Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: German authorities identify REvil and GangCrab ransomware bosses

Featured Deal: Protect up to 9 devices from ads and tracking for just $16 in this AdGuard deal

Latest Buyer's Guide: Best VPNs in 2025

Rogue Agent and Trojan Agent/Popup windows

Started by Lesgreen , Feb 25 2011 09:36 PM

This topic is locked

32 replies to this topic

#1 Lesgreen

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 25 February 2011 - 09:36 PM

I was getting popup windows saying "MSVideo.dll is not a valid Windows image". (See previous discussion in link). Norton Internet Security 2011 and Malbyteware found nothing. SuperAntiSpyware found the above viruses and removed them. I continued to see popup windows after doing this. To see if everything is gone I was instructed to create log files with DDS and GMER. The dds.txt file is pasted below. The attach.txt and ark.txt files are attached. I just tried to run SuperAntiSpyware and got the same error page about msvideo (see attached image). So something is still wrong.

DDS (Ver_10-12-12.02) - NTFSx86
Run by Les at 11:48:20.37 on Fri 02/25/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1331 [GMT -8:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Nuance\PDFViewerPlus\pdfpro5hook.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Wiley\Webster's New World\HKML_SRV.exe
C:\Documents and Settings\Les\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://finance.yahoo.com/p?v&k=pf_1
uSearch Bar =
mSearch Bar = hxxp://home.netscape.com/home/winsearch200.html
uSearchURL,(Default) = hxxp://keyword.netscape.com/keyword/%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: PlusIEEventHelper Class: {551a852f-39a6-44a7-9c13-afbec9185a9d} - c:\program files\nuance\pdfviewerplus\bin\PlusIEContextMenu.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\18.5.0.125\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\18.5.0.125\ips\IPSBHO.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: ZeonIEEventHelper Class: {da986d7d-ccaf-47b2-84fe-bfa1549bebf9} - c:\program files\nuance\pdfviewerplus\bin\ZeonIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\18.5.0.125\coIEPlg.dll
TB: Nuance PDF: {e3286bf1-e654-42ff-b4a6-5e111731df6b} - c:\program files\nuance\pdfviewerplus\bin\ZeonIEFavClient.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
EB: {182EC0BE-5110-49C8-A062-BEB1D02A220B} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: {9404901D-06DA-4B23-A0EE-3EA4F64EC9B3} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Norton Download Manager{NAV_Production_94_136_NUC}] c:\documents and settings\all users\documents\norton\{nav_production_94_136_nuc}\NAVDownloader[1].exe /m
uRun: [ISUSPM] c:\documents and settings\all users\application data\flexnet\connect\11\ISUSPM.exe -scheduler
mRun: [VTPreset] VTPreset.exe
mRun: [SystemTray] SysTray.Exe
mRun: [SunJavaUpdateSched] c:\program files\adobe\acrobat 9.0\designer 8.2\jre\bin\jusched.exe
mRun: [SecurDisc] c:\program files\nero\nero 7\incd\NBHGui.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [RoxioEngineUtility] "c:\program files\common files\roxio shared\system\EngUtil.exe"
mRun: [QD FastAndSafe] "c:\program files\common files\roxio shared\system\EngUtil.exe"
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [InCD] c:\program files\nero\nero 7\incd\InCD.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [ADUserMon] c:\program files\iomega\autodisk\ADUserMon.exe
mRun: [NSWosCheck] "c:\program files\norton systemworks basic edition\osCheck.exe"
mRun: [NswUiTray] c:\program files\norton systemworks basic edition\NswUiTray.exe
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe
mRun: [PPort12reminder] "c:\program files\nuance\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\12\config\ereg\Ereg.ini"
mRun: [PDFHook] c:\program files\nuance\pdfviewerplus\pdfpro5hook.exe
mRun: [PDF5 Registry Controller] c:\program files\nuance\pdfviewerplus\RegistryController.exe
mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wnwtra~1.lnk - c:\program files\wiley\webster's new world\HKML_SRV.exe
uPolicies-explorer: EditLevel = 0 (0x0)
dPolicies-explorer: EditLevel = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {5E638779-1818-4754-A595-EF1C63B87A56} - c:\program files\norton systemworks basic edition\norton cleanup\WCQuick.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
Trusted Zone: aol.com\free
DPF: DirectAnimation Java Classes - file://c:\windows\system\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\system\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso4.cab
DPF: {00000161-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/msaudio.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/Dcode/ActiveX/MSDcode.cab
DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/7/0/7/707a44ad-52ad-49af-b7ef-e21b6b0656e4/VirtualEarth3D.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {31564D57-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmvax.cab
DPF: {3BB1D69B-A780-4BE1-876E-F3D488877135} - hxxp://download.microsoft.com/download/3/B/E/3BE57995-8452-41F1-8297-DD75EF049853/VirtualEarth3D.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab
DPF: {428A9DEF-F057-402B-9F2D-A5887F4544ED} - hxxp://download.microsoft.com/download/f/0/2/f02b515c-7076-4cee-bc08-fd6fea594578/VirtualEarth3D.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222688023296
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37840.5036342593
DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CEBC955E-58AF-11D2-A30A-00A0C903492B} - hxxp://windowsupdate.microsoft.com/R686/V31Controls/x86/w98/en/actsetup.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {F234BAD4-178E-44D0-863B-25CE420F28BC} = 138.23.146.213,138.23.226.101
Filter: text/html - {ace5913e-4f2c-4b0f-8832-f14e6680e878} - c:\windows\system\msvideo.dll
Name-Space Handler: ftp\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\system32\NZDD.DLL
Name-Space Handler: http\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\system32\NZDD.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\qualcomm\eudora\EUSHLEXT.DLL
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\outlook express\setup50.exe" /APP:OE /CALLER:IE50 /user /install
mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\outlook express\setup50.exe" /app:oe /caller:ie50 /user /install - "c:\program files\outlook express\setup50.exe" /APP:OE /CALLER:IE50 /user /install
mASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\program files\outlook express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
mASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\program files\outlook express\setup50.exe" /app:wab /caller:win9x /user /install - "c:\program files\outlook express\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
mASetup: {9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} - c:\windows\system32\updcrl.exe -e -u c:\windows\system\verisignpub1.crl

============= SERVICES / DRIVERS ===============

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1205000.07d\SymDS.sys [2011-1-10 340016]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1205000.07d\SymEFA.sys [2011-1-10 652336]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\bashdefs\20110114.001\BHDrvx86.sys [2011-1-19 691248]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1205000.07d\Ironx86.sys [2011-1-10 136312]
R2 BCMNTIO;BCMNTIO;c:\progra~1\checkit\diagno~1\BCMNTIO.sys [2009-4-8 3744]
R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\verizon\iha_messagecenter\bin\Verizon_IHAMessageCenter.exe [2010-10-13 98304]
R2 MAPMEM;MAPMEM;c:\progra~1\checkit\diagno~1\MAPMEM.sys [2009-4-8 3904]
R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\18.5.0.125\ccSvcHst.exe [2011-1-10 130000]
R2 NProtectService;Norton UnErase Protection;c:\progra~1\norton~2\norton~1\NPROTECT.EXE [2008-9-25 95600]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\nuance\paperport\PDFProFiltSrvPP.exe [2010-2-10 144672]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-16 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\ipsdefs\20110223.001\IDSXpx86.sys [2011-2-23 341944]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\virusdefs\20110223.002\NAVENG.SYS [2011-2-23 86008]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\virusdefs\20110223.002\NAVEX15.SYS [2011-2-23 1360760]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-5 135664]
S3 cpuz132;cpuz132; [x]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\lavasoft\ad-aware\kernexplorer.sys --> c:\program files\lavasoft\ad-aware\KernExplorer.sys [?]
S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [2008-9-12 15104]
S3 VIASens;Vinyl Sensaura WDM 3D Audio Driver;c:\windows\system32\drivers\viasens.sys [2003-11-7 391680]

=============== Created Last 30 ================

2011-02-23 01:24:30 -------- d-----w- c:\docume~1\les\applic~1\SUPERAntiSpyware.com
2011-02-23 01:24:30 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2011-02-23 01:24:17 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-02-22 19:09:05 -------- d-----w- c:\docume~1\les\applic~1\FixCleaner
2011-02-22 19:08:52 -------- d-----w- c:\program files\FixCleaner
2011-02-22 19:08:19 -------- d-----w- c:\program files\Downloaded Installers
2011-02-19 01:09:36 -------- d-----w- c:\docume~1\les\applic~1\Verizon
2011-02-19 01:09:19 -------- d-----w- c:\docume~1\alluse~1\applic~1\Verizon
2011-02-16 19:38:31 -------- d-----w- c:\program files\common files\xing shared
2011-02-15 22:02:05 -------- d-----w- c:\docume~1\les\locals~1\applic~1\NPE
2011-02-15 21:45:17 -------- d-----w- c:\docume~1\alluse~1\applic~1\RegCure
2011-02-12 02:15:07 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-12 02:08:06 -------- d-----w- c:\docume~1\les\locals~1\applic~1\Sunbelt Software
2011-02-12 01:28:05 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-12 01:28:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-12 00:59:52 -------- d-----w- c:\docume~1\les\applic~1\Uniblue
2011-02-12 00:18:39 -------- d-----w- c:\program files\common files\Motive
2011-02-12 00:16:45 -------- d-----w- c:\program files\Verizon

==================== Find3M ====================

2011-02-16 19:37:58 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-02-16 19:37:58 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-10 21:21:13 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 23:13:35 100 ----a-w- c:\windows\system32\prsgrc.dll
2010-12-22 12:34:28 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:59:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:59:19 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 23:59:19 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:26:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55:26 385024 ----a-w- c:\windows\system32\html.iec
2010-12-09 15:15:09 718336 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 14:30:22 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-09 13:42:26 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 13:07:07 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-02 03:35:18 4280320 ----a-w- c:\windows\system32\GPhotos.scr

============= FINISH: 11:49:21.54 ===============

Previous discussion

This is the link to the previous discussion on this topic.

Merged posts. ~ OB

Attached Files

Attach.txt 20.79KB 2 downloads
ark.txt 10.11KB 6 downloads
screen snapshot.jpg 176.26KB 6 downloads

Edited by Orange Blossom, 25 February 2011 - 09:50 PM.

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 m0le

Can U Dig It?

Malware Response Team
34,528 posts
OFFLINE

Gender:Male
Location:London, UK
Local time:02:28 AM

Posted 04 March 2011 - 08:30 PM

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.

Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.
Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
Please reply to this post so I know you are there.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Once I receive a reply then I will return with your first instructions.

Thanks :thumbup2:

m0le is a proud member of UNITE

#3 Lesgreen

Topic Starter

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 05 March 2011 - 08:30 PM

Thank you for your response.

I had to use my computer during the week, in spite of the irritating popup windows. So possibly there have been changes since my scans done a week ago. Do you want me to redo any of the scans? I can still easily demonstrate the popup window if I run SuperAntiSpyware.

#4 m0le

Can U Dig It?

Malware Response Team
34,528 posts
OFFLINE

Gender:Male
Location:London, UK
Local time:02:28 AM

Posted 06 March 2011 - 01:39 PM

Please run OTL for me, this will work as DDS but we can do more with it.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

m0le is a proud member of UNITE

#5 Lesgreen

Topic Starter

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 07 March 2011 - 01:43 PM

Here is the otl.txt file:

OTL logfile created on: 3/7/2011 10:26:15 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Les\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 191.99 Gb Total Space | 143.00 Gb Free Space | 74.48% Space Free | Partition Type: NTFS
Drive F: | 40.89 Gb Total Space | 16.66 Gb Free Space | 40.73% Space Free | Partition Type: NTFS

Computer Name: LESGREEN | User Name: Les | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Les\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe ()
PRC - C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\Nuance\PDFViewerPlus\pdfPro5Hook.exe (Nuance Communications, Inc.)
PRC - C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\Speed Disk\NOPDB.exe (Symantec Corporation)
PRC - C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
PRC - C:\Program Files\Norton SystemWorks Basic Edition\NswUiTray.exe (Symantec Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
PRC - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
PRC - C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
PRC - C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Les\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\asOEHook.dll (Symantec Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\Microsoft.VC90.CRT\msvcr90.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\Microsoft.VC90.CRT\msvcp90.dll (Microsoft Corporation)
MOD - C:\WINDOWS\SYSTEM32\msacm32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\AppPatch\AcGenral.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Iomega Activity Disk2) -- File not found
SRV - (HidServ) -- File not found
SRV - (NIS) -- C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (IHA_MessageCenter) -- C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe ()
SRV - (PDFProFiltSrvPP) -- C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Speed Disk service) -- C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\Speed Disk\NOPDB.exe (Symantec Corporation)
SRV - (NProtectService) -- C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (Symantec RemoteAssist) -- C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (InCDsrv) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
SRV - (CCALib8) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (_IOMEGA_ACTIVE_DISK_SERVICE_) -- C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
SRV - (Iomega App Services) -- C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)

========== Driver Services (SafeList) ==========

DRV - (BHDrvx86) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110225.002\BHDrvx86.sys (Symantec Corporation)
DRV - (SymEvent) -- C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110307.002\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110307.002\NAVENG.SYS (Symantec Corporation)
DRV - (SYMTDI) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMTDI.SYS (Symantec Corporation)
DRV - (SymIMMP) -- C:\WINDOWS\SYSTEM32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SymIM) -- C:\WINDOWS\SYSTEM32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\WINDOWS\System32\Drivers\NIS\1205000.07D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\Ironx86.SYS (Symantec Corporation)
DRV - (IDSxpx86) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110303.001\IDSXpx86.sys (Symantec Corporation)
DRV - (SymDS) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMDS.SYS (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SDdriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\SdDriver.SYS (Symantec Corporation)
DRV - (NPDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\NPDRIVER.SYS (Symantec Corporation)
DRV - (gameenum) -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\SYSTEM32\DRIVERS\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (incdrm) -- C:\WINDOWS\SYSTEM32\DRIVERS\InCDRm.sys (Nero AG)
DRV - (InCDPass) -- C:\WINDOWS\SYSTEM32\DRIVERS\InCDPass.sys (Nero AG)
DRV - (InCDfs) -- C:\WINDOWS\SYSTEM32\DRIVERS\InCDfs.sys (Nero AG)
DRV - (Cdralw2k) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (S3Psddr) -- C:\WINDOWS\SYSTEM32\DRIVERS\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (VIAudio) Vinyl AC'97 Audio Controller (WDM) -- C:\WINDOWS\SYSTEM32\DRIVERS\viaudios.sys (VIA Technologies, Inc.)
DRV - (MAPMEM) -- C:\Program Files\CheckIt\Diagnostics\MAPMEM.SYS ()
DRV - (BCMNTIO) -- C:\Program Files\CheckIt\Diagnostics\BCMNTIO.SYS ()
DRV - (VIASens) -- C:\WINDOWS\SYSTEM32\DRIVERS\viasens.sys (Sensaura Ltd)
DRV - (cdudf_xp) -- C:\WINDOWS\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys (Roxio)
DRV - (PQNTDrv) -- C:\WINDOWS\System32\drivers\PQNTDRV.sys (PowerQuest Corporation)
DRV - (iomdisk) -- C:\WINDOWS\System32\DRIVERS\iomdisk.sys (Iomega Corporation)
DRV - (ms_mpu401) -- C:\WINDOWS\SYSTEM32\DRIVERS\msmpu401.sys (Microsoft Corporation)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/p?v&k=pf_1
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\SYSTEM32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://finance.yahoo.com/p?v&k=pf_1"

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2011/01/10 13:27:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn\ [2011/01/10 13:20:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010/01/15 15:17:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010/11/05 10:58:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/02/16 11:38:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.02\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/01/25 11:52:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.02\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/01/25 11:52:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/01/25 11:52:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/12/19 13:18:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]

[2006/12/27 13:10:30 | 000,000,377 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\AOL.gif
[2006/12/27 13:10:30 | 000,000,553 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\AOL.src
[2006/12/27 13:10:30 | 000,001,076 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\google.gif
[2006/12/27 13:10:30 | 000,000,670 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\google.src
[2006/12/27 13:10:30 | 000,000,932 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\jeeves.gif
[2006/12/27 13:10:30 | 000,000,590 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\jeeves.src
[2006/12/27 13:10:30 | 000,000,380 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\NetscapeSearch.gif
[2006/12/27 13:10:30 | 000,000,999 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\NetscapeSearch.src
[2006/12/27 13:10:30 | 000,000,088 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\yahoo.gif
[2006/12/27 13:10:30 | 000,000,716 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\yahoo.src

O1 HOSTS File: ([2010/01/14 10:53:14 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDFViewerPlus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDFViewerPlus\bin\ZeonIEFavClient.dll (Zeon Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDFViewerPlus\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\SYSTEM32\ieframe.dll (Microsoft Corporation)
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\SYSTEM32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NSWosCheck] C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [NswUiTray] C:\Program Files\Norton SystemWorks Basic Edition\NswUiTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDFViewerPlus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDFViewerPlus\pdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\SYSTEM32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [PPort12reminder] C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QD FastAndSafe] C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe (Roxio)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [RoxioEngineUtility] C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe (Roxio)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Adobe\Acrobat 9.0\Designer 8.2\jre\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SystemTray] C:\WINDOWS\System32\systray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [VTPreset] C:\WINDOWS\System32\VTPreset.exe (S3 Graphics, Inc.)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\SYSTEM32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSPM] C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [Norton Download Manager{NAV_Production_94_136_NUC}] File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeText =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeCaption =
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk ()
O9 - Extra 'Tools' menuitem : Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\SYSTEM32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\SYSTEM32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\SYSTEM32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {00000161-0000-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/msaudio.cab (Reg Error: Key error.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} http://download.microsoft.com/download/7/0/7/707a44ad-52ad-49af-b7ef-e21b6b0656e4/VirtualEarth3D.cab (SentinelVE3D Class)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31564D57-0000-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/wmvax.cab (Reg Error: Key error.)
O16 - DPF: {3BB1D69B-A780-4BE1-876E-F3D488877135} http://download.microsoft.com/download/3/B/E/3BE57995-8452-41F1-8297-DD75EF049853/VirtualEarth3D.cab (SentinelProxy Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {428A9DEF-F057-402B-9F2D-A5887F4544ED} http://download.microsoft.com/download/f/0/2/f02b515c-7076-4cee-bc08-fd6fea594578/VirtualEarth3D.cab (SentinelProxy Class)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222688023296 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37840.5036342593 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_18)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CEBC955E-58AF-11D2-A30A-00A0C903492B} http://windowsupdate.microsoft.com/R686/V31Controls/x86/w98/en/actsetup.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.)
O16 - DPF: Internet Explorer Classes for Java file://C:\WINDOWS\SYSTEM\iejava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso4.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 138.23.146.213 138.23.201.101
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\lid {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\SYSTEM32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\SYSTEM32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\SYSTEM32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\SYSTEM32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\SYSTEM32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\SYSTEM32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Les\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Les\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files\Qualcomm\Eudora\EuShlExt.dll (Qualcomm Inc.)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [1999/10/23 03:43:30 | 000,000,692 | ---- | M] () - C:\AUTOEXEC -- [ NTFS ]
O32 - AutoRun File - [2003/08/07 10:11:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/04/26 17:02:36 | 000,000,000 | ---- | M] () - C:\autoexec.ds -- [ NTFS ]
O32 - AutoRun File - [1999/10/23 03:43:30 | 000,000,692 | ---- | M] () - C:\AUTOEXEC -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/07 10:19:51 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Les\Desktop\OTL.exe
[2011/03/04 11:01:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\EndNote
[2011/03/04 11:01:07 | 000,000,000 | ---D | C] -- C:\Program Files\EndNote X1
[2011/03/03 11:37:59 | 000,044,024 | R--- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SymIM.sys
[2011/03/03 11:23:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2011/02/22 17:24:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\SUPERAntiSpyware.com
[2011/02/22 17:24:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/02/22 17:24:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Start Menu\Programs\SUPERAntiSpyware
[2011/02/22 17:24:17 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/02/22 17:22:52 | 010,464,584 | ---- | C] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware.exe
[2011/02/22 11:09:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\FixCleaner
[2011/02/22 11:08:52 | 000,000,000 | ---D | C] -- C:\Program Files\FixCleaner
[2011/02/22 11:08:19 | 000,000,000 | ---D | C] -- C:\Program Files\Downloaded Installers
[2011/02/18 17:09:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\Personal\My Videos
[2011/02/18 17:09:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\Verizon
[2011/02/18 17:09:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Verizon
[2011/02/16 11:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2011/02/16 11:38:19 | 000,198,848 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2011/02/16 11:38:03 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2011/02/16 11:38:03 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2011/02/16 11:38:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Real
[2011/02/16 11:37:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Real
[2011/02/15 14:02:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Local Settings\Application Data\NPE
[2011/02/15 13:45:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2011/02/11 18:15:07 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/02/11 18:08:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Local Settings\Application Data\Sunbelt Software
[2011/02/11 17:28:05 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/02/11 17:28:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/02/11 17:28:02 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/02/11 16:59:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\Uniblue
[2011/02/11 16:20:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\Motive
[2011/02/11 16:18:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2011/02/11 16:16:45 | 000,000,000 | ---D | C] -- C:\Program Files\Verizon
[274 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/07 10:27:00 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{01EA7816-2C2F-44D4-9017-536659A092B7}.job
[2011/03/07 10:24:27 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
[2011/03/07 10:20:10 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/03/07 10:20:10 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/03/07 10:20:09 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/03/07 10:19:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Les\Desktop\OTL.exe
[2011/03/07 10:05:02 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/03/07 09:57:07 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/03/07 09:56:42 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/03/07 09:55:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/04 16:17:48 | 000,002,225 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\EndNote Program.lnk
[2011/03/04 10:09:04 | 000,334,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/03 15:12:36 | 048,149,880 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\ENX102Inst.exe
[2011/03/03 11:14:52 | 000,000,212 | RHS- | M] () -- C:\boot.ini
[2011/03/01 15:39:36 | 000,006,656 | ---- | M] () -- C:\WINDOWS\Personal\gardengrove.est
[2011/03/01 15:33:50 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Microsoft Streets & Trips 2009.lnk
[2011/02/28 18:19:17 | 000,448,882 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Dorymyrmex bicolor.jpg
[2011/02/28 18:15:00 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/02/28 18:13:51 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/02/28 18:13:50 | 000,047,616 | ---- | M] () -- C:\Documents and Settings\Les\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/28 18:09:55 | 000,487,889 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Argentine ant.jpg
[2011/02/25 11:29:51 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Les\defogger_reenable
[2011/02/25 10:58:20 | 000,624,128 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\dds.scr
[2011/02/24 15:43:10 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Defogger.exe
[2011/02/23 16:28:13 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\qczjdkd6.exe
[2011/02/23 11:25:14 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/02/22 17:24:20 | 000,001,687 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/02/22 17:23:23 | 010,464,584 | ---- | M] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware.exe
[2011/02/22 14:01:34 | 000,104,537 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\error2.jpg
[2011/02/22 11:50:15 | 001,844,258 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help.mht
[2011/02/18 13:45:31 | 002,482,840 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\NPE.exe
[2011/02/18 12:11:39 | 008,559,782 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\error2.rtf
[2011/02/16 11:38:19 | 000,198,848 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2011/02/16 11:38:03 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2011/02/16 11:38:03 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2011/02/16 11:38:02 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll
[2011/02/15 15:06:49 | 000,196,096 | ---- | M] () -- C:\WINDOWS\Personal\American Jewish University.est
[2011/02/15 12:32:37 | 000,592,413 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\patagonicus.jpg
[2011/02/11 18:14:33 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/02/11 17:28:06 | 000,000,793 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/10 11:53:08 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[274 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/03 15:12:32 | 048,149,880 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\ENX102Inst.exe
[2011/02/28 18:19:33 | 000,448,882 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Dorymyrmex bicolor.jpg
[2011/02/28 18:10:57 | 000,487,889 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Argentine ant.jpg
[2011/02/25 11:36:43 | 000,624,128 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\dds.scr
[2011/02/25 11:29:51 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Les\defogger_reenable
[2011/02/25 10:52:10 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Defogger.exe
[2011/02/23 16:28:12 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\qczjdkd6.exe
[2011/02/23 11:25:14 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/02/22 17:24:20 | 000,001,687 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/02/22 14:01:34 | 000,104,537 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\error2.jpg
[2011/02/22 11:50:12 | 001,844,258 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help.mht
[2011/02/18 12:36:00 | 002,482,840 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\NPE.exe
[2011/02/18 12:11:38 | 008,559,782 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\error2.rtf
[2011/02/16 11:38:58 | 000,000,274 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/02/16 11:38:57 | 000,000,282 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/02/15 15:06:49 | 000,196,096 | ---- | C] () -- C:\WINDOWS\Personal\American Jewish University.est
[2011/02/15 12:33:26 | 000,592,413 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\patagonicus.jpg
[2011/02/11 18:28:25 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/02/11 17:28:06 | 000,000,793 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/04 13:44:47 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\Les\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/04 13:39:38 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/10/18 13:50:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\biv9x40.dll
[2010/02/16 14:42:32 | 000,033,036 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2010/01/25 14:28:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\KZM10.INI
[2010/01/14 10:36:29 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/01/14 10:36:29 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/01/14 10:36:29 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/01/14 10:36:29 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/01/14 10:36:29 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/06/05 17:47:00 | 000,061,208 | ---- | C] () -- C:\WINDOWS\System32\MPEG4E-uninstall.exe
[2008/10/28 03:32:40 | 000,950,272 | ---- | C] () -- C:\WINDOWS\System32\MPEG4Evfw.dll
[2008/10/02 11:46:34 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4906.dll
[2008/10/01 13:55:37 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/09/29 02:30:11 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2008/09/29 02:27:55 | 001,399,880 | R--- | C] () -- C:\WINDOWS\System32\igklg450.dll
[2008/09/29 02:27:54 | 001,843,784 | R--- | C] () -- C:\WINDOWS\System32\igklg400.dll
[2008/09/29 02:27:53 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v1409.dll
[2008/09/29 02:27:53 | 000,104,636 | R--- | C] () -- C:\WINDOWS\System32\igmedcompkrn.dll
[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/01/11 10:09:26 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2008/01/08 17:25:46 | 000,002,928 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/09/24 12:18:02 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\FLT_ffdshow.dll
[2007/08/15 14:33:14 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007/06/07 14:10:50 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\ac3config.exe
[2007/06/02 23:08:08 | 000,104,960 | ---- | C] () -- C:\WINDOWS\System32\dsmux.exe
[2007/06/02 23:06:14 | 000,151,040 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll
[2007/06/02 23:06:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\avi.dll
[2007/06/02 23:05:58 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\gdsmux.exe
[2007/06/02 23:05:44 | 000,142,848 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll
[2007/06/02 23:05:38 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\avss.dll
[2007/06/02 23:05:34 | 000,123,392 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll
[2007/06/02 23:05:20 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\mmfinfo.dll
[2007/06/02 23:05:04 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\ts.dll
[2007/06/02 23:04:54 | 000,233,984 | ---- | C] () -- C:\WINDOWS\System32\dxr.dll
[2007/06/02 23:04:32 | 000,100,352 | ---- | C] () -- C:\WINDOWS\System32\avs.dll
[2007/06/02 23:04:28 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\mkv2vfr.exe
[2007/06/02 23:04:16 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
[2007/06/02 23:04:14 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
[2007/04/15 15:33:33 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini
[2007/04/15 15:33:25 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv
[2007/02/13 14:33:29 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll
[2007/02/01 13:31:36 | 000,000,010 | ---- | C] () -- C:\WINDOWS\PureEdgeAPI.ini
[2006/11/01 06:54:30 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/09/12 14:24:09 | 000,046,345 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/08/29 09:30:35 | 000,059,172 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2004/12/16 17:56:29 | 000,002,048 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2004/09/16 11:51:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\frontpg.ini
[2004/09/16 11:48:27 | 000,021,791 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
[2004/09/16 11:48:25 | 000,001,037 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
[2004/09/16 11:46:16 | 000,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2004/09/16 11:46:14 | 000,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2004/09/16 11:45:58 | 000,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2004/09/16 11:45:43 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/04 08:07:22 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\myzhya8.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2004/08/04 07:56:44 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll
[2004/08/04 07:56:44 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2004/08/04 07:56:44 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\tilnuwe.dll
[2004/08/04 00:56:46 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/08/02 21:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/07/01 11:14:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2004/06/07 18:20:56 | 000,000,395 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2004/06/07 18:20:27 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2004/03/25 10:43:15 | 000,047,616 | ---- | C] () -- C:\Documents and Settings\Les\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/02/18 16:13:19 | 000,061,440 | ---- | C] () -- C:\WINDOWS\wnUninstall.exe
[2003/11/06 10:34:36 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Les\Application Data\dm.ini
[2003/08/25 16:08:20 | 000,105,168 | ---- | C] () -- C:\WINDOWS\GREUninstall.exe
[2003/08/20 14:32:59 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2003/08/20 14:32:59 | 000,048,640 | ---- | C] () -- C:\WINDOWS\catalogSubInstaller.exe
[2003/08/07 10:27:43 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2003/08/07 10:20:52 | 000,000,660 | ---- | C] () -- C:\WINDOWS\LnkStub.dat
[2003/08/07 10:15:56 | 000,012,327 | ---- | C] () -- C:\WINDOWS\IOS.INI
[2003/08/07 10:15:56 | 000,006,239 | ---- | C] () -- C:\WINDOWS\WTGW60US.INI
[2003/08/07 10:15:56 | 000,005,393 | ---- | C] () -- C:\WINDOWS\EMCGM9.INI
[2003/08/07 10:15:56 | 000,005,068 | ---- | C] () -- C:\WINDOWS\DELETEFI.INI
[2003/08/07 10:15:56 | 000,004,595 | ---- | C] () -- C:\WINDOWS\HGW2.INI
[2003/08/07 10:15:56 | 000,004,347 | ---- | C] () -- C:\WINDOWS\mixerdef.ini
[2003/08/07 10:15:56 | 000,004,319 | ---- | C] () -- C:\WINDOWS\ISGDI16.INI
[2003/08/07 10:15:56 | 000,004,312 | ---- | C] () -- C:\WINDOWS\HFX100.INI
[2003/08/07 10:15:56 | 000,003,921 | ---- | C] () -- C:\WINDOWS\BIRDSNA2.INI
[2003/08/07 10:15:56 | 000,003,914 | ---- | C] () -- C:\WINDOWS\EMPS_9.INI
[2003/08/07 10:15:56 | 000,003,598 | ---- | C] () -- C:\WINDOWS\HTMLHELP.INI
[2003/08/07 10:15:56 | 000,003,592 | ---- | C] () -- C:\WINDOWS\BOWSV2.INI
[2003/08/07 10:15:56 | 000,003,544 | ---- | C] () -- C:\WINDOWS\MSMUSCTL.INI
[2003/08/07 10:15:56 | 000,003,183 | ---- | C] () -- C:\WINDOWS\telephon.ini
[2003/08/07 10:15:56 | 000,002,526 | ---- | C] () -- C:\WINDOWS\PUBLISH4.INI
[2003/08/07 10:15:56 | 000,002,284 | ---- | C] () -- C:\WINDOWS\FONTSMRT.INI
[2003/08/07 10:15:56 | 000,002,041 | ---- | C] () -- C:\WINDOWS\MSFNTMAP.INI
[2003/08/07 10:15:56 | 000,002,035 | ---- | C] () -- C:\WINDOWS\DOSAPP.INI
[2003/08/07 10:15:56 | 000,001,905 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2003/08/07 10:15:56 | 000,001,790 | ---- | C] () -- C:\WINDOWS\TBSQUIZ.INI
[2003/08/07 10:15:56 | 000,001,786 | ---- | C] () -- C:\WINDOWS\SYSTAT6.INI
[2003/08/07 10:15:56 | 000,001,780 | ---- | C] () -- C:\WINDOWS\EXCEL4.INI
[2003/08/07 10:15:56 | 000,001,745 | ---- | C] () -- C:\WINDOWS\ascd_tmp.ini
[2003/08/07 10:15:56 | 000,001,663 | ---- | C] () -- C:\WINDOWS\CHTBAK.INI
[2003/08/07 10:15:56 | 000,001,650 | ---- | C] () -- C:\WINDOWS\intuprof.ini
[2003/08/07 10:15:56 | 000,001,516 | ---- | C] () -- C:\WINDOWS\AD_PREFS.INI
[2003/08/07 10:15:56 | 000,001,399 | ---- | C] () -- C:\WINDOWS\QfnOnl.ini
[2003/08/07 10:15:56 | 000,001,350 | ---- | C] () -- C:\WINDOWS\NETSCAPE.INI
[2003/08/07 10:15:56 | 000,001,319 | ---- | C] () -- C:\WINDOWS\HP_CLJ85.INI
[2003/08/07 10:15:56 | 000,001,212 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2003/08/07 10:15:56 | 000,001,197 | ---- | C] () -- C:\WINDOWS\WTAPI.INI
[2003/08/07 10:15:56 | 000,001,010 | ---- | C] () -- C:\WINDOWS\WORDWIZ.INI
[2003/08/07 10:15:56 | 000,000,959 | ---- | C] () -- C:\WINDOWS\wnsetup.ini
[2003/08/07 10:15:56 | 000,000,921 | ---- | C] () -- C:\WINDOWS\EQNEDIT.INI
[2003/08/07 10:15:56 | 000,000,865 | ---- | C] () -- C:\WINDOWS\DOSREP.INI
[2003/08/07 10:15:56 | 000,000,846 | ---- | C] () -- C:\WINDOWS\JUKEBOX.INI
[2003/08/07 10:15:56 | 000,000,826 | ---- | C] () -- C:\WINDOWS\EMWMF9.INI
[2003/08/07 10:15:56 | 000,000,787 | ---- | C] () -- C:\WINDOWS\SCANREG.INI
[2003/08/07 10:15:56 | 000,000,758 | ---- | C] () -- C:\WINDOWS\PERWIN96.INI
[2003/08/07 10:15:56 | 000,000,701 | ---- | C] () -- C:\WINDOWS\WINWORD6.INI
[2003/08/07 10:15:56 | 000,000,663 | ---- | C] () -- C:\WINDOWS\artview.ini
[2003/08/07 10:15:56 | 000,000,594 | ---- | C] () -- C:\WINDOWS\PERWIN95.INI
[2003/08/07 10:15:56 | 000,000,576 | ---- | C] () -- C:\WINDOWS\TL6.INI
[2003/08/07 10:15:56 | 000,000,546 | ---- | C] () -- C:\WINDOWS\FTGW.INI
[2003/08/07 10:15:56 | 000,000,535 | ---- | C] () -- C:\WINDOWS\MSTXTCNV.INI
[2003/08/07 10:15:56 | 000,000,467 | ---- | C] () -- C:\WINDOWS\SIDEKICK.INI
[2003/08/07 10:15:56 | 000,000,444 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2003/08/07 10:15:56 | 000,000,429 | ---- | C] () -- C:\WINDOWS\EBJPG9.INI
[2003/08/07 10:15:56 | 000,000,382 | ---- | C] () -- C:\WINDOWS\EBTIF9.INI
[2003/08/07 10:15:56 | 000,000,375 | ---- | C] () -- C:\WINDOWS\EBBMP9.INI
[2003/08/07 10:15:56 | 000,000,350 | ---- | C] () -- C:\WINDOWS\QE.INI
[2003/08/07 10:15:56 | 000,000,341 | ---- | C] () -- C:\WINDOWS\XMPLAYER.INI
[2003/08/07 10:15:56 | 000,000,338 | ---- | C] () -- C:\WINDOWS\EXCEL.INI
[2003/08/07 10:15:56 | 000,000,331 | ---- | C] () -- C:\WINDOWS\RBJRD.INI
[2003/08/07 10:15:56 | 000,000,315 | ---- | C] () -- C:\WINDOWS\HPWTRMRK.INI
[2003/08/07 10:15:56 | 000,000,291 | ---- | C] () -- C:\WINDOWS\ORCH.INI
[2003/08/07 10:15:56 | 000,000,289 | ---- | C] () -- C:\WINDOWS\SPCDIRS.INI
[2003/08/07 10:15:56 | 000,000,280 | ---- | C] () -- C:\WINDOWS\TTEMBED.INI
[2003/08/07 10:15:56 | 000,000,275 | ---- | C] () -- C:\WINDOWS\FILEMAN.INI
[2003/08/07 10:15:56 | 000,000,252 | ---- | C] () -- C:\WINDOWS\TIMEWARP.INI
[2003/08/07 10:15:56 | 000,000,247 | ---- | C] () -- C:\WINDOWS\EMPCT9.INI
[2003/08/07 10:15:56 | 000,000,243 | ---- | C] () -- C:\WINDOWS\SMI.INI
[2003/08/07 10:15:56 | 000,000,237 | ---- | C] () -- C:\WINDOWS\MSMAIL.INI
[2003/08/07 10:15:56 | 000,000,234 | ---- | C] () -- C:\WINDOWS\TRDSPDRV.INI
[2003/08/07 10:15:56 | 000,000,232 | ---- | C] () -- C:\WINDOWS\IMWMF9.INI
[2003/08/07 10:15:56 | 000,000,228 | ---- | C] () -- C:\WINDOWS\VSADVCTL.INI
[2003/08/07 10:15:56 | 000,000,228 | ---- | C] () -- C:\WINDOWS\TOOLBOX.INI
[2003/08/07 10:15:56 | 000,000,224 | ---- | C] () -- C:\WINDOWS\AUDIOSTA.INI
[2003/08/07 10:15:56 | 000,000,207 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2003/08/07 10:15:56 | 000,000,205 | ---- | C] () -- C:\WINDOWS\CLIPBRD.INI
[2003/08/07 10:15:56 | 000,000,176 | ---- | C] () -- C:\WINDOWS\WINDAT.INI
[2003/08/07 10:15:56 | 000,000,159 | ---- | C] () -- C:\WINDOWS\sbpci.ini
[2003/08/07 10:15:56 | 000,000,125 | ---- | C] () -- C:\WINDOWS\ems16.ini
[2003/08/07 10:15:56 | 000,000,122 | ---- | C] () -- C:\WINDOWS\protocol.ini
[2003/08/07 10:15:56 | 000,000,120 | ---- | C] () -- C:\WINDOWS\MODLIST.INI
[2003/08/07 10:15:56 | 000,000,107 | ---- | C] () -- C:\WINDOWS\CMSurround.ini
[2003/08/07 10:15:56 | 000,000,099 | ---- | C] () -- C:\WINDOWS\FOXPRO.INI
[2003/08/07 10:15:56 | 000,000,094 | ---- | C] () -- C:\WINDOWS\AUTOMAP.INI
[2003/08/07 10:15:56 | 000,000,092 | ---- | C] () -- C:\WINDOWS\hyprview.ini
[2003/08/07 10:15:56 | 000,000,089 | ---- | C] () -- C:\WINDOWS\UULAUNCH.INI
[2003/08/07 10:15:56 | 000,000,085 | ---- | C] () -- C:\WINDOWS\CLOCK.INI
[2003/08/07 10:15:56 | 000,000,077 | ---- | C] () -- C:\WINDOWS\WINPROBE.INI
[2003/08/07 10:15:56 | 000,000,076 | ---- | C] () -- C:\WINDOWS\DBD.INI
[2003/08/07 10:15:56 | 000,000,072 | ---- | C] () -- C:\WINDOWS\SCANMGR.INI
[2003/08/07 10:15:56 | 000,000,069 | ---- | C] () -- C:\WINDOWS\MUSICBOX.INI
[2003/08/07 10:15:56 | 000,000,069 | ---- | C] () -- C:\WINDOWS\efaxpump.ini
[2003/08/07 10:15:56 | 000,000,065 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2003/08/07 10:15:56 | 000,000,065 | ---- | C] () -- C:\WINDOWS\KEYPAD.INI
[2003/08/07 10:15:56 | 000,000,063 | ---- | C] () -- C:\WINDOWS\ODBCISAM.INI
[2003/08/07 10:15:56 | 000,000,057 | ---- | C] () -- C:\WINDOWS\pixworks.ini
[2003/08/07 10:15:56 | 000,000,057 | ---- | C] () -- C:\WINDOWS\HPDS22.INI
[2003/08/07 10:15:56 | 000,000,052 | ---- | C] () -- C:\WINDOWS\THBVIEW.INI
[2003/08/07 10:15:56 | 000,000,051 | ---- | C] () -- C:\WINDOWS\TCWIN.INI
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\schdplus.ini
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\QDQIck.ini
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\ENTPACK.INI
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\COMPANON.INI
[2003/08/07 10:15:56 | 000,000,046 | ---- | C] () -- C:\WINDOWS\MOZART.INI
[2003/08/07 10:15:56 | 000,000,044 | ---- | C] () -- C:\WINDOWS\ODBCDDP.INI
[2003/08/07 10:15:56 | 000,000,044 | ---- | C] () -- C:\WINDOWS\EXCHNG32.INI
[2003/08/07 10:15:56 | 000,000,037 | ---- | C] () -- C:\WINDOWS\TBH.INI
[2003/08/07 10:15:56 | 000,000,034 | ---- | C] () -- C:\WINDOWS\SOL.INI
[2003/08/07 10:15:56 | 000,000,033 | ---- | C] () -- C:\WINDOWS\EWAN.INI
[2003/08/07 10:15:56 | 000,000,031 | ---- | C] () -- C:\WINDOWS\VBA.INI
[2003/08/07 10:15:56 | 000,000,031 | ---- | C] () -- C:\WINDOWS\bscrrun.ini
[2003/08/07 10:15:56 | 000,000,028 | ---- | C] () -- C:\WINDOWS\MOUSE.INI
[2003/08/07 10:15:56 | 000,000,028 | ---- | C] () -- C:\WINDOWS\HMCSTUFF.INI
[2003/08/07 10:15:56 | 000,000,022 | ---- | C] () -- C:\WINDOWS\calera.ini
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VTPWRA.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\TCWINCA.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\setscan.ini
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\progman.ini
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NREGEDIT.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSINFO32.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSDRAW.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HURRICAN.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ATIDESK.INI
[2003/08/07 10:15:55 | 000,007,885 | ---- | C] () -- C:\WINDOWS\NETDET.INI
[2003/08/07 10:15:55 | 000,006,217 | ---- | C] () -- C:\WINDOWS\ZREG32S.INI
[2003/08/07 10:15:55 | 000,002,221 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2003/08/07 10:15:55 | 000,000,948 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2003/08/07 10:15:55 | 000,000,620 | ---- | C] () -- C:\WINDOWS\MSD.INI
[2003/08/07 10:15:55 | 000,000,512 | ---- | C] () -- C:\WINDOWS\PIB.INI
[2003/08/07 10:15:55 | 000,000,480 | ---- | C] () -- C:\WINDOWS\YSTATION.INI
[2003/08/07 10:15:55 | 000,000,186 | ---- | C] () -- C:\WINDOWS\NCDINFO.INI
[2003/08/07 10:15:55 | 000,000,175 | ---- | C] () -- C:\WINDOWS\WINFILE.INI
[2003/08/07 10:15:55 | 000,000,165 | ---- | C] () -- C:\WINDOWS\MSACM.INI
[2003/08/07 10:15:55 | 000,000,136 | ---- | C] () -- C:\WINDOWS\SERIALNO.INI
[2003/08/07 10:15:55 | 000,000,117 | ---- | C] () -- C:\WINDOWS\TDCI.INI
[2003/08/07 10:15:55 | 000,000,095 | ---- | C] () -- C:\WINDOWS\LDG.INI
[2003/08/07 10:15:55 | 000,000,067 | ---- | C] () -- C:\WINDOWS\WINMETER.INI
[2003/08/07 10:15:55 | 000,000,060 | ---- | C] () -- C:\WINDOWS\POWERPNT.INI
[2003/08/07 10:15:55 | 000,000,054 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2003/08/07 10:15:55 | 000,000,038 | ---- | C] () -- C:\WINDOWS\ACCWIZ.INI
[2003/08/07 10:15:55 | 000,000,026 | ---- | C] () -- C:\WINDOWS\MSOFFICE.INI
[2003/08/07 10:15:55 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2003/08/07 10:15:55 | 000,000,022 | ---- | C] () -- C:\WINDOWS\SHAREMEM.INI
[2003/08/07 10:15:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WHAKSHOT.INI
[2003/08/07 10:15:54 | 000,000,174 | ---- | C] () -- C:\WINDOWS\WINMINE.INI
[2003/08/07 10:07:37 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2003/08/07 10:01:49 | 000,004,590 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/08/07 10:00:49 | 000,334,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/08/01 10:36:43 | 001,237,140 | RH-- | C] () -- C:\WINDOWS\HWINFO.DAT
[2003/08/01 10:28:08 | 000,000,025 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/08/01 10:25:27 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\MEMBG.DLL
[2003/08/01 10:25:15 | 000,006,550 | ---- | C] () -- C:\WINDOWS\JAUTOEXP.DAT
[2003/07/22 21:41:18 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\CMedia.dll
[2003/07/22 21:41:17 | 000,049,152 | ---- | C] () -- C:\WINDOWS\W2K_c38uinst.exe
[2003/07/22 21:41:17 | 000,049,152 | ---- | C] () -- C:\WINDOWS\c38uinst.exe
[2003/07/22 18:06:24 | 000,077,824 | ---- | C] () -- C:\WINDOWS\uinst001.exe
[2003/06/26 18:54:50 | 000,105,168 | ---- | C] () -- C:\WINDOWS\NSUninst.exe
[2003/06/26 18:54:34 | 000,017,720 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2003/06/25 18:37:02 | 000,048,640 | ---- | C] () -- C:\WINDOWS\System32\HPFPNP.DLL
[2003/06/23 16:34:30 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Les\Local Settings\Application Data\fusioncache.dat
[2003/05/26 12:24:38 | 000,083,086 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2003/02/06 17:49:05 | 000,036,352 | ---- | C] () -- C:\WINDOWS\hpfsched.exe
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/16 15:52:19 | 000,634,065 | ---- | C] () -- C:\WINDOWS\cd32.exe
[2002/02/07 17:33:10 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\icmfilter.dll
[2001/12/05 16:07:02 | 000,100,864 | ---- | C] () -- C:\WINDOWS\System32\Dc50ip32.dll
[2001/12/05 16:06:59 | 000,065,864 | ---- | C] () -- C:\WINDOWS\System32\Digita.sys
[2001/12/05 16:06:57 | 000,007,808 | ---- | C] () -- C:\WINDOWS\System32\dc240u.sys
[2001/12/05 16:06:41 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\SoyWeb.dll
[2001/12/05 16:06:41 | 000,006,144 | ---- | C] () -- C:\WINDOWS\System32\ImgLibLead.dll
[2001/12/05 16:06:40 | 000,248,832 | ---- | C] () -- C:\WINDOWS\System32\ECircles.dll
[2001/08/23 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 12:00:00 | 000,522,794 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 12:00:00 | 000,101,114 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 12:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 12:00:00 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\zydrxqr.dll
[2001/08/23 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001/08/23 12:00:00 | 000,000,339 | ---- | C] () -- C:\WINDOWS\System32\wj6tyop.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\zf44tsw.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\z1j4tji.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\ycsep0m.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\wkufhx9.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\s0rmcnd.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\rjwnt7n.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\q0086qh.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\mhny8cu.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\hoe1fcn.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\hna3tb2.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\ek695fx.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\e65s219.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\e38o6gw.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\bsfwj3c.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\acmyv8b.dll
[2001/04/27 16:47:18 | 000,122,345 | ---- | C] () -- C:\WINDOWS\preuninst.EXE
[2001/04/27 16:47:08 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\mstart.exe
[2001/04/27 16:47:07 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Dbwin32.exe
[2001/04/26 10:53:20 | 000,282,624 | ---- | C] () -- C:\WINDOWS\unin0411.exe
[2001/04/23 08:54:51 | 000,014,942 | ---- | C] () -- C:\WINDOWS\UNINSDEL.EXE
[2000/06/14 16:44:38 | 000,181,760 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2000/03/02 19:42:08 | 000,269,312 | ---- | C] () -- C:\WINDOWS\System32\FPXIG.DLL
[2000/03/02 19:42:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\System32\IGFPX32P.DLL
[2000/03/02 19:42:08 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\JPEGACC.DLL
[2000/02/29 15:19:40 | 000,011,264 | ---- | C] () -- C:\WINDOWS\System32\Thumb.dll
[2000/02/29 15:19:18 | 000,101,376 | ---- | C] () -- C:\WINDOWS\System32\welsof32.dll
[1999/10/22 12:07:47 | 000,011,079 | -H-- | C] () -- C:\Program Files\folder.htt
[1999/07/13 17:50:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\verinst.exe
[1999/07/12 14:50:53 | 000,009,026 | ---- | C] () -- C:\WINDOWS\hh.dat
[1999/06/11 16:29:01 | 000,016,384 | ---- | C] () -- C:\WINDOWS\hpu.dll
[1999/06/01 10:28:38 | 000,000,010 | ---- | C] () -- C:\WINDOWS\evypaths.bin
[1999/03/26 16:40:45 | 000,020,992 | ---- | C] () -- C:\WINDOWS\System32\PFMAPI32.DLL
[1998/10/28 13:59:44 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL
[1998/05/14 11:37:02 | 000,016,384 | ---- | C] () -- C:\WINDOWS\MSIMGSIZ.DAT
[1998/05/14 09:33:41 | 000,375,930 | ---- | C] () -- C:\WINDOWS\NETPWL.EXE
[1998/04/25 14:06:58 | 000,197,120 | ---- | C] () -- C:\WINDOWS\System32\ZTIFF.DLL
[1998/04/25 14:06:55 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\FLTERROR.DLL
[1998/04/20 14:33:24 | 000,013,824 | ---- | C] () -- C:\WINDOWS\System32\wb32lib5.dll
[1998/04/20 14:33:24 | 000,013,824 | ---- | C] () -- C:\WINDOWS\System32\wb32lib4.dll
[1998/01/30 15:02:41 | 000,001,421 | ---- | C] () -- C:\WINDOWS\EReg132.dat
[1997/10/10 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[1997/04/12 23:15:07 | 000,008,724 | ---- | C] () -- C:\WINDOWS\QFNOAD16.DAT
[1997/04/10 14:02:23 | 000,097,056 | ---- | C] () -- C:\WINDOWS\System32\TRIDDD32.DLL
[1997/04/10 13:58:28 | 000,000,026 | ---- | C] () -- C:\WINDOWS\TRDEFREF.DAT
[1997/04/09 17:11:57 | 000,006,960 | ---- | C] () -- C:\WINDOWS\CER.EXE
[1997/04/09 16:20:14 | 000,012,250 | ---- | C] () -- C:\WINDOWS\WPURL16.DLL
[1997/04/04 15:01:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\CONNECT.DAT
[1997/01/13 18:27:18 | 000,030,464 | ---- | C] () -- C:\WINDOWS\MACROMIX.DLL
[1996/08/15 10:25:44 | 000,102,656 | ---- | C] () -- C:\WINDOWS\PR1630.DLL
[1996/02/23 02:10:00 | 000,099,600 | ---- | C] () -- C:\WINDOWS\CER.DLL
[1995/03/02 16:05:14 | 000,016,848 | ---- | C] () -- C:\WINDOWS\HOTKEY.DLL
[1995/03/02 10:48:16 | 000,050,064 | ---- | C] () -- C:\WINDOWS\ATIDTUTL.DLL
[1994/10/31 18:59:46 | 000,102,912 | ---- | C] () -- C:\WINDOWS\ATICNTL.DLL
[1994/10/21 19:51:58 | 000,016,656 | ---- | C] () -- C:\WINDOWS\DESKSCAN.DLL
[1994/10/21 19:51:22 | 000,019,968 | ---- | C] () -- C:\WINDOWS\DPMS.DLL
[1994/10/01 13:55:34 | 000,039,973 | ---- | C] () -- C:\WINDOWS\WTSETUP.EXE
[1994/05/31 06:22:00 | 000,119,557 | ---- | C] () -- C:\WINDOWS\MEMMAKER.EXE
[1994/05/31 06:22:00 | 000,041,600 | ---- | C] () -- C:\WINDOWS\CHKSTATE.SYS
[1994/05/31 06:22:00 | 000,007,169 | ---- | C] () -- C:\WINDOWS\SIZER.EXE
[1993/11/01 03:11:00 | 000,148,528 | ---- | C] () -- C:\WINDOWS\CARDS.DLL
[1993/11/01 03:11:00 | 000,016,378 | ---- | C] () -- C:\WINDOWS\EXPAND.EXE
[1993/11/01 03:11:00 | 000,010,414 | ---- | C] () -- C:\WINDOWS\RECORDER.DLL
[1992/10/05 20:00:00 | 000,038,704 | ---- | C] () -- C:\WINDOWS\WNGRAFIC.DLL
[1992/10/05 20:00:00 | 000,022,960 | ---- | C] () -- C:\WINDOWS\WNTSR.DLL
[1992/10/05 20:00:00 | 000,020,032 | ---- | C] () -- C:\WINDOWS\CPSICONS.DLL

========== LOP Check ==========

[2010/08/18 09:55:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2009/06/05 17:43:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Extensions
[2008/10/28 12:48:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2010/12/20 12:59:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NewsView
[2010/07/13 14:04:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nuance
[2010/01/14 17:41:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/03/21 17:58:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995
[2009/04/24 12:27:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PhotoStitch
[2007/02/01 13:31:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PureEdge
[2011/02/18 16:31:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2009/10/30 12:21:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
[2010/07/13 14:02:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/03/03 15:37:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2011/03/07 09:58:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/05/26 13:40:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\zeon
[2010/12/27 14:21:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\.oit
[2005/10/20 10:12:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Active Disk
[2009/05/06 15:35:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Canon
[2006/02/13 13:43:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\DeductionPro 2005-06
[2011/03/04 11:15:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\EndNote
[2011/02/22 11:37:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\FixCleaner
[2004/06/07 18:35:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\FUJIFILM
[2009/05/15 14:29:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\HDRsoft
[2006/03/01 11:55:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\HorizonWimba
[2009/05/27 12:31:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\ISI ResearchSoft
[2003/08/07 10:15:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Leadertech
[2006/12/19 13:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Netscape
[2010/05/26 13:53:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Nuance
[2009/11/04 11:57:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Octoshape
[2007/04/15 15:33:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\pdf995
[2007/02/01 13:31:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\PureEdge
[2009/03/03 15:58:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\SigmaPlot 11.0
[2010/03/21 17:58:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\TaxCut
[2010/01/20 11:57:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Tific
[2011/02/11 16:59:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Uniblue
[2010/01/28 15:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Windows Desktop Search
[2008/09/29 08:05:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Windows Search
[2010/05/26 13:38:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Zeon
[2011/02/28 18:15:00 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2011/03/07 10:27:00 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{01EA7816-2C2F-44D4-9017-536659A092B7}.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 250 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01C66DD9
@Alternate Data Stream - 238 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B9FB94D

< End of report >

Here is Extras.txt:

OTL Extras logfile created on: 3/7/2011 10:26:15 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Les\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 191.99 Gb Total Space | 143.00 Gb Free Space | 74.48% Space Free | Partition Type: NTFS
Drive F: | 40.89 Gb Total Space | 16.66 Gb Free Space | 40.73% Space Free | Partition Type: NTFS

Computer Name: LESGREEN | User Name: Les | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirstRunDisabled" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"50000:UDP" = 50000:UDP:*:Enabled:IHA_MessageCenter
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Program Files\Common Files\ABC7 QuickCast\TrueWeather.exe" = C:\Program Files\Common Files\ABC7 QuickCast\TrueWeather.exe:*:Enabled:TrueWeather -- (Digital Information Network)
"C:\Program Files\Netscape\Netscape\Netscp.exe" = C:\Program Files\Netscape\Netscape\Netscp.exe:*:Enabled:Netscape -- (Mozilla, Netscape)
"C:\WINDOWS\System32\dpvsetup.exe" = C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Messenger\msmsgs.exe" = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger -- (Microsoft Corporation)
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google)
"C:\Documents and Settings\Les\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe" = C:\Documents and Settings\Les\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe:*:Enabled:Octoshape add-in for Adobe Flash Player -- (Octoshape ApS)
"C:\Program Files\Common Files\NewsView\TrueWeather.exe" = C:\Program Files\Common Files\NewsView\TrueWeather.exe:*:Enabled:TrueWeather
"C:\Documents and Settings\Les\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" = C:\Documents and Settings\Les\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe:*:Enabled:Main program for Octoshape client -- (Octoshape ApS)
"C:\WINDOWS\LMI3.tmp\lmi_rescue.exe" = C:\WINDOWS\LMI3.tmp\lmi_rescue.exe:*:Enabled:LogMeIn Rescue
"C:\Documents and Settings\Les\Local Settings\temp\7zS5.tmp\SymNRT.exe" = C:\Documents and Settings\Les\Local Settings\temp\7zS5.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Program Files\Verizon\Verizon Media Manager\Release\Verizon Media Manager.exe" = C:\Program Files\Verizon\Verizon Media Manager\Release\Verizon Media Manager.exe:*:Enabled:Verizon Media Manager

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = Google Gmail Notifier
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Professional
"{097CD098-D31F-4A6B-9C9D-1647E2F06DC6}" = Nuance PDF Viewer Plus
"{0F052922-4BCE-4763-A540-00857554336D}" = Redist
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID Sign-in Assistant
"{11B569C2-4BF6-4ED0-9D17-A4273943CB24}" = Adobe Photoshop Album 2.0 Starter Edition
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 18
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Virtual Earth 3D (Beta)
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2FE8EBAF-2F93-4EC6-9EBA-5B82F4905437}" = SYSTAT 11
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36008995-DD98-410E-A449-D791372F2E22}" = Eudora
"{3A1421C0-5610-46D4-8283-82F3CA755FDB}" = Roxio PhotoSuite 5
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows Journal Viewer
"{48969BDB-A81B-4688-8339-F7613436AC3D}" = Norton SystemWorks Basic Edition
"{48FF6DE6-0619-4562-B4B1-21F161FE0DE0}" = Symantec Technical Support Advanced Chat Controls
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EB092F5-185E-4FE6-8ED7-23F61C17D76C}" = SYSTAT 12
"{53A19323-917A-4822-B27E-A57D1EF6E9FC}" = H&R Block Deluxe + Efile + State 2009
"{53E6B7DE-320B-4C3D-B324-76589B97B6A2}" = Molecular Weight Calculator
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5FF4A578-4588-4ACF-8317-7191FC45F3E1}" = TaxCut California 2007
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6549AA0C-6D93-4E76-9A13-6A6A0AA4FD6D}" = TaxCut California 2008
"{663E217E-FC26-4249-9E8E-F190CD63E737}" = TaxCut Premium + State 2007
"{671CB656-DCED-4C30-90AD-CA75CB5C7BAA}" = Windows Live Local Add-in for Microsoft Office Outlook
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}" = Norton Utilities
"{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6EF2FDAB-7FBF-4AB9-92CD-594BDDB6A56B}" = PaperPort Image Printer
"{70C592EC-AE9B-4734-928B-676E824FB41E}" = MFC RunTime files
"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
"{7148F0A8-6813-11D6-A77B-00B0D0142180}" = Java 2 Runtime Environment, SE v1.4.2_18
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7680E3B2-9DCA-4D3E-B2E1-2E1DCE8D05E7}" = Data Uploader
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77364F85-6219-4CB8-AAA0-6D53368D683D}" = Connection Keep Alive
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.12.0
"{80813829-BE27-4799-8BC7-2F75A7B6CB50}" = IHA_MessageCenter
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{849089CF-4988-49ED-A2DD-110CD5D9D7E8}" = PerformanceTest
"{87F7773C-EC9C-461A-AA7B-4AF8EF54DF49}" = EndNote X1
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{8E72B982-D54F-486F-B35A-C24B6F171033}" = Nero 7 Essentials
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-00D1-0409-0000-0000000FF1CE}" = Microsoft Office Access database engine 2007 (English)
"{90200409-6000-11D3-8CFE-0050048383C9}" = System Files Update
"{94824ADD-8F26-43D2-84DB-22E11F377E5E}" = Microsoft English TTS Engine
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97D0C0A1-7E64-4B05-A2EE-61D2CE23F154}" = TTS Wrapper
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8F4D2B4-354F-44F5-A1DB-769229E9F088}" = Brooklyn College
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-1033-0000-7760-000000000004}" = Adobe Acrobat 9 Pro
"{AC76BA86-1033-0000-7760-000000000004}_942" = Adobe Acrobat 9.4.2 - CPSID_83708
"{AC76BA86-1033-0000-7760-000000000004}{AC76BA86-1033-0000-7760-000000000004}" = Adobe Acrobat 9 Pro
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B977686C-1ACE-45A1-A7A3-A1FCB979A684}" = Nuance PaperPort 12
"{BBB33AD6-BCF7-4002-B6A0-6DC679AE5C18}" = TaxCut Premium + State + Efile 2008
"{BDCF27CA-BFC4-4F49-8D24-A925C9505AB8}" = Windows Rights Management Client with Service Pack 2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C82185E8-C27B-4EF4-2009-4444BC2C2B6D}" = Microsoft Streets & Trips 2009
"{CA31120D-2101-484D-9FF1-195DE96FE346}" = Norton Cleanup
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software 1.10.13.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D683E370-3B68-4BE0-8C29-1326F2EABCCC}" = SYSTAT 12 Manuals
"{DB9E4EAB-2717-499F-8D56-4CC8A644AB60}" = MPlayer for Windows (Full Package)
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Windows Rights Management Client Backwards Compatibility SP2
"{EE81912D-CD8C-4E39-AAB1-0338924DAA41}" = SYSTAT 13
"{EF71A531-5B6C-4B20-8D1E-E6379C7FB6D3}" = Microsoft IntelliPoint 7.0
"{EFCE5837-FC21-11D6-9D24-00010240CE95}" = Java 2 Runtime Environment, SE v1.4.1_02
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F41D214F-FFE8-4A71-8C79-C21D5AB3C603}" = Systat 13 Manuals
"{F4898C08-90A2-431C-BCE5-87866531D05B}" = H&R Block California 2009
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"ABC7 QuickCast" = ABC7 QuickCast
"Active Disk" = Active Disk
"ActiveTouchMeetingClient" = WebEx
"Adobe ActiveShare" = Adobe ActiveShare 1.2
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe PhotoDeluxe Home Edition 4.0" = Adobe PhotoDeluxe Home Edition 4.0
"AdobeESD" = Adobe Download Manager 1.2 (Remove Only)
"ArcSoft VideoImpression 16FP" = ArcSoft VideoImpression 1.6FP
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"CAL" = Canon Camera Access Library
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC5" = Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CheckIt Diagnostics" = CheckIt Diagnostics
"Corel WordPerfect Suite 8" = Corel WordPerfect Suite 8
"CSCLIB" = Canon Camera Support Core Library
"DECCHECK" = Microsoft Windows XP Video Decoder Checkup Utility
"EOS Utility" = Canon Utilities EOS Utility
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0
"ISI ResearchSoft - Export Helper" = ISI ResearchSoft - Export Helper
"Java Web Start" = Java Web Start
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Media Player - Codec Pack" = Media Player Codec Pack 1.1.0
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Office Live Meeting" = Microsoft Office Live Meeting
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MPEG4E" = MPEG4E VFW - H.264/MPEG-4 AVC codec (remove only)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"Netscape (7.1)" = Netscape (7.1)
"Netscape (7.2)" = Netscape (7.2)
"Netscape Browser" = Netscape Browser (remove only)
"Netscape Communicator 4.79" = Netscape Communicator 4.79
"NewsView" = NewsView
"NIS" = Norton Internet Security
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PCI Audio Applications" = PCI Audio Applications
"Pdf995" = Pdf995 (installed by TaxCut)
"PdfEdit995" = PdfEdit995 (installed by TaxCut)
"PhotomatixPro3_is1" = Photomatix Pro version 3.1.3
"PhotoStitch" = Canon Utilities PhotoStitch
"Picasa 3" = Picasa 3
"PoloPlus" = LeOra Software Company PoloPlus 1.00
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealDownload" = RealDownload
"RealPlayer 12.0" = RealPlayer
"RemoteCaptureDC" = Canon Utilities RemoteCapture DC
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"S3Display" = S3Display
"S3Gamma2" = S3Gamma2
"S3Info2" = S3Info2
"S3Overlay" = S3Overlay
"Sound Blaster AudioPCI" = Sound Blaster AudioPCI
"SymSetup.{48969BDB-A81B-4688-8339-F7613436AC3D}" = Norton SystemWorks (Symantec Corporation)
"TaxCut 2000" = TaxCut 2000
"TaxCut 2001" = TaxCut 2001
"TaxCut 2002" = TaxCut 2002
"TaxCut 2003" = TaxCut 2003
"TaxCut 2004" = TaxCut 2004
"TaxCut Deluxe 2005" = TaxCut Deluxe 2005
"TaxCut Premium 2006" = TaxCut Premium 2006
"The Weather Channel" = The Weather Channel
"unWNW1.0" = Webster's New World Dictionary
"Visioneer 6100 USB Scanner Driver" = Visioneer 6100 USB Scanner Driver
"Visioneer Pro OCR 100" = Visioneer Pro OCR 100
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Octoshape Streaming Services" = Octoshape Streaming Services

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/3/2011 10:23:32 PM | Computer Name = LESGREEN | Source = Windows Search Service | ID = 3013
Description = The entry <C:\CONFIG.MSI\17A63A6.RBF> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 3/3/2011 10:23:32 PM | Computer Name = LESGREEN | Source = Windows Search Service | ID = 3013
Description = The entry <C:\CONFIG.MSI\17A63A7.RBF> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 3/3/2011 10:23:32 PM | Computer Name = LESGREEN | Source = Windows Search Service | ID = 3013
Description = The entry <C:\CONFIG.MSI\17A63A8.RBF> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 3/3/2011 10:23:32 PM | Computer Name = LESGREEN | Source = Windows Search Service | ID = 3013
Description = The entry <C:\CONFIG.MSI\17A63A9.RBF> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 3/3/2011 10:23:32 PM | Computer Name = LESGREEN | Source = Windows Search Service | ID = 3013
Description = The entry <C:\CONFIG.MSI\17A63AA.RBF> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 3/3/2011 10:23:32 PM | Computer Name = LESGREEN | Source = Windows Search Service | ID = 3013
Description = The entry <C:\CONFIG.MSI\17A63AB.RBF> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 3/4/2011 8:59:26 PM | Computer Name = LESGREEN | Source = ESENT | ID = 486
Description = SearchIndexer (2340) An attempt to move the file "C:\Documents and
Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log"
to "C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS03CED.log"
failed with system error 32 (0x00000020): "The process cannot access the file because
it is being used by another process. ". The move file operation will fail with
error -1032 (0xfffffbf8).

Error - 3/4/2011 8:59:26 PM | Computer Name = LESGREEN | Source = ESENT | ID = 413
Description = SearchIndexer (2340) Unable to create a new logfile because the database
cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured,
or corrupted. Error -1032.

Error - 3/4/2011 8:59:26 PM | Computer Name = LESGREEN | Source = ESENT | ID = 492
Description = SearchIndexer (2340) The logfile sequence in "C:\Documents and Settings\All
Users\Application Data\Microsoft\Search\Data\Applications\Windows\" has been halted
due to a fatal error. No further updates are possible for the databases that use
this logfile sequence. Please correct the problem and restart or restore from
backup.

Error - 3/7/2011 2:23:02 PM | Computer Name = LESGREEN | Source = Application Hang | ID = 1002
Description = Hanging application Eudora.exe, version 7.1.0.9, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 3/4/2011 9:04:48 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NIS service.

Error - 3/4/2011 9:06:20 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7022
Description = The IHA_MessageCenter service hung on starting.

Error - 3/4/2011 9:06:20 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdudf_xp Lbd

Error - 3/7/2011 1:56:04 PM | Computer Name = LESGREEN | Source = NETLOGON | ID = 3095
Description = This computer is configured as a member of a workgroup, not as a member
of a domain. The Netlogon service does not need to run in this configuration.

Error - 3/7/2011 1:57:06 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7000
Description = The Parallel port driver service failed to start due to the following
error: %%1058

Error - 3/7/2011 1:57:06 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NIS service.

Error - 3/7/2011 1:57:29 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NIS service.

Error - 3/7/2011 1:58:56 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7022
Description = The IHA_MessageCenter service hung on starting.

Error - 3/7/2011 1:58:56 PM | Computer Name = LESGREEN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdudf_xp Lbd

Error - 3/7/2011 1:59:14 PM | Computer Name = LESGREEN | Source = NetBT | ID = 4321
Description = The name "MSHOME :1d" could not be registered on the Interface
with IP address 138.23.211.37. The machine with the IP address 138.23.211.6 did
not allow the name to be claimed by this machine.

< End of report >

#6 m0le

Can U Dig It?

Malware Response Team
34,528 posts
OFFLINE

Gender:Male
Location:London, UK
Local time:02:28 AM

Posted 07 March 2011 - 04:59 PM

Okay, yes there are things there which we need to remove. Please download and run Combofix (OTL may not be able to cope)

Please download ComboFix from one of these locations:

* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe

Disable your AntiVirus and AntiSpyware applications including Firewalls, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Comfix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

m0le is a proud member of UNITE

#7 Lesgreen

Topic Starter

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 08 March 2011 - 02:21 PM

Hi m0le,

Here is the combofix text file:

ComboFix 11-03-07.07 - Les 03/08/2011 10:52:49.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1327 [GMT -8:00]
Running from: c:\documents and settings\Les\Desktop\ComFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\netzeroinstaller\NetZeroInstaller.exe
c:\program files\Downloaded Installers
c:\program files\Quicktime\QTTask.exe
c:\program files\Shared
c:\windows\Personal\maxdesk.ini
c:\windows\Personal\maxdesk.ini2
c:\windows\Personal\MyFiles\Bait_stations\maxdesk.ini2
c:\windows\Personal\MyFiles\baitchoice\maxdesk.ini
c:\windows\Personal\MyFiles\baitchoice\maxdesk.ini2
c:\windows\Personal\MyFiles\Biosis\maxdesk.ini2
c:\windows\Personal\MyFiles\Corsica\maxdesk.ini2
c:\windows\Personal\MyFiles\DPR\maxdesk.ini2
c:\windows\Personal\MyFiles\Encyclopedia\maxdesk.ini2
c:\windows\Personal\MyFiles\Fallbrook\maxdesk.ini
c:\windows\Personal\MyFiles\Fallbrook\maxdesk.ini2
c:\windows\Personal\MyFiles\Fipronil_bait\maxdesk.ini2
c:\windows\Personal\MyFiles\flight\maxdesk.ini2
c:\windows\Personal\MyFiles\maxdesk.ini
c:\windows\Personal\MyFiles\maxdesk.ini2
c:\windows\Personal\MyFiles\Rochelle\maxdesk.ini2
c:\windows\Personal\MyFiles\Rust\2010\maxdesk.ini2
c:\windows\Personal\MyFiles\Safety\maxdesk.ini2
c:\windows\Personal\MyFiles\Salary\maxdesk.ini2
c:\windows\Personal\MyFiles\Scans\maxdesk.ini2
c:\windows\Personal\MyFiles\Scans\scans2\maxdesk.ini
c:\windows\Personal\MyFiles\Scans\scans2\maxdesk.ini2
c:\windows\Personal\MyFiles\stats_misc\maxdesk.ini2
c:\windows\Personal\MyFiles\Toll_Road\maxdesk.ini2
c:\windows\Personal\MyFiles\Tollerup\maxdesk.ini2
c:\windows\Personal\Shortcuts\maxdesk.ini2
c:\windows\system32\prsgrc.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-02-08 to 2011-03-08 )))))))))))))))))))))))))))))))
.
.
2011-03-04 19:01 . 2011-03-04 19:03 -------- d-----w- c:\program files\EndNote X1
2011-03-03 19:37 . 2010-11-23 04:59 44024 ----a-r- c:\windows\system32\drivers\SymIM.sys
2011-03-03 19:23 . 2011-03-03 19:27 -------- d-----w- c:\program files\Common Files\Motive
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\documents and settings\Les\Application Data\SUPERAntiSpyware.com
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-02-22 19:09 . 2011-02-22 19:37 -------- d-----w- c:\documents and settings\Les\Application Data\FixCleaner
2011-02-22 19:08 . 2011-02-22 19:36 -------- d-----w- c:\program files\FixCleaner
2011-02-19 01:09 . 2011-03-03 19:29 -------- d-----w- c:\documents and settings\Les\Application Data\Verizon
2011-02-19 01:09 . 2011-03-03 19:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon
2011-02-16 19:38 . 2011-02-16 19:38 -------- d-----w- c:\program files\Common Files\xing shared
2011-02-15 22:02 . 2011-02-19 00:25 -------- d-----w- c:\documents and settings\Les\Local Settings\Application Data\NPE
2011-02-15 21:45 . 2011-02-19 00:31 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2011-02-12 02:15 . 2011-02-12 02:14 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-12 02:08 . 2011-02-12 02:08 -------- d-----w- c:\documents and settings\Les\Local Settings\Application Data\Sunbelt Software
2011-02-12 01:28 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-12 01:28 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-12 00:59 . 2011-02-12 00:59 -------- d-----w- c:\documents and settings\Les\Application Data\Uniblue
2011-02-12 00:20 . 2011-02-12 00:20 -------- d-----w- c:\documents and settings\Les\Application Data\Motive
2011-02-12 00:18 . 2011-02-12 00:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2011-02-12 00:16 . 2011-03-03 19:29 -------- d-----w- c:\program files\Verizon
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-16 19:37 . 2006-07-12 01:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-02-16 19:37 . 2003-03-19 06:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-01-21 14:44 . 2004-08-04 15:56 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-10 21:21 . 2010-01-20 20:42 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2011-01-10 21:21 . 2010-01-20 20:42 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-01-07 14:09 . 2004-08-04 15:56 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10 . 2004-08-04 14:17 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-04 15:56 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:59 . 2004-08-04 15:56 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:59 . 2004-08-04 15:56 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-20 23:59 . 2004-08-04 15:56 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 17:26 . 2004-08-04 15:56 730112 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-04 13:59 385024 ----a-w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2004-08-04 15:56 718336 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 14:30 . 2004-08-04 15:56 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-09 13:42 . 2004-08-04 14:18 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 13:07 . 2004-08-04 06:59 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
.
------- Sigcheck -------
.
[7] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[7] 2008-04-13 17:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\aec.sys
[-] 2006-02-15 01:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2004-08-04 16:05 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\SYSTEM32\DRIVERS\aec.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-08 68856]
"ISUSPM"="c:\documents and settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"SunJavaUpdateSched"="c:\program files\Adobe\Acrobat 9.0\Designer 8.2\jre\bin\jusched.exe" [2008-05-23 75520]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"RTHDCPL"="RTHDCPL.EXE" [2008-03-03 16859648]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 69632]
"QD FastAndSafe"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 69632]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-03 131072]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-06-01 1468296]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-03 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-03 159744]
"ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-25 147456]
"NSWosCheck"="c:\program files\Norton SystemWorks Basic Edition\osCheck.exe" [2008-09-25 160112]
"NswUiTray"="c:\program files\Norton SystemWorks Basic Edition\NswUiTray.exe" [2008-09-25 85360]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"PPort12reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"PDFHook"="c:\program files\Nuance\PDFViewerPlus\pdfpro5hook.exe" [2010-02-09 1369376]
"PDF5 Registry Controller"="c:\program files\Nuance\PDFViewerPlus\RegistryController.exe" [2010-02-09 62752]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\QUALCOMM\EUDORA\EUSHLEXT.DLL" [2006-08-17 86016]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WNW Tray Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WNW Tray Agent.lnk
backup=c:\windows\pss\WNW Tray Agent.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"LiveUpdate"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Common Files\\ABC7 QuickCast\\TrueWeather.exe"=
"c:\\Program Files\\Netscape\\Netscape\\Netscp.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Documents and Settings\\Les\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Documents and Settings\\Les\\Application Data\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"50000:UDP"= 50000:UDP:IHA_MessageCenter
.
R0 SymDS;Symantec Data Store;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\SymDS.sys [1/10/2011 1:20 PM 340016]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\SymEFA.sys [1/10/2011 1:20 PM 652336]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110225.002\BHDrvx86.sys [2/25/2011 1:59 PM 800376]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 10:41 AM 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\Ironx86.sys [1/10/2011 1:20 PM 136312]
R2 BCMNTIO;BCMNTIO;c:\progra~1\CHECKIT\DIAGNO~1\BCMNTIO.sys [4/8/2009 4:51 PM 3744]
R2 MAPMEM;MAPMEM;c:\progra~1\CHECKIT\DIAGNO~1\MAPMEM.sys [4/8/2009 4:51 PM 3904]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [1/10/2011 1:20 PM 130000]
R2 NProtectService;Norton UnErase Protection;c:\progra~1\NORTON~2\NORTON~1\NPROTECT.EXE [9/25/2008 2:53 PM 95600]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\Nuance\PaperPort\PDFProFiltSrvPP.exe [2/10/2010 10:30 PM 144672]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/16/2010 8:31 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110304.001\IDSXpx86.sys [3/7/2011 3:41 PM 341944]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/5/2010 4:56 PM 135664]
S2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [10/13/2010 5:06 PM 98304]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 pmxscan;Visioneer USB Kernel;c:\windows\SYSTEM32\DRIVERS\usbscan.sys [9/12/2008 11:33 AM 15104]
S3 VIASens;Vinyl Sensaura WDM 3D Audio Driver;c:\windows\SYSTEM32\DRIVERS\viasens.sys [11/7/2003 7:07 AM 391680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-24 01:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
2002-12-10 17:57 7168 ----a-w- c:\windows\SYSTEM32\updcrl.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-08 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2006-12-20 00:34]
.
2011-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 00:55]
.
2011-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 00:55]
.
2011-03-07 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job
- c:\program files\Norton SystemWorks Basic Edition\OBC.exe [2008-09-25 22:52]
.
2011-03-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1482476501-842925246-854245398-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 22:25]
.
2011-03-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1482476501-842925246-854245398-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 22:25]
.
2011-03-08 c:\windows\Tasks\User_Feed_Synchronization-{01EA7816-2C2F-44D4-9017-536659A092B7}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 12:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://finance.yahoo.com/p?v&k=pf_1
mSearch Bar = hxxp://home.netscape.com/home/winsearch200.html
uSearchURL,(Default) = hxxp://keyword.netscape.com/keyword/%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
Name-Space Handler: ftp\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\NZDD.DLL
Name-Space Handler: http\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\NZDD.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Norton Download Manager{NAV_Production_94_136_NUC} - c:\documents and settings\All Users\Documents\Norton\{NAV_Production_94_136_NUC}\NAVDownloader[1].exe
HKLM-Run-QuickTime Task - c:\program files\QuickTime\qttask.exe
Notify-NavLogon - (no file)
MSConfigStartUp-Verizon_McciTrayApp - c:\program files\Verizon\McciTrayApp.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-08 11:02
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\$$$\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(800)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-03-08 11:05:16
ComboFix-quarantined-files.txt 2011-03-08 19:04
ComboFix2.txt 2010-01-14 18:57
.
Pre-Run: 153,794,217,984 bytes free
Post-Run: 154,254,315,520 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - D0BCE2DEC097AB5625BC8CD6D3080783

#8 m0le

Can U Dig It?

Malware Response Team
34,528 posts
OFFLINE

Gender:Male
Location:London, UK
Local time:02:28 AM

Posted 08 March 2011 - 07:29 PM

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the box below into it:

RegLock::
[HKEY_USERS\$$$\Software\Microsoft\SystemCertificates\AddressBook*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

Save this as CFScript.txt, in the same location as Comfix.exe (called ComboFix.exe in the below graphic)

Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

If the program requests for you to update Combofix then click Yes.

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Next please run MBAM

Please download Posted Image

Malwarebytes Anti-Malware and save it to your desktop.

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application or, if you are using Vista, right-click and select Run As Administrator on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
If MBAM won't update then download and update MBAM on a clean computer then save the rules.ref folder to a memory stick. This file is found here: 'C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware' then transfer it across to the infected computer.
On the Scanner tab:
- Make sure the "Perform Full Scan" option is selected.
- Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

m0le is a proud member of UNITE

#9 Lesgreen

Topic Starter

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 09 March 2011 - 04:51 PM

Here are the logs you wanted. First ComboFix:

ComboFix 11-03-08.09 - Les 03/09/2011 11:10:10.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1295 [GMT -8:00]
Running from: c:\documents and settings\Les\Desktop\ComFix.exe
Command switches used :: c:\documents and settings\Les\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Personal\MyFiles\Bait_stations\maxdesk.ini2
c:\windows\Personal\MyFiles\baitchoice\maxdesk.ini2
c:\windows\Personal\MyFiles\maxdesk.ini2
c:\windows\Personal\MyFiles\Personals\maxdesk.ini2
.
.
((((((((((((((((((((((((( Files Created from 2011-02-09 to 2011-03-09 )))))))))))))))))))))))))))))))
.
.
2011-03-09 18:04 . 2011-03-09 18:04 -------- d-----w- c:\windows\LastGood
2011-03-04 19:01 . 2011-03-04 19:03 -------- d-----w- c:\program files\EndNote X1
2011-03-03 19:37 . 2010-11-23 04:59 44024 ----a-r- c:\windows\system32\drivers\SymIM.sys
2011-03-03 19:23 . 2011-03-03 19:27 -------- d-----w- c:\program files\Common Files\Motive
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\documents and settings\Les\Application Data\SUPERAntiSpyware.com
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-02-22 19:09 . 2011-02-22 19:37 -------- d-----w- c:\documents and settings\Les\Application Data\FixCleaner
2011-02-22 19:08 . 2011-02-22 19:36 -------- d-----w- c:\program files\FixCleaner
2011-02-19 01:09 . 2011-03-03 19:29 -------- d-----w- c:\documents and settings\Les\Application Data\Verizon
2011-02-19 01:09 . 2011-03-03 19:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon
2011-02-16 19:38 . 2011-02-16 19:38 -------- d-----w- c:\program files\Common Files\xing shared
2011-02-15 22:02 . 2011-02-19 00:25 -------- d-----w- c:\documents and settings\Les\Local Settings\Application Data\NPE
2011-02-15 21:45 . 2011-02-19 00:31 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2011-02-12 02:15 . 2011-02-12 02:14 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-12 02:08 . 2011-02-12 02:08 -------- d-----w- c:\documents and settings\Les\Local Settings\Application Data\Sunbelt Software
2011-02-12 01:28 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-12 01:28 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-12 00:59 . 2011-02-12 00:59 -------- d-----w- c:\documents and settings\Les\Application Data\Uniblue
2011-02-12 00:20 . 2011-02-12 00:20 -------- d-----w- c:\documents and settings\Les\Application Data\Motive
2011-02-12 00:18 . 2011-02-12 00:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2011-02-12 00:16 . 2011-03-03 19:29 -------- d-----w- c:\program files\Verizon
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-16 19:37 . 2006-07-12 01:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-02-16 19:37 . 2003-03-19 06:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-01-21 14:44 . 2004-08-04 15:56 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-10 21:21 . 2010-01-20 20:42 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2011-01-10 21:21 . 2010-01-20 20:42 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-01-07 14:09 . 2004-08-04 15:56 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10 . 2004-08-04 14:17 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-04 15:56 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:59 . 2004-08-04 15:56 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:59 . 2004-08-04 15:56 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-20 23:59 . 2004-08-04 15:56 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 17:26 . 2004-08-04 15:56 730112 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-04 13:59 385024 ----a-w- c:\windows\system32\html.iec
.
.
------- Sigcheck -------
.
[7] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[7] 2008-04-13 17:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\aec.sys
[-] 2006-02-15 01:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2004-08-04 16:05 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\SYSTEM32\DRIVERS\aec.sys
.
((((((((((((((((((((((((((((( SnapShot@2011-03-08_19.02.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-03-09 18:01 . 2011-03-09 18:01 16384 c:\windows\TEMP\Perflib_Perfdata_96c.dat
+ 2011-03-09 18:02 . 2011-03-09 18:02 16384 c:\windows\TEMP\Perflib_Perfdata_864.dat
+ 2011-03-09 18:00 . 2011-03-09 18:00 16384 c:\windows\TEMP\Perflib_Perfdata_644.dat
- 2011-03-08 19:02 . 2011-03-08 19:02 53248 c:\windows\TEMP\catchme.dll
+ 2011-03-09 19:20 . 2011-03-09 19:20 53248 c:\windows\TEMP\catchme.dll
+ 2009-06-03 22:12 . 2011-03-09 18:46 262144 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
- 2009-06-03 22:12 . 2010-08-11 17:59 262144 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
+ 2009-03-09 17:49 . 2011-03-09 18:42 421888 c:\windows\repair\RegBack\UsrClass.dat
+ 2005-10-20 00:38 . 2011-03-09 18:40 10231808 c:\windows\repair\RegBack\NTUSER.DAT
- 2003-08-07 18:12 . 2011-03-08 18:52 10354688 c:\windows\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2003-08-07 18:12 . 2011-03-09 19:10 10354688 c:\windows\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-08 68856]
"ISUSPM"="c:\documents and settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"SunJavaUpdateSched"="c:\program files\Adobe\Acrobat 9.0\Designer 8.2\jre\bin\jusched.exe" [2008-05-23 75520]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"RTHDCPL"="RTHDCPL.EXE" [2008-03-03 16859648]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 69632]
"QD FastAndSafe"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 69632]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-03 131072]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-06-01 1468296]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-03 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-03 159744]
"ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-25 147456]
"NSWosCheck"="c:\program files\Norton SystemWorks Basic Edition\osCheck.exe" [2008-09-25 160112]
"NswUiTray"="c:\program files\Norton SystemWorks Basic Edition\NswUiTray.exe" [2008-09-25 85360]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"PPort12reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"PDFHook"="c:\program files\Nuance\PDFViewerPlus\pdfpro5hook.exe" [2010-02-09 1369376]
"PDF5 Registry Controller"="c:\program files\Nuance\PDFViewerPlus\RegistryController.exe" [2010-02-09 62752]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\QUALCOMM\EUDORA\EUSHLEXT.DLL" [2006-08-17 86016]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WNW Tray Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WNW Tray Agent.lnk
backup=c:\windows\pss\WNW Tray Agent.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"LiveUpdate"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Common Files\\ABC7 QuickCast\\TrueWeather.exe"=
"c:\\Program Files\\Netscape\\Netscape\\Netscp.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Documents and Settings\\Les\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Documents and Settings\\Les\\Application Data\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"50000:UDP"= 50000:UDP:IHA_MessageCenter
.
R0 SymDS;Symantec Data Store;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\SymDS.sys [1/10/2011 1:20 PM 340016]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\SymEFA.sys [1/10/2011 1:20 PM 652336]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110225.002\BHDrvx86.sys [2/25/2011 1:59 PM 800376]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 10:41 AM 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\Ironx86.sys [1/10/2011 1:20 PM 136312]
R2 BCMNTIO;BCMNTIO;c:\progra~1\CHECKIT\DIAGNO~1\BCMNTIO.sys [4/8/2009 4:51 PM 3744]
R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [10/13/2010 5:06 PM 98304]
R2 MAPMEM;MAPMEM;c:\progra~1\CHECKIT\DIAGNO~1\MAPMEM.sys [4/8/2009 4:51 PM 3904]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [1/10/2011 1:20 PM 130000]
R2 NProtectService;Norton UnErase Protection;c:\progra~1\NORTON~2\NORTON~1\NPROTECT.EXE [9/25/2008 2:53 PM 95600]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\Nuance\PaperPort\PDFProFiltSrvPP.exe [2/10/2010 10:30 PM 144672]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/16/2010 8:31 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110304.001\IDSXpx86.sys [3/7/2011 3:41 PM 341944]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/5/2010 4:56 PM 135664]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 pmxscan;Visioneer USB Kernel;c:\windows\SYSTEM32\DRIVERS\usbscan.sys [9/12/2008 11:33 AM 15104]
S3 VIASens;Vinyl Sensaura WDM 3D Audio Driver;c:\windows\SYSTEM32\DRIVERS\viasens.sys [11/7/2003 7:07 AM 391680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-24 01:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
2002-12-10 17:57 7168 ----a-w- c:\windows\SYSTEM32\updcrl.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-09 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2006-12-20 00:34]
.
2011-03-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 00:55]
.
2011-03-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 00:55]
.
2011-03-08 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job
- c:\program files\Norton SystemWorks Basic Edition\OBC.exe [2008-09-25 22:52]
.
2011-03-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1482476501-842925246-854245398-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 22:25]
.
2011-03-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1482476501-842925246-854245398-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 22:25]
.
2011-03-09 c:\windows\Tasks\User_Feed_Synchronization-{01EA7816-2C2F-44D4-9017-536659A092B7}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 12:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://finance.yahoo.com/p?v&k=pf_1
mSearch Bar = hxxp://home.netscape.com/home/winsearch200.html
uSearchURL,(Default) = hxxp://keyword.netscape.com/keyword/%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
Name-Space Handler: ftp\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\NZDD.DLL
Name-Space Handler: http\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\NZDD.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-09 11:20
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\$$$\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(796)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-03-09 11:24:03
ComboFix-quarantined-files.txt 2011-03-09 19:23
ComboFix2.txt 2011-03-08 19:05
ComboFix3.txt 2010-01-14 18:57
.
Pre-Run: 153,970,231,296 bytes free
Post-Run: 154,181,782,528 bytes free
.
- - End Of File - - 4CCBBC4FE92E123416A14BDAA14EB90B

Now MBam log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6003

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/9/2011 1:20:45 PM
mbam-log-2011-03-09 (13-20-45).txt

Scan type: Full scan (C:\|)
Objects scanned: 380863
Time elapsed: 1 hour(s), 38 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#10 m0le

Can U Dig It?

Malware Response Team
34,528 posts
OFFLINE

Gender:Male
Location:London, UK
Local time:02:28 AM

Posted 09 March 2011 - 08:33 PM

We are seeing some infections returning but let's clear out the temp folder and finish the minor clear up first.

Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

NB: If you are using Firefox and this has caused page loading problems then please clear your private data. To do this go
to the Tools menu, select Clear Private Data, and then check Cache. Click Clear Private Data Now.

This could also be Clear Recent History or similar

Then close Firefox and then reopen it.

Next please run ESET

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on:

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on:
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on:
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Finally, please run another scan with OTL and post the log (as before)

m0le is a proud member of UNITE

#11 Lesgreen

Topic Starter

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 10 March 2011 - 04:30 PM

mOle,

The ESET scanner found 43 problems. I have attached the log file below. OTL only produced one file, otl.txt, that I have also attached. By the way, something called "Software Manager" just appeared in my windows tray and it doesn't allow deletion.

ESET LOG:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=fd34525050f0034281e45295af45816f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-03-10 08:36:28
# local_time=2011-03-10 12:36:28 (-0800, Pacific Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=3584 16777191 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=222474
# found=43
# cleaned=0
# scan_time=5406
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144327.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144329.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144330.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144331.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144332.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144494.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144496.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144497.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144498.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144499.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP222\A0145355.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145755.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145757.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145758.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145759.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145760.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145827.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145829.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145830.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145831.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145899.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145901.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145902.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145903.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145904.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146008.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146010.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146011.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146012.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146013.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148009.msi Win32/Adware.ErrorRepair application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148096.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148098.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148099.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148100.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148101.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148325.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148327.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148328.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148329.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148330.rbf Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148336.rbf Win32/Adware.ErrorRepair application (unable to clean) 00000000000000000000000000000000 I
C:\temp_ESA\atmcns.msi probably a variant of Win32/Genetik trojan (unable to clean) 00000000000000000000000000000000 I

HERE IS THE OTL LOG, OTL.TXT:

OTL logfile created on: 3/10/2011 1:12:40 PM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Les\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 191.99 Gb Total Space | 143.07 Gb Free Space | 74.52% Space Free | Partition Type: NTFS
Drive F: | 40.89 Gb Total Space | 16.66 Gb Free Space | 40.73% Space Free | Partition Type: NTFS

Computer Name: LESGREEN | User Name: Les | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Les\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe ()
PRC - C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\Nuance\PDFViewerPlus\pdfPro5Hook.exe (Nuance Communications, Inc.)
PRC - C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\agent.exe (Acresso Corporation)
PRC - C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\Speed Disk\NOPDB.exe (Symantec Corporation)
PRC - C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
PRC - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
PRC - C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
PRC - C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Les\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\asOEHook.dll (Symantec Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\Microsoft.VC90.CRT\msvcr90.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\Microsoft.VC90.CRT\msvcp90.dll (Microsoft Corporation)
MOD - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
MOD - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
MOD - C:\WINDOWS\SYSTEM32\msacm32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\AppPatch\AcGenral.dll (Microsoft Corporation)
MOD - C:\Program Files\Qualcomm\Eudora\EuShlExt.dll (Qualcomm Inc.)

========== Win32 Services (SafeList) ==========

SRV - (Iomega Activity Disk2) -- File not found
SRV - (HidServ) -- File not found
SRV - (NIS) -- C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (IHA_MessageCenter) -- C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe ()
SRV - (PDFProFiltSrvPP) -- C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Speed Disk service) -- C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\Speed Disk\NOPDB.exe (Symantec Corporation)
SRV - (NProtectService) -- C:\Program Files\Norton SystemWorks Basic Edition\Norton Utilities\NPROTECT.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (Symantec RemoteAssist) -- C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (InCDsrv) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
SRV - (CCALib8) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (_IOMEGA_ACTIVE_DISK_SERVICE_) -- C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
SRV - (Iomega App Services) -- C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)

========== Driver Services (SafeList) ==========

DRV - (BHDrvx86) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110225.002\BHDrvx86.sys (Symantec Corporation)
DRV - (SymEvent) -- C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110310.003\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110310.003\NAVENG.SYS (Symantec Corporation)
DRV - (SYMTDI) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMTDI.SYS (Symantec Corporation)
DRV - (SymIMMP) -- C:\WINDOWS\SYSTEM32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SymIM) -- C:\WINDOWS\SYSTEM32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\WINDOWS\System32\Drivers\NIS\1205000.07D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\Ironx86.SYS (Symantec Corporation)
DRV - (IDSxpx86) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110308.003\IDSXpx86.sys (Symantec Corporation)
DRV - (SymDS) -- C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMDS.SYS (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SDdriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\SdDriver.SYS (Symantec Corporation)
DRV - (NPDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\NPDRIVER.SYS (Symantec Corporation)
DRV - (gameenum) -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\SYSTEM32\DRIVERS\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (incdrm) -- C:\WINDOWS\SYSTEM32\DRIVERS\InCDRm.sys (Nero AG)
DRV - (InCDPass) -- C:\WINDOWS\SYSTEM32\DRIVERS\InCDPass.sys (Nero AG)
DRV - (InCDfs) -- C:\WINDOWS\SYSTEM32\DRIVERS\InCDfs.sys (Nero AG)
DRV - (Cdralw2k) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (S3Psddr) -- C:\WINDOWS\SYSTEM32\DRIVERS\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (VIAudio) Vinyl AC'97 Audio Controller (WDM) -- C:\WINDOWS\SYSTEM32\DRIVERS\viaudios.sys (VIA Technologies, Inc.)
DRV - (MAPMEM) -- C:\Program Files\CheckIt\Diagnostics\MAPMEM.SYS ()
DRV - (BCMNTIO) -- C:\Program Files\CheckIt\Diagnostics\BCMNTIO.SYS ()
DRV - (VIASens) -- C:\WINDOWS\SYSTEM32\DRIVERS\viasens.sys (Sensaura Ltd)
DRV - (cdudf_xp) -- C:\WINDOWS\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys (Roxio)
DRV - (PQNTDrv) -- C:\WINDOWS\System32\drivers\PQNTDRV.sys (PowerQuest Corporation)
DRV - (iomdisk) -- C:\WINDOWS\System32\DRIVERS\iomdisk.sys (Iomega Corporation)
DRV - (ms_mpu401) -- C:\WINDOWS\SYSTEM32\DRIVERS\msmpu401.sys (Microsoft Corporation)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/p?v&k=pf_1
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\SYSTEM32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://finance.yahoo.com/p?v&k=pf_1"

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2011/01/10 13:27:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn\ [2011/01/10 13:20:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010/01/15 15:17:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010/11/05 10:58:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/02/16 11:38:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.02\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/01/25 11:52:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.02\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/01/25 11:52:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/01/25 11:52:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/12/19 13:18:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/02/16 11:38:44 | 000,000,000 | ---D | M]

[2006/12/27 13:10:30 | 000,000,377 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\AOL.gif
[2006/12/27 13:10:30 | 000,000,553 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\AOL.src
[2006/12/27 13:10:30 | 000,001,076 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\google.gif
[2006/12/27 13:10:30 | 000,000,670 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\google.src
[2006/12/27 13:10:30 | 000,000,932 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\jeeves.gif
[2006/12/27 13:10:30 | 000,000,590 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\jeeves.src
[2006/12/27 13:10:30 | 000,000,380 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\NetscapeSearch.gif
[2006/12/27 13:10:30 | 000,000,999 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\NetscapeSearch.src
[2006/12/27 13:10:30 | 000,000,088 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\yahoo.gif
[2006/12/27 13:10:30 | 000,000,716 | ---- | M] () -- C:\Documents and Settings\Les\Application Data\Netscape\NSB\Profiles\42xoxk54.default\searchplugins\yahoo.src

O1 HOSTS File: ([2011/03/09 11:20:39 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDFViewerPlus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDFViewerPlus\bin\ZeonIEFavClient.dll (Zeon Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDFViewerPlus\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\SYSTEM32\ieframe.dll (Microsoft Corporation)
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\SYSTEM32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NSWosCheck] C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [NswUiTray] C:\Program Files\Norton SystemWorks Basic Edition\NswUiTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDFViewerPlus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDFViewerPlus\pdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\SYSTEM32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [PPort12reminder] C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QD FastAndSafe] C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe (Roxio)
O4 - HKLM..\Run: [RoxioEngineUtility] C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe (Roxio)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Adobe\Acrobat 9.0\Designer 8.2\jre\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [VTPreset] C:\WINDOWS\System32\VTPreset.exe (S3 Graphics, Inc.)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\SYSTEM32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSPM] C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeText =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeCaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk ()
O9 - Extra 'Tools' menuitem : Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\SYSTEM32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\SYSTEM32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\SYSTEM32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {00000161-0000-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/msaudio.cab (Reg Error: Key error.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} http://download.microsoft.com/download/7/0/7/707a44ad-52ad-49af-b7ef-e21b6b0656e4/VirtualEarth3D.cab (SentinelVE3D Class)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31564D57-0000-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/wmvax.cab (Reg Error: Key error.)
O16 - DPF: {3BB1D69B-A780-4BE1-876E-F3D488877135} http://download.microsoft.com/download/3/B/E/3BE57995-8452-41F1-8297-DD75EF049853/VirtualEarth3D.cab (SentinelProxy Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {428A9DEF-F057-402B-9F2D-A5887F4544ED} http://download.microsoft.com/download/f/0/2/f02b515c-7076-4cee-bc08-fd6fea594578/VirtualEarth3D.cab (SentinelProxy Class)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222688023296 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37840.5036342593 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_18)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CEBC955E-58AF-11D2-A30A-00A0C903492B} http://windowsupdate.microsoft.com/R686/V31Controls/x86/w98/en/actsetup.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.)
O16 - DPF: Internet Explorer Classes for Java file://C:\WINDOWS\SYSTEM\iejava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso4.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 138.23.146.213 138.23.201.101
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\lid {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\SYSTEM32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\SYSTEM32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\SYSTEM32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\SYSTEM32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\SYSTEM32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\SYSTEM32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Les\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Les\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files\Qualcomm\Eudora\EuShlExt.dll (Qualcomm Inc.)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [1999/10/23 03:43:30 | 000,000,692 | ---- | M] () - C:\AUTOEXEC -- [ NTFS ]
O32 - AutoRun File - [2003/08/07 10:11:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/04/26 17:02:36 | 000,000,000 | ---- | M] () - C:\autoexec.ds -- [ NTFS ]
O32 - AutoRun File - [1999/10/23 03:43:30 | 000,000,692 | ---- | M] () - C:\AUTOEXEC -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/10 11:00:16 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/03/10 10:33:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2011/03/09 18:12:14 | 000,050,688 | ---- | C] (Atribune.org) -- C:\Documents and Settings\Les\Desktop\ATF-Cleaner.exe
[2011/03/08 10:49:43 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/03/08 10:45:14 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/03/07 10:19:51 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Les\Desktop\OTL.exe
[2011/03/04 11:01:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\EndNote
[2011/03/04 11:01:07 | 000,000,000 | ---D | C] -- C:\Program Files\EndNote X1
[2011/03/03 11:37:59 | 000,044,024 | R--- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SymIM.sys
[2011/03/03 11:23:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2011/02/22 17:24:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\SUPERAntiSpyware.com
[2011/02/22 17:24:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/02/22 17:24:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Start Menu\Programs\SUPERAntiSpyware
[2011/02/22 17:24:17 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/02/22 17:22:52 | 010,464,584 | ---- | C] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware.exe
[2011/02/22 11:09:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\FixCleaner
[2011/02/22 11:08:52 | 000,000,000 | ---D | C] -- C:\Program Files\FixCleaner
[2011/02/18 17:09:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\Personal\My Videos
[2011/02/18 17:09:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\Verizon
[2011/02/18 17:09:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Verizon
[2011/02/16 11:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2011/02/16 11:38:19 | 000,198,848 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2011/02/16 11:38:03 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2011/02/16 11:38:03 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2011/02/16 11:38:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Real
[2011/02/16 11:37:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Real
[2011/02/15 14:02:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Local Settings\Application Data\NPE
[2011/02/15 13:45:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2011/02/11 18:15:07 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/02/11 18:08:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Local Settings\Application Data\Sunbelt Software
[2011/02/11 17:28:05 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/02/11 17:28:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/02/11 17:28:02 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/02/11 16:59:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\Uniblue
[2011/02/11 16:20:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Les\Application Data\Motive
[2011/02/11 16:18:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2011/02/11 16:16:45 | 000,000,000 | ---D | C] -- C:\Program Files\Verizon
[274 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/10 13:12:00 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{01EA7816-2C2F-44D4-9017-536659A092B7}.job
[2011/03/10 13:05:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/03/10 12:50:27 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/03/10 12:50:27 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/03/10 11:14:59 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job
[2011/03/10 10:34:06 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/10 10:30:47 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/03/10 10:30:22 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/03/10 10:26:59 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/03/10 10:26:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/10 10:26:25 | 000,334,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/09 18:12:14 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\Les\Desktop\ATF-Cleaner.exe
[2011/03/09 17:22:45 | 000,000,174 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\SYSTAT 13 32bit perpetual.lic
[2011/03/09 17:17:07 | 000,195,584 | ---- | M] () -- C:\WINDOWS\Personal\Bann Thai, Riverside.est
[2011/03/09 17:15:48 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Microsoft Streets & Trips 2009.lnk
[2011/03/09 16:14:04 | 000,196,096 | ---- | M] () -- C:\WINDOWS\Personal\Uncle Billy's Kona resort.est
[2011/03/09 11:20:39 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/03/09 11:05:59 | 004,284,225 | R--- | M] () -- C:\Documents and Settings\Les\Desktop\ComFix.exe
[2011/03/08 12:18:56 | 000,002,225 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\EndNote Program.lnk
[2011/03/08 11:29:48 | 000,002,307 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PaperPort.lnk
[2011/03/08 10:49:53 | 000,000,328 | RHS- | M] () -- C:\boot.ini
[2011/03/07 10:19:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Les\Desktop\OTL.exe
[2011/03/03 15:12:36 | 048,149,880 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\ENX102Inst.exe
[2011/03/03 11:14:52 | 000,000,212 | ---- | M] () -- C:\Boot.bak
[2011/03/01 15:39:36 | 000,006,656 | ---- | M] () -- C:\WINDOWS\Personal\gardengrove.est
[2011/02/28 18:19:17 | 000,448,882 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Dorymyrmex bicolor.jpg
[2011/02/28 18:13:51 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/02/28 18:13:50 | 000,047,616 | ---- | M] () -- C:\Documents and Settings\Les\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/28 18:09:55 | 000,487,889 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Argentine ant.jpg
[2011/02/25 11:29:51 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Les\defogger_reenable
[2011/02/25 10:58:20 | 000,624,128 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\dds.scr
[2011/02/24 15:43:10 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Defogger.exe
[2011/02/23 16:28:13 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\qczjdkd6.exe
[2011/02/23 11:25:14 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/02/22 17:24:20 | 000,001,687 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/02/22 17:23:23 | 010,464,584 | ---- | M] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware.exe
[2011/02/22 14:01:34 | 000,104,537 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\error2.jpg
[2011/02/22 11:50:15 | 001,844,258 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help.mht
[2011/02/18 13:45:31 | 002,482,840 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\NPE.exe
[2011/02/18 12:11:39 | 008,559,782 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\error2.rtf
[2011/02/16 11:38:19 | 000,198,848 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2011/02/16 11:38:03 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2011/02/16 11:38:03 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2011/02/16 11:38:02 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll
[2011/02/15 15:06:49 | 000,196,096 | ---- | M] () -- C:\WINDOWS\Personal\American Jewish University.est
[2011/02/15 12:32:37 | 000,592,413 | ---- | M] () -- C:\Documents and Settings\Les\Desktop\patagonicus.jpg
[2011/02/11 18:14:33 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/02/11 17:28:06 | 000,000,793 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/09 05:53:52 | 000,270,848 | ---- | M] () -- C:\WINDOWS\System32\dllcache\sbe.dll
[2011/02/09 05:53:52 | 000,186,880 | ---- | M] () -- C:\WINDOWS\System32\dllcache\encdec.dll
[274 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/09 17:22:45 | 000,000,174 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\SYSTAT 13 32bit perpetual.lic
[2011/03/09 17:17:06 | 000,195,584 | ---- | C] () -- C:\WINDOWS\Personal\Bann Thai, Riverside.est
[2011/03/09 15:34:20 | 000,196,096 | ---- | C] () -- C:\WINDOWS\Personal\Uncle Billy's Kona resort.est
[2011/03/08 10:49:53 | 000,000,212 | ---- | C] () -- C:\Boot.bak
[2011/03/08 10:49:50 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/03/08 10:36:56 | 004,284,225 | R--- | C] () -- C:\Documents and Settings\Les\Desktop\ComFix.exe
[2011/03/03 15:12:32 | 048,149,880 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\ENX102Inst.exe
[2011/02/28 18:19:33 | 000,448,882 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Dorymyrmex bicolor.jpg
[2011/02/28 18:10:57 | 000,487,889 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Argentine ant.jpg
[2011/02/25 11:36:43 | 000,624,128 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\dds.scr
[2011/02/25 11:29:51 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Les\defogger_reenable
[2011/02/25 10:52:10 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Defogger.exe
[2011/02/23 16:28:12 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\qczjdkd6.exe
[2011/02/23 11:25:14 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/02/22 17:24:20 | 000,001,687 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/02/22 14:01:34 | 000,104,537 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\error2.jpg
[2011/02/22 11:50:12 | 001,844,258 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help.mht
[2011/02/18 12:36:00 | 002,482,840 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\NPE.exe
[2011/02/18 12:11:38 | 008,559,782 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\error2.rtf
[2011/02/16 11:38:58 | 000,000,274 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/02/16 11:38:57 | 000,000,282 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1482476501-842925246-854245398-1003.job
[2011/02/15 15:06:49 | 000,196,096 | ---- | C] () -- C:\WINDOWS\Personal\American Jewish University.est
[2011/02/15 12:33:26 | 000,592,413 | ---- | C] () -- C:\Documents and Settings\Les\Desktop\patagonicus.jpg
[2011/02/11 17:28:06 | 000,000,793 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/09 05:53:52 | 000,270,848 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sbe.dll
[2011/02/09 05:53:52 | 000,186,880 | ---- | C] () -- C:\WINDOWS\System32\dllcache\encdec.dll
[2011/01/04 13:44:47 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\Les\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/04 13:39:38 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/10/18 13:50:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\biv9x40.dll
[2010/02/16 14:42:32 | 000,033,036 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2010/01/25 14:28:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\KZM10.INI
[2010/01/14 10:36:29 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/01/14 10:36:29 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/01/14 10:36:29 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/01/14 10:36:29 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/01/14 10:36:29 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/06/05 17:47:00 | 000,061,208 | ---- | C] () -- C:\WINDOWS\System32\MPEG4E-uninstall.exe
[2008/10/28 03:32:40 | 000,950,272 | ---- | C] () -- C:\WINDOWS\System32\MPEG4Evfw.dll
[2008/10/02 11:46:34 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4906.dll
[2008/10/01 13:55:37 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/09/29 02:30:11 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2008/09/29 02:27:55 | 001,399,880 | R--- | C] () -- C:\WINDOWS\System32\igklg450.dll
[2008/09/29 02:27:54 | 001,843,784 | R--- | C] () -- C:\WINDOWS\System32\igklg400.dll
[2008/09/29 02:27:53 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v1409.dll
[2008/09/29 02:27:53 | 000,104,636 | R--- | C] () -- C:\WINDOWS\System32\igmedcompkrn.dll
[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/01/11 10:09:26 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2008/01/08 17:25:46 | 000,002,928 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/09/24 12:18:02 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\FLT_ffdshow.dll
[2007/08/15 14:33:14 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007/06/07 14:10:50 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\ac3config.exe
[2007/06/02 23:08:08 | 000,104,960 | ---- | C] () -- C:\WINDOWS\System32\dsmux.exe
[2007/06/02 23:06:14 | 000,151,040 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll
[2007/06/02 23:06:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\avi.dll
[2007/06/02 23:05:58 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\gdsmux.exe
[2007/06/02 23:05:44 | 000,142,848 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll
[2007/06/02 23:05:38 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\avss.dll
[2007/06/02 23:05:34 | 000,123,392 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll
[2007/06/02 23:05:20 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\mmfinfo.dll
[2007/06/02 23:05:04 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\ts.dll
[2007/06/02 23:04:54 | 000,233,984 | ---- | C] () -- C:\WINDOWS\System32\dxr.dll
[2007/06/02 23:04:32 | 000,100,352 | ---- | C] () -- C:\WINDOWS\System32\avs.dll
[2007/06/02 23:04:28 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\mkv2vfr.exe
[2007/06/02 23:04:16 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
[2007/06/02 23:04:14 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
[2007/04/15 15:33:33 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini
[2007/04/15 15:33:25 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv
[2007/02/13 14:33:29 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll
[2007/02/01 13:31:36 | 000,000,010 | ---- | C] () -- C:\WINDOWS\PureEdgeAPI.ini
[2006/11/01 06:54:30 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/09/12 14:24:09 | 000,046,345 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/08/29 09:30:35 | 000,059,172 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2004/12/16 17:56:29 | 000,002,048 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2004/09/16 11:51:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\frontpg.ini
[2004/09/16 11:48:27 | 000,021,791 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
[2004/09/16 11:48:25 | 000,001,037 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
[2004/09/16 11:46:16 | 000,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2004/09/16 11:46:14 | 000,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2004/09/16 11:45:58 | 000,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2004/09/16 11:45:43 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/04 08:07:22 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\myzhya8.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2004/08/04 07:56:44 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2004/08/04 07:56:44 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2004/08/04 07:56:44 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\tilnuwe.dll
[2004/08/04 00:56:46 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/08/02 21:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/07/01 11:14:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2004/06/07 18:20:56 | 000,000,395 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2004/06/07 18:20:27 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2004/03/25 10:43:15 | 000,047,616 | ---- | C] () -- C:\Documents and Settings\Les\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/02/18 16:13:19 | 000,061,440 | ---- | C] () -- C:\WINDOWS\wnUninstall.exe
[2003/11/06 10:34:36 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Les\Application Data\dm.ini
[2003/08/25 16:08:20 | 000,105,168 | ---- | C] () -- C:\WINDOWS\GREUninstall.exe
[2003/08/20 14:32:59 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2003/08/20 14:32:59 | 000,048,640 | ---- | C] () -- C:\WINDOWS\catalogSubInstaller.exe
[2003/08/07 10:27:43 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2003/08/07 10:20:52 | 000,000,660 | ---- | C] () -- C:\WINDOWS\LnkStub.dat
[2003/08/07 10:15:56 | 000,012,327 | ---- | C] () -- C:\WINDOWS\IOS.INI
[2003/08/07 10:15:56 | 000,006,239 | ---- | C] () -- C:\WINDOWS\WTGW60US.INI
[2003/08/07 10:15:56 | 000,005,393 | ---- | C] () -- C:\WINDOWS\EMCGM9.INI
[2003/08/07 10:15:56 | 000,005,068 | ---- | C] () -- C:\WINDOWS\DELETEFI.INI
[2003/08/07 10:15:56 | 000,004,595 | ---- | C] () -- C:\WINDOWS\HGW2.INI
[2003/08/07 10:15:56 | 000,004,347 | ---- | C] () -- C:\WINDOWS\mixerdef.ini
[2003/08/07 10:15:56 | 000,004,319 | ---- | C] () -- C:\WINDOWS\ISGDI16.INI
[2003/08/07 10:15:56 | 000,004,312 | ---- | C] () -- C:\WINDOWS\HFX100.INI
[2003/08/07 10:15:56 | 000,003,921 | ---- | C] () -- C:\WINDOWS\BIRDSNA2.INI
[2003/08/07 10:15:56 | 000,003,914 | ---- | C] () -- C:\WINDOWS\EMPS_9.INI
[2003/08/07 10:15:56 | 000,003,598 | ---- | C] () -- C:\WINDOWS\HTMLHELP.INI
[2003/08/07 10:15:56 | 000,003,592 | ---- | C] () -- C:\WINDOWS\BOWSV2.INI
[2003/08/07 10:15:56 | 000,003,544 | ---- | C] () -- C:\WINDOWS\MSMUSCTL.INI
[2003/08/07 10:15:56 | 000,003,183 | ---- | C] () -- C:\WINDOWS\telephon.ini
[2003/08/07 10:15:56 | 000,002,526 | ---- | C] () -- C:\WINDOWS\PUBLISH4.INI
[2003/08/07 10:15:56 | 000,002,284 | ---- | C] () -- C:\WINDOWS\FONTSMRT.INI
[2003/08/07 10:15:56 | 000,002,041 | ---- | C] () -- C:\WINDOWS\MSFNTMAP.INI
[2003/08/07 10:15:56 | 000,002,035 | ---- | C] () -- C:\WINDOWS\DOSAPP.INI
[2003/08/07 10:15:56 | 000,001,905 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2003/08/07 10:15:56 | 000,001,790 | ---- | C] () -- C:\WINDOWS\TBSQUIZ.INI
[2003/08/07 10:15:56 | 000,001,786 | ---- | C] () -- C:\WINDOWS\SYSTAT6.INI
[2003/08/07 10:15:56 | 000,001,780 | ---- | C] () -- C:\WINDOWS\EXCEL4.INI
[2003/08/07 10:15:56 | 000,001,745 | ---- | C] () -- C:\WINDOWS\ascd_tmp.ini
[2003/08/07 10:15:56 | 000,001,663 | ---- | C] () -- C:\WINDOWS\CHTBAK.INI
[2003/08/07 10:15:56 | 000,001,650 | ---- | C] () -- C:\WINDOWS\intuprof.ini
[2003/08/07 10:15:56 | 000,001,516 | ---- | C] () -- C:\WINDOWS\AD_PREFS.INI
[2003/08/07 10:15:56 | 000,001,399 | ---- | C] () -- C:\WINDOWS\QfnOnl.ini
[2003/08/07 10:15:56 | 000,001,350 | ---- | C] () -- C:\WINDOWS\NETSCAPE.INI
[2003/08/07 10:15:56 | 000,001,319 | ---- | C] () -- C:\WINDOWS\HP_CLJ85.INI
[2003/08/07 10:15:56 | 000,001,212 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2003/08/07 10:15:56 | 000,001,197 | ---- | C] () -- C:\WINDOWS\WTAPI.INI
[2003/08/07 10:15:56 | 000,001,010 | ---- | C] () -- C:\WINDOWS\WORDWIZ.INI
[2003/08/07 10:15:56 | 000,000,959 | ---- | C] () -- C:\WINDOWS\wnsetup.ini
[2003/08/07 10:15:56 | 000,000,921 | ---- | C] () -- C:\WINDOWS\EQNEDIT.INI
[2003/08/07 10:15:56 | 000,000,865 | ---- | C] () -- C:\WINDOWS\DOSREP.INI
[2003/08/07 10:15:56 | 000,000,846 | ---- | C] () -- C:\WINDOWS\JUKEBOX.INI
[2003/08/07 10:15:56 | 000,000,826 | ---- | C] () -- C:\WINDOWS\EMWMF9.INI
[2003/08/07 10:15:56 | 000,000,787 | ---- | C] () -- C:\WINDOWS\SCANREG.INI
[2003/08/07 10:15:56 | 000,000,758 | ---- | C] () -- C:\WINDOWS\PERWIN96.INI
[2003/08/07 10:15:56 | 000,000,701 | ---- | C] () -- C:\WINDOWS\WINWORD6.INI
[2003/08/07 10:15:56 | 000,000,663 | ---- | C] () -- C:\WINDOWS\artview.ini
[2003/08/07 10:15:56 | 000,000,594 | ---- | C] () -- C:\WINDOWS\PERWIN95.INI
[2003/08/07 10:15:56 | 000,000,576 | ---- | C] () -- C:\WINDOWS\TL6.INI
[2003/08/07 10:15:56 | 000,000,546 | ---- | C] () -- C:\WINDOWS\FTGW.INI
[2003/08/07 10:15:56 | 000,000,535 | ---- | C] () -- C:\WINDOWS\MSTXTCNV.INI
[2003/08/07 10:15:56 | 000,000,467 | ---- | C] () -- C:\WINDOWS\SIDEKICK.INI
[2003/08/07 10:15:56 | 000,000,444 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2003/08/07 10:15:56 | 000,000,429 | ---- | C] () -- C:\WINDOWS\EBJPG9.INI
[2003/08/07 10:15:56 | 000,000,382 | ---- | C] () -- C:\WINDOWS\EBTIF9.INI
[2003/08/07 10:15:56 | 000,000,375 | ---- | C] () -- C:\WINDOWS\EBBMP9.INI
[2003/08/07 10:15:56 | 000,000,350 | ---- | C] () -- C:\WINDOWS\QE.INI
[2003/08/07 10:15:56 | 000,000,341 | ---- | C] () -- C:\WINDOWS\XMPLAYER.INI
[2003/08/07 10:15:56 | 000,000,338 | ---- | C] () -- C:\WINDOWS\EXCEL.INI
[2003/08/07 10:15:56 | 000,000,331 | ---- | C] () -- C:\WINDOWS\RBJRD.INI
[2003/08/07 10:15:56 | 000,000,315 | ---- | C] () -- C:\WINDOWS\HPWTRMRK.INI
[2003/08/07 10:15:56 | 000,000,291 | ---- | C] () -- C:\WINDOWS\ORCH.INI
[2003/08/07 10:15:56 | 000,000,289 | ---- | C] () -- C:\WINDOWS\SPCDIRS.INI
[2003/08/07 10:15:56 | 000,000,280 | ---- | C] () -- C:\WINDOWS\TTEMBED.INI
[2003/08/07 10:15:56 | 000,000,275 | ---- | C] () -- C:\WINDOWS\FILEMAN.INI
[2003/08/07 10:15:56 | 000,000,252 | ---- | C] () -- C:\WINDOWS\TIMEWARP.INI
[2003/08/07 10:15:56 | 000,000,247 | ---- | C] () -- C:\WINDOWS\EMPCT9.INI
[2003/08/07 10:15:56 | 000,000,243 | ---- | C] () -- C:\WINDOWS\SMI.INI
[2003/08/07 10:15:56 | 000,000,237 | ---- | C] () -- C:\WINDOWS\MSMAIL.INI
[2003/08/07 10:15:56 | 000,000,234 | ---- | C] () -- C:\WINDOWS\TRDSPDRV.INI
[2003/08/07 10:15:56 | 000,000,232 | ---- | C] () -- C:\WINDOWS\IMWMF9.INI
[2003/08/07 10:15:56 | 000,000,228 | ---- | C] () -- C:\WINDOWS\VSADVCTL.INI
[2003/08/07 10:15:56 | 000,000,228 | ---- | C] () -- C:\WINDOWS\TOOLBOX.INI
[2003/08/07 10:15:56 | 000,000,224 | ---- | C] () -- C:\WINDOWS\AUDIOSTA.INI
[2003/08/07 10:15:56 | 000,000,207 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2003/08/07 10:15:56 | 000,000,205 | ---- | C] () -- C:\WINDOWS\CLIPBRD.INI
[2003/08/07 10:15:56 | 000,000,176 | ---- | C] () -- C:\WINDOWS\WINDAT.INI
[2003/08/07 10:15:56 | 000,000,159 | ---- | C] () -- C:\WINDOWS\sbpci.ini
[2003/08/07 10:15:56 | 000,000,125 | ---- | C] () -- C:\WINDOWS\ems16.ini
[2003/08/07 10:15:56 | 000,000,122 | ---- | C] () -- C:\WINDOWS\protocol.ini
[2003/08/07 10:15:56 | 000,000,120 | ---- | C] () -- C:\WINDOWS\MODLIST.INI
[2003/08/07 10:15:56 | 000,000,107 | ---- | C] () -- C:\WINDOWS\CMSurround.ini
[2003/08/07 10:15:56 | 000,000,099 | ---- | C] () -- C:\WINDOWS\FOXPRO.INI
[2003/08/07 10:15:56 | 000,000,094 | ---- | C] () -- C:\WINDOWS\AUTOMAP.INI
[2003/08/07 10:15:56 | 000,000,092 | ---- | C] () -- C:\WINDOWS\hyprview.ini
[2003/08/07 10:15:56 | 000,000,089 | ---- | C] () -- C:\WINDOWS\UULAUNCH.INI
[2003/08/07 10:15:56 | 000,000,085 | ---- | C] () -- C:\WINDOWS\CLOCK.INI
[2003/08/07 10:15:56 | 000,000,077 | ---- | C] () -- C:\WINDOWS\WINPROBE.INI
[2003/08/07 10:15:56 | 000,000,076 | ---- | C] () -- C:\WINDOWS\DBD.INI
[2003/08/07 10:15:56 | 000,000,072 | ---- | C] () -- C:\WINDOWS\SCANMGR.INI
[2003/08/07 10:15:56 | 000,000,069 | ---- | C] () -- C:\WINDOWS\MUSICBOX.INI
[2003/08/07 10:15:56 | 000,000,069 | ---- | C] () -- C:\WINDOWS\efaxpump.ini
[2003/08/07 10:15:56 | 000,000,065 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2003/08/07 10:15:56 | 000,000,065 | ---- | C] () -- C:\WINDOWS\KEYPAD.INI
[2003/08/07 10:15:56 | 000,000,063 | ---- | C] () -- C:\WINDOWS\ODBCISAM.INI
[2003/08/07 10:15:56 | 000,000,057 | ---- | C] () -- C:\WINDOWS\pixworks.ini
[2003/08/07 10:15:56 | 000,000,057 | ---- | C] () -- C:\WINDOWS\HPDS22.INI
[2003/08/07 10:15:56 | 000,000,052 | ---- | C] () -- C:\WINDOWS\THBVIEW.INI
[2003/08/07 10:15:56 | 000,000,051 | ---- | C] () -- C:\WINDOWS\TCWIN.INI
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\schdplus.ini
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\QDQIck.ini
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\ENTPACK.INI
[2003/08/07 10:15:56 | 000,000,049 | ---- | C] () -- C:\WINDOWS\COMPANON.INI
[2003/08/07 10:15:56 | 000,000,046 | ---- | C] () -- C:\WINDOWS\MOZART.INI
[2003/08/07 10:15:56 | 000,000,044 | ---- | C] () -- C:\WINDOWS\ODBCDDP.INI
[2003/08/07 10:15:56 | 000,000,044 | ---- | C] () -- C:\WINDOWS\EXCHNG32.INI
[2003/08/07 10:15:56 | 000,000,037 | ---- | C] () -- C:\WINDOWS\TBH.INI
[2003/08/07 10:15:56 | 000,000,034 | ---- | C] () -- C:\WINDOWS\SOL.INI
[2003/08/07 10:15:56 | 000,000,033 | ---- | C] () -- C:\WINDOWS\EWAN.INI
[2003/08/07 10:15:56 | 000,000,031 | ---- | C] () -- C:\WINDOWS\VBA.INI
[2003/08/07 10:15:56 | 000,000,031 | ---- | C] () -- C:\WINDOWS\bscrrun.ini
[2003/08/07 10:15:56 | 000,000,028 | ---- | C] () -- C:\WINDOWS\MOUSE.INI
[2003/08/07 10:15:56 | 000,000,028 | ---- | C] () -- C:\WINDOWS\HMCSTUFF.INI
[2003/08/07 10:15:56 | 000,000,022 | ---- | C] () -- C:\WINDOWS\calera.ini
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VTPWRA.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\TCWINCA.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\setscan.ini
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\progman.ini
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NREGEDIT.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSINFO32.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSDRAW.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HURRICAN.INI
[2003/08/07 10:15:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ATIDESK.INI
[2003/08/07 10:15:55 | 000,007,885 | ---- | C] () -- C:\WINDOWS\NETDET.INI
[2003/08/07 10:15:55 | 000,006,217 | ---- | C] () -- C:\WINDOWS\ZREG32S.INI
[2003/08/07 10:15:55 | 000,002,221 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2003/08/07 10:15:55 | 000,000,948 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2003/08/07 10:15:55 | 000,000,620 | ---- | C] () -- C:\WINDOWS\MSD.INI
[2003/08/07 10:15:55 | 000,000,512 | ---- | C] () -- C:\WINDOWS\PIB.INI
[2003/08/07 10:15:55 | 000,000,480 | ---- | C] () -- C:\WINDOWS\YSTATION.INI
[2003/08/07 10:15:55 | 000,000,186 | ---- | C] () -- C:\WINDOWS\NCDINFO.INI
[2003/08/07 10:15:55 | 000,000,175 | ---- | C] () -- C:\WINDOWS\WINFILE.INI
[2003/08/07 10:15:55 | 000,000,165 | ---- | C] () -- C:\WINDOWS\MSACM.INI
[2003/08/07 10:15:55 | 000,000,136 | ---- | C] () -- C:\WINDOWS\SERIALNO.INI
[2003/08/07 10:15:55 | 000,000,117 | ---- | C] () -- C:\WINDOWS\TDCI.INI
[2003/08/07 10:15:55 | 000,000,095 | ---- | C] () -- C:\WINDOWS\LDG.INI
[2003/08/07 10:15:55 | 000,000,067 | ---- | C] () -- C:\WINDOWS\WINMETER.INI
[2003/08/07 10:15:55 | 000,000,060 | ---- | C] () -- C:\WINDOWS\POWERPNT.INI
[2003/08/07 10:15:55 | 000,000,054 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2003/08/07 10:15:55 | 000,000,038 | ---- | C] () -- C:\WINDOWS\ACCWIZ.INI
[2003/08/07 10:15:55 | 000,000,026 | ---- | C] () -- C:\WINDOWS\MSOFFICE.INI
[2003/08/07 10:15:55 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2003/08/07 10:15:55 | 000,000,022 | ---- | C] () -- C:\WINDOWS\SHAREMEM.INI
[2003/08/07 10:15:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WHAKSHOT.INI
[2003/08/07 10:15:54 | 000,000,174 | ---- | C] () -- C:\WINDOWS\WINMINE.INI
[2003/08/07 10:07:37 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2003/08/07 10:01:49 | 000,004,590 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/08/07 10:00:49 | 000,334,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/08/01 10:36:43 | 001,237,140 | RH-- | C] () -- C:\WINDOWS\HWINFO.DAT
[2003/08/01 10:28:08 | 000,000,025 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/08/01 10:25:27 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\MEMBG.DLL
[2003/08/01 10:25:15 | 000,006,550 | ---- | C] () -- C:\WINDOWS\JAUTOEXP.DAT
[2003/07/22 21:41:18 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\CMedia.dll
[2003/07/22 21:41:17 | 000,049,152 | ---- | C] () -- C:\WINDOWS\W2K_c38uinst.exe
[2003/07/22 21:41:17 | 000,049,152 | ---- | C] () -- C:\WINDOWS\c38uinst.exe
[2003/07/22 18:06:24 | 000,077,824 | ---- | C] () -- C:\WINDOWS\uinst001.exe
[2003/06/26 18:54:50 | 000,105,168 | ---- | C] () -- C:\WINDOWS\NSUninst.exe
[2003/06/26 18:54:34 | 000,017,720 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2003/06/25 18:37:02 | 000,048,640 | ---- | C] () -- C:\WINDOWS\System32\HPFPNP.DLL
[2003/06/23 16:34:30 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Les\Local Settings\Application Data\fusioncache.dat
[2003/05/26 12:24:38 | 000,083,086 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2003/02/06 17:49:05 | 000,036,352 | ---- | C] () -- C:\WINDOWS\hpfsched.exe
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/16 15:52:19 | 000,634,065 | ---- | C] () -- C:\WINDOWS\cd32.exe
[2002/02/07 17:33:10 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\icmfilter.dll
[2001/12/05 16:07:02 | 000,100,864 | ---- | C] () -- C:\WINDOWS\System32\Dc50ip32.dll
[2001/12/05 16:06:59 | 000,065,864 | ---- | C] () -- C:\WINDOWS\System32\Digita.sys
[2001/12/05 16:06:57 | 000,007,808 | ---- | C] () -- C:\WINDOWS\System32\dc240u.sys
[2001/12/05 16:06:41 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\SoyWeb.dll
[2001/12/05 16:06:41 | 000,006,144 | ---- | C] () -- C:\WINDOWS\System32\ImgLibLead.dll
[2001/12/05 16:06:40 | 000,248,832 | ---- | C] () -- C:\WINDOWS\System32\ECircles.dll
[2001/08/23 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 12:00:00 | 000,522,794 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 12:00:00 | 000,101,114 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 12:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 12:00:00 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\zydrxqr.dll
[2001/08/23 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001/08/23 12:00:00 | 000,000,339 | ---- | C] () -- C:\WINDOWS\System32\wj6tyop.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\zf44tsw.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\z1j4tji.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\ycsep0m.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\wkufhx9.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\s0rmcnd.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\rjwnt7n.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\q0086qh.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\mhny8cu.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\hoe1fcn.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\hna3tb2.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\ek695fx.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\e65s219.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\e38o6gw.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\bsfwj3c.dll
[2001/08/23 12:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\acmyv8b.dll
[2001/04/27 16:47:18 | 000,122,345 | ---- | C] () -- C:\WINDOWS\preuninst.EXE
[2001/04/27 16:47:08 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\mstart.exe
[2001/04/27 16:47:07 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Dbwin32.exe
[2001/04/26 10:53:20 | 000,282,624 | ---- | C] () -- C:\WINDOWS\unin0411.exe
[2001/04/23 08:54:51 | 000,014,942 | ---- | C] () -- C:\WINDOWS\UNINSDEL.EXE
[2000/06/14 16:44:38 | 000,181,760 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2000/03/02 19:42:08 | 000,269,312 | ---- | C] () -- C:\WINDOWS\System32\FPXIG.DLL
[2000/03/02 19:42:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\System32\IGFPX32P.DLL
[2000/03/02 19:42:08 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\JPEGACC.DLL
[2000/02/29 15:19:40 | 000,011,264 | ---- | C] () -- C:\WINDOWS\System32\Thumb.dll
[2000/02/29 15:19:18 | 000,101,376 | ---- | C] () -- C:\WINDOWS\System32\welsof32.dll
[1999/10/22 12:07:47 | 000,011,079 | -H-- | C] () -- C:\Program Files\folder.htt
[1999/07/13 17:50:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\verinst.exe
[1999/07/12 14:50:53 | 000,009,026 | ---- | C] () -- C:\WINDOWS\hh.dat
[1999/06/11 16:29:01 | 000,016,384 | ---- | C] () -- C:\WINDOWS\hpu.dll
[1999/06/01 10:28:38 | 000,000,010 | ---- | C] () -- C:\WINDOWS\evypaths.bin
[1999/03/26 16:40:45 | 000,020,992 | ---- | C] () -- C:\WINDOWS\System32\PFMAPI32.DLL
[1998/10/28 13:59:44 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL
[1998/05/14 11:37:02 | 000,016,384 | ---- | C] () -- C:\WINDOWS\MSIMGSIZ.DAT
[1998/05/14 09:33:41 | 000,375,930 | ---- | C] () -- C:\WINDOWS\NETPWL.EXE
[1998/04/25 14:06:58 | 000,197,120 | ---- | C] () -- C:\WINDOWS\System32\ZTIFF.DLL
[1998/04/25 14:06:55 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\FLTERROR.DLL
[1998/04/20 14:33:24 | 000,013,824 | ---- | C] () -- C:\WINDOWS\System32\wb32lib5.dll
[1998/04/20 14:33:24 | 000,013,824 | ---- | C] () -- C:\WINDOWS\System32\wb32lib4.dll
[1998/01/30 15:02:41 | 000,001,421 | ---- | C] () -- C:\WINDOWS\EReg132.dat
[1997/10/10 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[1997/04/12 23:15:07 | 000,008,724 | ---- | C] () -- C:\WINDOWS\QFNOAD16.DAT
[1997/04/10 14:02:23 | 000,097,056 | ---- | C] () -- C:\WINDOWS\System32\TRIDDD32.DLL
[1997/04/10 13:58:28 | 000,000,026 | ---- | C] () -- C:\WINDOWS\TRDEFREF.DAT
[1997/04/09 17:11:57 | 000,006,960 | ---- | C] () -- C:\WINDOWS\CER.EXE
[1997/04/09 16:20:14 | 000,012,250 | ---- | C] () -- C:\WINDOWS\WPURL16.DLL
[1997/04/04 15:01:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\CONNECT.DAT
[1997/01/13 18:27:18 | 000,030,464 | ---- | C] () -- C:\WINDOWS\MACROMIX.DLL
[1996/08/15 10:25:44 | 000,102,656 | ---- | C] () -- C:\WINDOWS\PR1630.DLL
[1996/02/23 02:10:00 | 000,099,600 | ---- | C] () -- C:\WINDOWS\CER.DLL
[1995/03/02 16:05:14 | 000,016,848 | ---- | C] () -- C:\WINDOWS\HOTKEY.DLL
[1995/03/02 10:48:16 | 000,050,064 | ---- | C] () -- C:\WINDOWS\ATIDTUTL.DLL
[1994/10/31 18:59:46 | 000,102,912 | ---- | C] () -- C:\WINDOWS\ATICNTL.DLL
[1994/10/21 19:51:58 | 000,016,656 | ---- | C] () -- C:\WINDOWS\DESKSCAN.DLL
[1994/10/21 19:51:22 | 000,019,968 | ---- | C] () -- C:\WINDOWS\DPMS.DLL
[1994/10/01 13:55:34 | 000,039,973 | ---- | C] () -- C:\WINDOWS\WTSETUP.EXE
[1994/05/31 06:22:00 | 000,119,557 | ---- | C] () -- C:\WINDOWS\MEMMAKER.EXE
[1994/05/31 06:22:00 | 000,041,600 | ---- | C] () -- C:\WINDOWS\CHKSTATE.SYS
[1994/05/31 06:22:00 | 000,007,169 | ---- | C] () -- C:\WINDOWS\SIZER.EXE
[1993/11/01 03:11:00 | 000,148,528 | ---- | C] () -- C:\WINDOWS\CARDS.DLL
[1993/11/01 03:11:00 | 000,016,378 | ---- | C] () -- C:\WINDOWS\EXPAND.EXE
[1993/11/01 03:11:00 | 000,010,414 | ---- | C] () -- C:\WINDOWS\RECORDER.DLL
[1992/10/05 20:00:00 | 000,038,704 | ---- | C] () -- C:\WINDOWS\WNGRAFIC.DLL
[1992/10/05 20:00:00 | 000,022,960 | ---- | C] () -- C:\WINDOWS\WNTSR.DLL
[1992/10/05 20:00:00 | 000,020,032 | ---- | C] () -- C:\WINDOWS\CPSICONS.DLL

========== LOP Check ==========

[2010/08/18 09:55:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2009/06/05 17:43:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Extensions
[2008/10/28 12:48:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2010/12/20 12:59:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NewsView
[2010/07/13 14:04:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nuance
[2010/01/14 17:41:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/03/21 17:58:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995
[2009/04/24 12:27:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PhotoStitch
[2007/02/01 13:31:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PureEdge
[2011/02/18 16:31:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2009/10/30 12:21:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
[2010/07/13 14:02:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/03/03 15:37:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2011/03/10 10:29:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/05/26 13:40:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\zeon
[2011/03/08 11:41:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\.oit
[2005/10/20 10:12:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Active Disk
[2009/05/06 15:35:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Canon
[2006/02/13 13:43:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\DeductionPro 2005-06
[2011/03/09 10:16:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\EndNote
[2011/02/22 11:37:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\FixCleaner
[2004/06/07 18:35:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\FUJIFILM
[2009/05/15 14:29:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\HDRsoft
[2006/03/01 11:55:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\HorizonWimba
[2009/05/27 12:31:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\ISI ResearchSoft
[2003/08/07 10:15:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Leadertech
[2006/12/19 13:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Netscape
[2010/05/26 13:53:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Nuance
[2009/11/04 11:57:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Octoshape
[2007/04/15 15:33:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\pdf995
[2007/02/01 13:31:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\PureEdge
[2009/03/03 15:58:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\SigmaPlot 11.0
[2010/03/21 17:58:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\TaxCut
[2010/01/20 11:57:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Tific
[2011/02/11 16:59:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Uniblue
[2010/01/28 15:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Windows Desktop Search
[2008/09/29 08:05:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Windows Search
[2010/05/26 13:38:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Les\Application Data\Zeon
[2011/03/10 13:12:00 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{01EA7816-2C2F-44D4-9017-536659A092B7}.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 250 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01C66DD9
@Alternate Data Stream - 238 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B9FB94D

< End of report >

#12 m0le

Can U Dig It?

Malware Response Team
34,528 posts
OFFLINE

Gender:Male
Location:London, UK
Local time:02:28 AM

Posted 10 March 2011 - 05:56 PM

Well, that's a nasty one. Please run TDSSKiller first of all, I think a rootkit is playing us.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

"%userprofile%\Desktop\TDSSKiller.exe" -l report.txt
Now click Start Scan.
If Malicious objects are found, ensure Cure is selected then click Continue > Reboot now.
Click Close
Finally press Report and copy and paste the contents into your next reply. If you've rebooted then the log will be found at C:\

m0le is a proud member of UNITE

#13 Lesgreen

Topic Starter

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 10 March 2011 - 06:17 PM

mOle,

TDSS didn't find anything. The Software Manager icon is not visible at this time, but was earlier in the day.

2011/03/10 15:11:03.0281 3544 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/10 15:11:04.0750 3544 ================================================================================
2011/03/10 15:11:04.0750 3544 SystemInfo:
2011/03/10 15:11:04.0750 3544
2011/03/10 15:11:04.0750 3544 OS Version: 5.1.2600 ServicePack: 3.0
2011/03/10 15:11:04.0750 3544 Product type: Workstation
2011/03/10 15:11:04.0750 3544 ComputerName: LESGREEN
2011/03/10 15:11:04.0750 3544 UserName: Les
2011/03/10 15:11:04.0750 3544 Windows directory: C:\WINDOWS
2011/03/10 15:11:04.0750 3544 System windows directory: C:\WINDOWS
2011/03/10 15:11:04.0750 3544 Processor architecture: Intel x86
2011/03/10 15:11:04.0750 3544 Number of processors: 2
2011/03/10 15:11:04.0750 3544 Page size: 0x1000
2011/03/10 15:11:04.0750 3544 Boot type: Normal boot
2011/03/10 15:11:04.0750 3544 ================================================================================
2011/03/10 15:11:05.0546 3544 Initialize success
2011/03/10 15:11:26.0328 2292 ================================================================================
2011/03/10 15:11:26.0328 2292 Scan started
2011/03/10 15:11:26.0328 2292 Mode: Manual;
2011/03/10 15:11:26.0328 2292 ================================================================================
2011/03/10 15:11:26.0765 2292 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/03/10 15:11:26.0828 2292 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/03/10 15:11:26.0890 2292 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
2011/03/10 15:11:26.0953 2292 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/03/10 15:11:27.0125 2292 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/03/10 15:11:27.0218 2292 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/03/10 15:11:27.0250 2292 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/03/10 15:11:27.0328 2292 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/03/10 15:11:27.0437 2292 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/03/10 15:11:27.0531 2292 BCMNTIO (90a87d49205b3893281203a477f66fe5) C:\PROGRA~1\CHECKIT\DIAGNO~1\BCMNTIO.sys
2011/03/10 15:11:27.0578 2292 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/03/10 15:11:27.0765 2292 BHDrvx86 (32d6e07922d17bed40ae746fc86b8a68) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110309.001\BHDrvx86.sys
2011/03/10 15:11:27.0890 2292 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/03/10 15:11:27.0968 2292 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/03/10 15:11:28.0015 2292 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/03/10 15:11:28.0062 2292 Cdr4_xp (bf79e659c506674c0497cc9c61f1a165) C:\WINDOWS\system32\drivers\Cdr4_xp.sys
2011/03/10 15:11:28.0109 2292 Cdralw2k (2c41cd49d82d5fd85c72d57b6ca25471) C:\WINDOWS\system32\drivers\Cdralw2k.sys
2011/03/10 15:11:28.0156 2292 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/03/10 15:11:28.0203 2292 cdudf_xp (8c7746acde6225a46b58ed7ae09ec166) C:\WINDOWS\system32\drivers\cdudf_xp.sys
2011/03/10 15:11:28.0468 2292 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/03/10 15:11:28.0562 2292 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/03/10 15:11:28.0625 2292 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\DRIVERS\dmio.sys
2011/03/10 15:11:28.0656 2292 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/03/10 15:11:28.0703 2292 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2011/03/10 15:11:28.0781 2292 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/03/10 15:11:28.0828 2292 e1express (34aaa3b298a852b3663e6e0d94d12945) C:\WINDOWS\system32\DRIVERS\e1e5132.sys
2011/03/10 15:11:28.0968 2292 eeCtrl (089296aedb9b72b4916ac959752bdc89) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/03/10 15:11:28.0984 2292 EraserUtilRebootDrv (850259334652d392e33ee3412562e583) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
2011/03/10 15:11:29.0046 2292 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/03/10 15:11:29.0093 2292 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/03/10 15:11:29.0156 2292 FETND5BV (cfc4cc73c903152a23e1db28eaba1f03) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
2011/03/10 15:11:29.0218 2292 FETNDISB (17ed59da290d5a25063265b3da08488e) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
2011/03/10 15:11:29.0265 2292 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/03/10 15:11:29.0328 2292 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/03/10 15:11:29.0359 2292 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/03/10 15:11:29.0421 2292 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/03/10 15:11:29.0453 2292 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/03/10 15:11:29.0500 2292 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2011/03/10 15:11:29.0546 2292 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/03/10 15:11:29.0593 2292 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/03/10 15:11:29.0640 2292 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/03/10 15:11:29.0765 2292 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/03/10 15:11:29.0843 2292 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/03/10 15:11:29.0968 2292 ialm (0f68e2ec713f132ffb19e45415b09679) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2011/03/10 15:11:30.0281 2292 IDSxpx86 (0308238c582a55d83d34feee39542793) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110308.003\IDSxpx86.sys
2011/03/10 15:11:30.0406 2292 igfx (c134e69ce901422d1f2d7ea8d69098fe) C:\WINDOWS\system32\DRIVERS\igdkmd32.sys
2011/03/10 15:11:30.0515 2292 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\drivers\Imapi.sys
2011/03/10 15:11:30.0562 2292 InCDfs (580a81790cd0a48d85da322267da7ac4) C:\WINDOWS\system32\drivers\InCDFs.sys
2011/03/10 15:11:30.0593 2292 InCDPass (aaa2789d2ce21b31be9406ba1ceb7285) C:\WINDOWS\system32\drivers\InCDPass.sys
2011/03/10 15:11:30.0640 2292 InCDrec (4d022577e9072b5d22e0a383a7806bbb) C:\WINDOWS\system32\drivers\InCDrec.sys
2011/03/10 15:11:30.0687 2292 incdrm (c258e57321a3c3737f4fa815fa69ee0b) C:\WINDOWS\system32\drivers\InCDRm.sys
2011/03/10 15:11:30.0859 2292 IntcAzAudAddService (dbc702fbc70dc58d9122ce56eadbd659) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/03/10 15:11:31.0015 2292 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/03/10 15:11:31.0062 2292 iomdisk (9d7069d72c0c72952f05e1688a5ae89d) C:\WINDOWS\system32\DRIVERS\iomdisk.sys
2011/03/10 15:11:31.0140 2292 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/03/10 15:11:31.0187 2292 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/03/10 15:11:31.0234 2292 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/03/10 15:11:31.0281 2292 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/03/10 15:11:31.0328 2292 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/03/10 15:11:31.0375 2292 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/03/10 15:11:31.0406 2292 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/03/10 15:11:31.0453 2292 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/03/10 15:11:31.0500 2292 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
2011/03/10 15:11:31.0531 2292 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/03/10 15:11:31.0703 2292 MAPMEM (61330a29bd4230505a7618bc41693cbb) C:\PROGRA~1\CHECKIT\DIAGNO~1\MAPMEM.sys
2011/03/10 15:11:31.0765 2292 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/03/10 15:11:31.0828 2292 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/03/10 15:11:31.0859 2292 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/03/10 15:11:31.0890 2292 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/03/10 15:11:31.0937 2292 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/03/10 15:11:32.0015 2292 MREMP50 (9bd4dcb5412921864a7aacdedfbd1923) C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS
2011/03/10 15:11:32.0046 2292 MRESP50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS
2011/03/10 15:11:32.0093 2292 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/03/10 15:11:32.0187 2292 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/03/10 15:11:32.0250 2292 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/03/10 15:11:32.0328 2292 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/03/10 15:11:32.0375 2292 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/03/10 15:11:32.0437 2292 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/03/10 15:11:32.0484 2292 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/03/10 15:11:32.0531 2292 ms_mpu401 (ca3e22598f411199adc2dfee76cd0ae0) C:\WINDOWS\system32\drivers\msmpu401.sys
2011/03/10 15:11:32.0562 2292 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/03/10 15:11:32.0703 2292 NAVENG (c8ef74e4d8105b1d02d58ea4734cf616) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110310.003\NAVENG.SYS
2011/03/10 15:11:32.0765 2292 NAVEX15 (94b3164055d821a62944d9fe84036470) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110310.003\NAVEX15.SYS
2011/03/10 15:11:32.0828 2292 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/03/10 15:11:32.0875 2292 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/03/10 15:11:32.0921 2292 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/03/10 15:11:32.0968 2292 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/03/10 15:11:33.0031 2292 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/03/10 15:11:33.0078 2292 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/03/10 15:11:33.0125 2292 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/03/10 15:11:33.0203 2292 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/03/10 15:11:33.0265 2292 NPDriver (65194f525aef541eaa5056eb3d53a25b) C:\WINDOWS\system32\Drivers\NPDRIVER.SYS
2011/03/10 15:11:33.0296 2292 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/03/10 15:11:33.0359 2292 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/03/10 15:11:33.0453 2292 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/03/10 15:11:33.0500 2292 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/03/10 15:11:33.0546 2292 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/03/10 15:11:33.0593 2292 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/03/10 15:11:33.0656 2292 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/03/10 15:11:33.0703 2292 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/03/10 15:11:33.0734 2292 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/03/10 15:11:33.0781 2292 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/03/10 15:11:33.0843 2292 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/03/10 15:11:33.0875 2292 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/03/10 15:11:34.0140 2292 pmxscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/03/10 15:11:34.0203 2292 Point32 (e5582e43e167cf367757d81e9727da2a) C:\WINDOWS\system32\DRIVERS\point32.sys
2011/03/10 15:11:34.0265 2292 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/03/10 15:11:34.0312 2292 PQNTDrv (4228630829c0e521c43d882a00533374) C:\WINDOWS\system32\drivers\PQNTDrv.sys
2011/03/10 15:11:34.0375 2292 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/03/10 15:11:34.0406 2292 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/03/10 15:11:34.0437 2292 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/03/10 15:11:34.0609 2292 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/03/10 15:11:34.0656 2292 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/03/10 15:11:34.0687 2292 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/03/10 15:11:34.0718 2292 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/03/10 15:11:34.0750 2292 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/03/10 15:11:34.0796 2292 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/03/10 15:11:34.0843 2292 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/03/10 15:11:34.0906 2292 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/03/10 15:11:34.0953 2292 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/03/10 15:11:35.0015 2292 S3Psddr (5cf6ea833ebd3cf79573e6960f4b9e0b) C:\WINDOWS\system32\DRIVERS\s3gnbm.sys
2011/03/10 15:11:35.0109 2292 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/03/10 15:11:35.0125 2292 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/03/10 15:11:35.0203 2292 SDdriver (11b5e1da4566a68a881a7d73222f4c78) C:\WINDOWS\system32\Drivers\sddriver.sys
2011/03/10 15:11:35.0250 2292 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/03/10 15:11:35.0312 2292 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/03/10 15:11:35.0359 2292 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/03/10 15:11:35.0375 2292 sermouse (1f16931c722c69e4a7866244796c66a0) C:\WINDOWS\system32\DRIVERS\sermouse.sys
2011/03/10 15:11:35.0437 2292 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/03/10 15:11:35.0562 2292 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2011/03/10 15:11:35.0640 2292 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
2011/03/10 15:11:35.0687 2292 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/03/10 15:11:35.0796 2292 SRTSP (a7a104a61c4e30de9c58f8c372a5c209) C:\WINDOWS\System32\Drivers\NIS\1205000.07D\SRTSP.SYS
2011/03/10 15:11:35.0859 2292 SRTSPX (2833445f786bd000bb14c84a9d91347a) C:\WINDOWS\system32\drivers\NIS\1205000.07D\SRTSPX.SYS
2011/03/10 15:11:35.0921 2292 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/03/10 15:11:35.0984 2292 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/03/10 15:11:36.0046 2292 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2011/03/10 15:11:36.0187 2292 SymDS (bdf077b897b5f9f929b6bf0cfd436962) C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMDS.SYS
2011/03/10 15:11:36.0250 2292 SymEFA (7732298ad2eddd364c1d4f439d99ae7c) C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMEFA.SYS
2011/03/10 15:11:36.0343 2292 SymEvent (5c76a63fac8a5580c5a1c4a4ed827782) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
2011/03/10 15:11:36.0406 2292 SymIM (b571a32ca2752f13b69f1da01ae03cbe) C:\WINDOWS\system32\DRIVERS\SymIM.sys
2011/03/10 15:11:36.0406 2292 SymIMMP (b571a32ca2752f13b69f1da01ae03cbe) C:\WINDOWS\system32\DRIVERS\SymIM.sys
2011/03/10 15:11:36.0468 2292 SymIRON (a73399804d5d4a8b20ba60fcf70c9f1f) C:\WINDOWS\system32\drivers\NIS\1205000.07D\Ironx86.SYS
2011/03/10 15:11:36.0531 2292 SYMTDI (8c07683bf02b63ad71bcb2cf28af2d06) C:\WINDOWS\system32\drivers\NIS\1205000.07D\SYMTDI.SYS
2011/03/10 15:11:36.0640 2292 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/03/10 15:11:36.0703 2292 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/03/10 15:11:36.0765 2292 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/03/10 15:11:36.0828 2292 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/03/10 15:11:36.0890 2292 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/03/10 15:11:36.0953 2292 TVICHW32 (e266683fc95abdec17cd378564e1b54b) C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS
2011/03/10 15:11:37.0000 2292 UdfReadr_xp (e1b5bfba7f1cde1fc28934639e83b3cf) C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
2011/03/10 15:11:37.0031 2292 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/03/10 15:11:37.0171 2292 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/03/10 15:11:37.0234 2292 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/03/10 15:11:37.0265 2292 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/03/10 15:11:37.0281 2292 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/03/10 15:11:37.0359 2292 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/03/10 15:11:37.0406 2292 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/03/10 15:11:37.0468 2292 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/03/10 15:11:37.0515 2292 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/03/10 15:11:37.0562 2292 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/03/10 15:11:37.0593 2292 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/03/10 15:11:37.0625 2292 VIASens (d3fb0a70fa3e3a62f1b2faa88daabae8) C:\WINDOWS\system32\drivers\viasens.sys
2011/03/10 15:11:37.0687 2292 VIAudio (8fe5fd4c124808b30720b84fd07051c2) C:\WINDOWS\system32\drivers\viaudios.sys
2011/03/10 15:11:37.0734 2292 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/03/10 15:11:37.0781 2292 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/03/10 15:11:37.0875 2292 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/03/10 15:11:37.0953 2292 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/03/10 15:11:38.0093 2292 ================================================================================
2011/03/10 15:11:38.0093 2292 Scan finished
2011/03/10 15:11:38.0093 2292 ================================================================================

#14 m0le

Can U Dig It?

Malware Response Team
34,528 posts
OFFLINE

Gender:Male
Location:London, UK
Local time:02:28 AM

Posted 10 March 2011 - 06:45 PM

Please run OTL as shown below

Open OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:files
C:\WINDOWS\System32\*.tmp
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"

Then click the Run Fix button at the top

Let the program run unhindered.

When done it will say "Fix Complete press ok to open the log"
Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Next please rerun Combofix as shown below.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the box below into it:

File::
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144327.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144329.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144330.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144331.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144332.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144494.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144496.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144497.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144498.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144499.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP222\A0145355.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145755.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145757.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145758.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145759.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145760.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145827.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145829.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145830.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145831.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145899.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145901.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145902.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145903.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145904.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146008.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146010.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146011.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146012.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146013.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148009.msi
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148096.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148098.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148099.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148100.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148101.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148325.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148327.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148328.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148329.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148330.rbf
C:\System Volume Information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148336.rbf
C:\temp_ESA\atmcns.msi

Save this as CFScript.txt, in the same location as Comfix.exe (called ComboFix.exe in the below graphic)

Posted Image

m0le is a proud member of UNITE

#15 Lesgreen

Topic Starter

Members
25 posts
OFFLINE

Local time:05:28 PM

Posted 10 March 2011 - 08:15 PM

mOle,

I have attached the logs below. After moving the CFScript into ComboFix a couple of error windows popped up. One said that the file or program Pev.exe had encountered an error and had to close. The second window said the same thing about Firefox.exe. To my knowledge I don't even have Firefox installed. Combo then continued to run after I closed the windows. At the end of the Combo scan it said "Combo needs to submit malware files for further analysis, make sure you have an internet connection." It then uploaded the files (at least it appeared to). Then the log popped up which is attached.

HERE IS THE OTL LOG:

========== FILES ==========
C:\WINDOWS\System32\CONFIG.TMP moved successfully.
C:\WINDOWS\System32\SET107D.tmp moved successfully.
C:\WINDOWS\System32\SET1080.tmp moved successfully.
C:\WINDOWS\System32\SET1085.tmp moved successfully.
C:\WINDOWS\System32\SET10B7.tmp moved successfully.
C:\WINDOWS\System32\SET1137.tmp moved successfully.
C:\WINDOWS\System32\SET187.tmp moved successfully.
C:\WINDOWS\System32\SET18A.tmp moved successfully.
C:\WINDOWS\System32\SET18B.tmp moved successfully.
C:\WINDOWS\System32\SET18D.tmp moved successfully.
C:\WINDOWS\System32\SET18F.tmp moved successfully.
C:\WINDOWS\System32\SET191.tmp moved successfully.
C:\WINDOWS\System32\SET194.tmp moved successfully.
C:\WINDOWS\System32\SET198.tmp moved successfully.
C:\WINDOWS\System32\SET199.tmp moved successfully.
C:\WINDOWS\System32\SET19C.tmp moved successfully.
C:\WINDOWS\System32\SET1A1.tmp moved successfully.
C:\WINDOWS\System32\SET1A2.tmp moved successfully.
C:\WINDOWS\System32\SET1A3.tmp moved successfully.
C:\WINDOWS\System32\SET1A6.tmp moved successfully.
C:\WINDOWS\System32\SET1A7.tmp moved successfully.
C:\WINDOWS\System32\SET1A8.tmp moved successfully.
C:\WINDOWS\System32\SET1AA.tmp moved successfully.
C:\WINDOWS\System32\SET1AB.tmp moved successfully.
C:\WINDOWS\System32\SET1AE.tmp moved successfully.
C:\WINDOWS\System32\SET1AF.tmp moved successfully.
C:\WINDOWS\System32\SET1B0.tmp moved successfully.
C:\WINDOWS\System32\SET1B5.tmp moved successfully.
C:\WINDOWS\System32\SET1BC.tmp moved successfully.
C:\WINDOWS\System32\SET1BD.tmp moved successfully.
C:\WINDOWS\System32\SET1BE.tmp moved successfully.
C:\WINDOWS\System32\SET1C1.tmp moved successfully.
C:\WINDOWS\System32\SET1C3.tmp moved successfully.
C:\WINDOWS\System32\SET1C4.tmp moved successfully.
C:\WINDOWS\System32\SET1CB.tmp moved successfully.
C:\WINDOWS\System32\SET1CE.tmp moved successfully.
C:\WINDOWS\System32\SET1CF.tmp moved successfully.
C:\WINDOWS\System32\SET1D1.tmp moved successfully.
C:\WINDOWS\System32\SET1D6.tmp moved successfully.
C:\WINDOWS\System32\SET1D7.tmp moved successfully.
C:\WINDOWS\System32\SET1D8.tmp moved successfully.
C:\WINDOWS\System32\SET1D9.tmp moved successfully.
C:\WINDOWS\System32\SET1DC.tmp moved successfully.
C:\WINDOWS\System32\SET1DF.tmp moved successfully.
C:\WINDOWS\System32\SET1E2.tmp moved successfully.
C:\WINDOWS\System32\SET1E8.tmp moved successfully.
C:\WINDOWS\System32\SET1E9.tmp moved successfully.
C:\WINDOWS\System32\SET1EC.tmp moved successfully.
C:\WINDOWS\System32\SET1EF.tmp moved successfully.
C:\WINDOWS\System32\SET1F0.tmp moved successfully.
C:\WINDOWS\System32\SET1F7.tmp moved successfully.
C:\WINDOWS\System32\SET1F8.tmp moved successfully.
C:\WINDOWS\System32\SET1FB.tmp moved successfully.
C:\WINDOWS\System32\SET1FF.tmp moved successfully.
C:\WINDOWS\System32\SET208.tmp moved successfully.
C:\WINDOWS\System32\SET209.tmp moved successfully.
C:\WINDOWS\System32\SET20A.tmp moved successfully.
C:\WINDOWS\System32\SET20D.tmp moved successfully.
C:\WINDOWS\System32\SET20F.tmp moved successfully.
C:\WINDOWS\System32\SET210.tmp moved successfully.
C:\WINDOWS\System32\SET211.tmp moved successfully.
C:\WINDOWS\System32\SET212.tmp moved successfully.
C:\WINDOWS\System32\SET213.tmp moved successfully.
C:\WINDOWS\System32\SET214.tmp moved successfully.
C:\WINDOWS\System32\SET219.tmp moved successfully.
C:\WINDOWS\System32\SET21A.tmp moved successfully.
C:\WINDOWS\System32\SET21B.tmp moved successfully.
C:\WINDOWS\System32\SET227.tmp moved successfully.
C:\WINDOWS\System32\SET22B.tmp moved successfully.
C:\WINDOWS\System32\SET22C.tmp moved successfully.
C:\WINDOWS\System32\SET22D.tmp moved successfully.
C:\WINDOWS\System32\SET22E.tmp moved successfully.
C:\WINDOWS\System32\SET230.tmp moved successfully.
C:\WINDOWS\System32\SET231.tmp moved successfully.
C:\WINDOWS\System32\SET232.tmp moved successfully.
C:\WINDOWS\System32\SET235.tmp moved successfully.
C:\WINDOWS\System32\SET236.tmp moved successfully.
C:\WINDOWS\System32\SET23A.tmp moved successfully.
C:\WINDOWS\System32\SET23B.tmp moved successfully.
C:\WINDOWS\System32\SET23E.tmp moved successfully.
C:\WINDOWS\System32\SET23F.tmp moved successfully.
C:\WINDOWS\System32\SET240.tmp moved successfully.
C:\WINDOWS\System32\SET246.tmp moved successfully.
C:\WINDOWS\System32\SET247.tmp moved successfully.
C:\WINDOWS\System32\SET248.tmp moved successfully.
C:\WINDOWS\System32\SET250.tmp moved successfully.
C:\WINDOWS\System32\SET251.tmp moved successfully.
C:\WINDOWS\System32\SET256.tmp moved successfully.
C:\WINDOWS\System32\SET257.tmp moved successfully.
C:\WINDOWS\System32\SET258.tmp moved successfully.
C:\WINDOWS\System32\SET25A.tmp moved successfully.
C:\WINDOWS\System32\SET25C.tmp moved successfully.
C:\WINDOWS\System32\SET261.tmp moved successfully.
C:\WINDOWS\System32\SET262.tmp moved successfully.
C:\WINDOWS\System32\SET26E.tmp moved successfully.
C:\WINDOWS\System32\SET270.tmp moved successfully.
C:\WINDOWS\System32\SET272.tmp moved successfully.
C:\WINDOWS\System32\SET273.tmp moved successfully.
C:\WINDOWS\System32\SET274.tmp moved successfully.
C:\WINDOWS\System32\SET277.tmp moved successfully.
C:\WINDOWS\System32\SET280.tmp moved successfully.
C:\WINDOWS\System32\SET284.tmp moved successfully.
C:\WINDOWS\System32\SET285.tmp moved successfully.
C:\WINDOWS\System32\SET288.tmp moved successfully.
C:\WINDOWS\System32\SET28A.tmp moved successfully.
C:\WINDOWS\System32\SET28D.tmp moved successfully.
C:\WINDOWS\System32\SET294.tmp moved successfully.
C:\WINDOWS\System32\SET29E.tmp moved successfully.
C:\WINDOWS\System32\SET2A0.tmp moved successfully.
C:\WINDOWS\System32\SET2A1.tmp moved successfully.
C:\WINDOWS\System32\SET2A2.tmp moved successfully.
C:\WINDOWS\System32\SET2A9.tmp moved successfully.
C:\WINDOWS\System32\SET2AA.tmp moved successfully.
C:\WINDOWS\System32\SET2AD.tmp moved successfully.
C:\WINDOWS\System32\SET2AE.tmp moved successfully.
C:\WINDOWS\System32\SET2AF.tmp moved successfully.
C:\WINDOWS\System32\SET2B0.tmp moved successfully.
C:\WINDOWS\System32\SET2B1.tmp moved successfully.
C:\WINDOWS\System32\SET2B3.tmp moved successfully.
C:\WINDOWS\System32\SET2B4.tmp moved successfully.
C:\WINDOWS\System32\SET2B5.tmp moved successfully.
C:\WINDOWS\System32\SET2B7.tmp moved successfully.
C:\WINDOWS\System32\SET2B8.tmp moved successfully.
C:\WINDOWS\System32\SET2B9.tmp moved successfully.
C:\WINDOWS\System32\SET2BB.tmp moved successfully.
C:\WINDOWS\System32\SET2BE.tmp moved successfully.
C:\WINDOWS\System32\SET2BF.tmp moved successfully.
C:\WINDOWS\System32\SET2C1.tmp moved successfully.
C:\WINDOWS\System32\SET2C3.tmp moved successfully.
C:\WINDOWS\System32\SET2C4.tmp moved successfully.
C:\WINDOWS\System32\SET2C5.tmp moved successfully.
C:\WINDOWS\System32\SET2C9.tmp moved successfully.
C:\WINDOWS\System32\SET2CA.tmp moved successfully.
C:\WINDOWS\System32\SET2CB.tmp moved successfully.
C:\WINDOWS\System32\SET2CC.tmp moved successfully.
C:\WINDOWS\System32\SET2CE.tmp moved successfully.
C:\WINDOWS\System32\SET2D1.tmp moved successfully.
C:\WINDOWS\System32\SET2D3.tmp moved successfully.
C:\WINDOWS\System32\SET2D4.tmp moved successfully.
C:\WINDOWS\System32\SET2D7.tmp moved successfully.
C:\WINDOWS\System32\SET2D8.tmp moved successfully.
C:\WINDOWS\System32\SET2DB.tmp moved successfully.
C:\WINDOWS\System32\SET2DE.tmp moved successfully.
C:\WINDOWS\System32\SET2DF.tmp moved successfully.
C:\WINDOWS\System32\SET2E1.tmp moved successfully.
C:\WINDOWS\System32\SET2E2.tmp moved successfully.
C:\WINDOWS\System32\SET2E6.tmp moved successfully.
C:\WINDOWS\System32\SET2E8.tmp moved successfully.
C:\WINDOWS\System32\SET2EB.tmp moved successfully.
C:\WINDOWS\System32\SET2EF.tmp moved successfully.
C:\WINDOWS\System32\SET2F1.tmp moved successfully.
C:\WINDOWS\System32\SET2F2.tmp moved successfully.
C:\WINDOWS\System32\SET2F5.tmp moved successfully.
C:\WINDOWS\System32\SET2F6.tmp moved successfully.
C:\WINDOWS\System32\SET2FC.tmp moved successfully.
C:\WINDOWS\System32\SET2FD.tmp moved successfully.
C:\WINDOWS\System32\SET2FF.tmp moved successfully.
C:\WINDOWS\System32\SET300.tmp moved successfully.
C:\WINDOWS\System32\SET306.tmp moved successfully.
C:\WINDOWS\System32\SET307.tmp moved successfully.
C:\WINDOWS\System32\SET308.tmp moved successfully.
C:\WINDOWS\System32\SET309.tmp moved successfully.
C:\WINDOWS\System32\SET30A.tmp moved successfully.
C:\WINDOWS\System32\SET30B.tmp moved successfully.
C:\WINDOWS\System32\SET30D.tmp moved successfully.
C:\WINDOWS\System32\SET30F.tmp moved successfully.
C:\WINDOWS\System32\SET312.tmp moved successfully.
C:\WINDOWS\System32\SET317.tmp moved successfully.
C:\WINDOWS\System32\SET318.tmp moved successfully.
C:\WINDOWS\System32\SET319.tmp moved successfully.
C:\WINDOWS\System32\SET31A.tmp moved successfully.
C:\WINDOWS\System32\SET31D.tmp moved successfully.
C:\WINDOWS\System32\SET31F.tmp moved successfully.
C:\WINDOWS\System32\SET320.tmp moved successfully.
C:\WINDOWS\System32\SET321.tmp moved successfully.
C:\WINDOWS\System32\SET323.tmp moved successfully.
C:\WINDOWS\System32\SET325.tmp moved successfully.
C:\WINDOWS\System32\SET32A.tmp moved successfully.
C:\WINDOWS\System32\SET32C.tmp moved successfully.
C:\WINDOWS\System32\SET32D.tmp moved successfully.
C:\WINDOWS\System32\SET333.tmp moved successfully.
C:\WINDOWS\System32\SET33E.tmp moved successfully.
C:\WINDOWS\System32\SET342.tmp moved successfully.
C:\WINDOWS\System32\SET343.tmp moved successfully.
C:\WINDOWS\System32\SET347.tmp moved successfully.
C:\WINDOWS\System32\SET34C.tmp moved successfully.
C:\WINDOWS\System32\SET34F.tmp moved successfully.
C:\WINDOWS\System32\SET350.tmp moved successfully.
C:\WINDOWS\System32\SET351.tmp moved successfully.
C:\WINDOWS\System32\SET354.tmp moved successfully.
C:\WINDOWS\System32\SET357.tmp moved successfully.
C:\WINDOWS\System32\SET359.tmp moved successfully.
C:\WINDOWS\System32\SET35A.tmp moved successfully.
C:\WINDOWS\System32\SET363.tmp moved successfully.
C:\WINDOWS\System32\SET365.tmp moved successfully.
C:\WINDOWS\System32\SET369.tmp moved successfully.
C:\WINDOWS\System32\SET379.tmp moved successfully.
C:\WINDOWS\System32\SET37D.tmp moved successfully.
C:\WINDOWS\System32\SET37F.tmp moved successfully.
C:\WINDOWS\System32\SET381.tmp moved successfully.
C:\WINDOWS\System32\SET387.tmp moved successfully.
C:\WINDOWS\System32\SET388.tmp moved successfully.
C:\WINDOWS\System32\SET38B.tmp moved successfully.
C:\WINDOWS\System32\SET393.tmp moved successfully.
C:\WINDOWS\System32\SET39C.tmp moved successfully.
C:\WINDOWS\System32\SET3A1.tmp moved successfully.
C:\WINDOWS\System32\SET3A3.tmp moved successfully.
C:\WINDOWS\System32\SET3A5.tmp moved successfully.
C:\WINDOWS\System32\SET3A6.tmp moved successfully.
C:\WINDOWS\System32\SET3AC.tmp moved successfully.
C:\WINDOWS\System32\SET3B0.tmp moved successfully.
C:\WINDOWS\System32\SET3B7.tmp moved successfully.
C:\WINDOWS\System32\SET3BA.tmp moved successfully.
C:\WINDOWS\System32\SET3BC.tmp moved successfully.
C:\WINDOWS\System32\SET3C2.tmp moved successfully.
C:\WINDOWS\System32\SET3D2.tmp moved successfully.
C:\WINDOWS\System32\SET3D3.tmp moved successfully.
C:\WINDOWS\System32\SET3D5.tmp moved successfully.
C:\WINDOWS\System32\SET3D6.tmp moved successfully.
C:\WINDOWS\System32\SET3D7.tmp moved successfully.
C:\WINDOWS\System32\SET3E3.tmp moved successfully.
C:\WINDOWS\System32\SET3EE.tmp moved successfully.
C:\WINDOWS\System32\SET3FE.tmp moved successfully.
C:\WINDOWS\System32\SET3FF.tmp moved successfully.
C:\WINDOWS\System32\SET404.tmp moved successfully.
C:\WINDOWS\System32\SET40E.tmp moved successfully.
C:\WINDOWS\System32\SET429.tmp moved successfully.
C:\WINDOWS\System32\SET42C.tmp moved successfully.
C:\WINDOWS\System32\SET433.tmp moved successfully.
C:\WINDOWS\System32\SET434.tmp moved successfully.
C:\WINDOWS\System32\SET435.tmp moved successfully.
C:\WINDOWS\System32\SET437.tmp moved successfully.
C:\WINDOWS\System32\SET438.tmp moved successfully.
C:\WINDOWS\System32\SET439.tmp moved successfully.
C:\WINDOWS\System32\SET43A.tmp moved successfully.
C:\WINDOWS\System32\SET43C.tmp moved successfully.
C:\WINDOWS\System32\SET43E.tmp moved successfully.
C:\WINDOWS\System32\SET43F.tmp moved successfully.
C:\WINDOWS\System32\SET441.tmp moved successfully.
C:\WINDOWS\System32\SET444.tmp moved successfully.
C:\WINDOWS\System32\SET446.tmp moved successfully.
C:\WINDOWS\System32\SET44B.tmp moved successfully.
C:\WINDOWS\System32\SET44C.tmp moved successfully.
C:\WINDOWS\System32\SET454.tmp moved successfully.
C:\WINDOWS\System32\SET45B.tmp moved successfully.
C:\WINDOWS\System32\SET45C.tmp moved successfully.
C:\WINDOWS\System32\SET45D.tmp moved successfully.
C:\WINDOWS\System32\SET462.tmp moved successfully.
C:\WINDOWS\System32\SET465.tmp moved successfully.
C:\WINDOWS\System32\SET468.tmp moved successfully.
C:\WINDOWS\System32\SET46A.tmp moved successfully.
C:\WINDOWS\System32\SET46E.tmp moved successfully.
C:\WINDOWS\System32\SET470.tmp moved successfully.
C:\WINDOWS\System32\SET471.tmp moved successfully.
C:\WINDOWS\System32\SET472.tmp moved successfully.
C:\WINDOWS\System32\SET476.tmp moved successfully.
C:\WINDOWS\System32\SET477.tmp moved successfully.
C:\WINDOWS\System32\SET478.tmp moved successfully.
C:\WINDOWS\System32\SET47B.tmp moved successfully.
C:\WINDOWS\System32\SET47C.tmp moved successfully.
C:\WINDOWS\System32\SET481.tmp moved successfully.
C:\WINDOWS\System32\SET487.tmp moved successfully.
C:\WINDOWS\System32\SET48A.tmp moved successfully.
C:\WINDOWS\System32\SET48E.tmp moved successfully.
C:\WINDOWS\System32\SET490.tmp moved successfully.
C:\WINDOWS\System32\SET492.tmp moved successfully.
C:\WINDOWS\System32\SET638.tmp moved successfully.
C:\WINDOWS\System32\SET640.tmp moved successfully.
C:\WINDOWS\System32\SET646.tmp moved successfully.
C:\WINDOWS\System32\SET651.tmp moved successfully.
C:\WINDOWS\System32\SET652.tmp moved successfully.
C:\WINDOWS\System32\SET653.tmp moved successfully.
C:\WINDOWS\System32\SET65B.tmp moved successfully.
C:\WINDOWS\System32\SET667.tmp moved successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!

OTL by OldTimer - Version 3.2.22.3 log created on 03102011_160300

HERE IS THE COMBO LOG:

ComboFix 11-03-10.01 - Les 03/10/2011 16:21:34.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1275 [GMT -8:00]
Running from: c:\documents and settings\Les\Desktop\ComFix.exe
Command switches used :: c:\documents and settings\Les\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
FILE ::
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144327.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144329.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144330.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144331.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144332.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144494.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144496.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144497.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144498.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144499.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP222\A0145355.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145755.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145757.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145758.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145759.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145760.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145827.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145829.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145830.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145831.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145899.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145901.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145902.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145903.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145904.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146008.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146010.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146011.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146012.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146013.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148009.msi"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148096.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148098.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148099.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148100.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148101.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148325.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148327.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148328.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148329.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148330.rbf"
"c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148336.rbf"
"c:\temp_esa\atmcns.msi"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144327.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144329.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144330.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144331.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144332.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144494.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144496.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144497.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144498.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP221\A0144499.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP222\A0145355.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145755.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145757.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145758.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145759.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145760.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145827.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145829.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145830.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145831.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145899.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145901.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145902.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145903.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0145904.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146008.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146010.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146011.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146012.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP223\A0146013.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148009.msi
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148096.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148098.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148099.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148100.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148101.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148325.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148327.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148328.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148329.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148330.rbf
c:\system volume information\_restore{E40B9A95-077A-4D0E-9CFE-2360E0349B72}\RP228\A0148336.rbf
c:\temp_esa\atmcns.msi
.
.
((((((((((((((((((((((((( Files Created from 2011-02-11 to 2011-03-11 )))))))))))))))))))))))))))))))
.
.
2011-03-11 00:03 . 2011-03-11 00:03 -------- d-----w- C:\_OTL
2011-03-10 19:00 . 2011-03-10 19:00 -------- d-----w- c:\program files\ESET
2011-03-10 18:33 . 2011-03-10 18:33 -------- d-----w- c:\windows\LastGood
2011-03-04 19:01 . 2011-03-04 19:03 -------- d-----w- c:\program files\EndNote X1
2011-03-03 19:37 . 2010-11-23 04:59 44024 ----a-r- c:\windows\system32\drivers\SymIM.sys
2011-03-03 19:23 . 2011-03-03 19:27 -------- d-----w- c:\program files\Common Files\Motive
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\documents and settings\Les\Application Data\SUPERAntiSpyware.com
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-02-23 01:24 . 2011-02-23 01:24 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-02-22 19:09 . 2011-02-22 19:37 -------- d-----w- c:\documents and settings\Les\Application Data\FixCleaner
2011-02-22 19:08 . 2011-02-22 19:36 -------- d-----w- c:\program files\FixCleaner
2011-02-19 01:09 . 2011-03-03 19:29 -------- d-----w- c:\documents and settings\Les\Application Data\Verizon
2011-02-19 01:09 . 2011-03-03 19:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon
2011-02-16 19:38 . 2011-02-16 19:38 -------- d-----w- c:\program files\Common Files\xing shared
2011-02-15 22:02 . 2011-02-19 00:25 -------- d-----w- c:\documents and settings\Les\Local Settings\Application Data\NPE
2011-02-15 21:45 . 2011-02-19 00:31 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2011-02-12 02:15 . 2011-02-12 02:14 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-12 02:08 . 2011-02-12 02:08 -------- d-----w- c:\documents and settings\Les\Local Settings\Application Data\Sunbelt Software
2011-02-12 01:28 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-12 01:28 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-12 00:59 . 2011-02-12 00:59 -------- d-----w- c:\documents and settings\Les\Application Data\Uniblue
2011-02-12 00:20 . 2011-02-12 00:20 -------- d-----w- c:\documents and settings\Les\Application Data\Motive
2011-02-12 00:18 . 2011-02-12 00:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2011-02-12 00:16 . 2011-03-03 19:29 -------- d-----w- c:\program files\Verizon
2011-02-09 13:53 . 2011-02-09 13:53 270848 ------w- c:\windows\system32\dllcache\sbe.dll
2011-02-09 13:53 . 2011-02-09 13:53 186880 ------w- c:\windows\system32\dllcache\encdec.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-16 19:37 . 2006-07-12 01:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-02-16 19:37 . 2003-03-19 06:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-02-09 13:53 . 2004-08-04 15:56 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 15:56 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2003-08-07 19:59 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2003-08-07 19:59 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-04 15:56 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-10 21:21 . 2010-01-20 20:42 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2011-01-10 21:21 . 2010-01-20 20:42 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-01-07 14:09 . 2004-08-04 15:56 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10 . 2004-08-04 14:17 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-04 15:56 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:59 . 2004-08-04 15:56 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:59 . 2004-08-04 15:56 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-20 23:59 . 2004-08-04 15:56 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 17:26 . 2004-08-04 15:56 730112 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-04 13:59 385024 ----a-w- c:\windows\system32\html.iec
.
.
------- Sigcheck -------
.
[7] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[7] 2008-04-13 17:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\aec.sys
[-] 2006-02-15 01:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2004-08-04 16:05 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\SYSTEM32\DRIVERS\aec.sys
.
((((((((((((((((((((((((((((( SnapShot@2011-03-08_19.02.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-03-10 18:28 . 2011-03-10 18:28 16384 c:\windows\TEMP\Perflib_Perfdata_934.dat
+ 2011-03-10 18:29 . 2011-03-10 18:29 16384 c:\windows\TEMP\Perflib_Perfdata_880.dat
+ 2011-03-10 18:27 . 2011-03-10 18:27 16384 c:\windows\TEMP\Perflib_Perfdata_474.dat
- 2011-03-08 19:02 . 2011-03-08 19:02 53248 c:\windows\TEMP\catchme.dll
+ 2011-03-11 00:30 . 2011-03-11 00:30 53248 c:\windows\TEMP\catchme.dll
- 2004-09-16 22:51 . 2011-02-10 19:52 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2003-08-07 18:00 . 2011-03-10 18:26 334664 c:\windows\SYSTEM32\FNTCACHE.DAT
- 2003-08-07 18:00 . 2011-03-08 17:44 334664 c:\windows\SYSTEM32\FNTCACHE.DAT
+ 2011-01-27 11:57 . 2011-01-27 11:57 677888 c:\windows\SYSTEM32\dllcache\lhmstsc.exe
- 2009-06-03 22:12 . 2010-08-11 17:59 262144 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
+ 2009-06-03 22:12 . 2011-03-09 18:46 262144 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
+ 2009-03-09 17:49 . 2011-03-09 18:42 421888 c:\windows\repair\RegBack\UsrClass.dat
- 2004-09-16 22:51 . 2011-02-10 19:52 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2004-09-16 22:51 . 2011-02-10 19:52 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2004-09-16 22:51 . 2011-03-10 18:32 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2011-02-02 07:58 . 2011-02-02 07:58 2067456 c:\windows\SYSTEM32\dllcache\lhmstscx.dll
+ 2011-02-22 18:32 . 2011-02-22 18:32 5520384 c:\windows\Installer\514ad.msp
+ 2005-05-11 17:53 . 2011-03-10 18:34 37943240 c:\windows\SYSTEM32\MRT.exe
+ 2005-10-20 00:38 . 2011-03-09 18:40 10231808 c:\windows\repair\RegBack\NTUSER.DAT
- 2003-08-07 18:12 . 2011-03-08 18:52 10354688 c:\windows\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2003-08-07 18:12 . 2011-03-11 00:21 10354688 c:\windows\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-08 68856]
"ISUSPM"="c:\documents and settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"SunJavaUpdateSched"="c:\program files\Adobe\Acrobat 9.0\Designer 8.2\jre\bin\jusched.exe" [2008-05-23 75520]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"RTHDCPL"="RTHDCPL.EXE" [2008-03-03 16859648]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 69632]
"QD FastAndSafe"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 69632]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-03 131072]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-06-01 1468296]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-03 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-03 159744]
"ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-25 147456]
"NSWosCheck"="c:\program files\Norton SystemWorks Basic Edition\osCheck.exe" [2008-09-25 160112]
"NswUiTray"="c:\program files\Norton SystemWorks Basic Edition\NswUiTray.exe" [2008-09-25 85360]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"PPort12reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"PDFHook"="c:\program files\Nuance\PDFViewerPlus\pdfpro5hook.exe" [2010-02-09 1369376]
"PDF5 Registry Controller"="c:\program files\Nuance\PDFViewerPlus\RegistryController.exe" [2010-02-09 62752]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\QUALCOMM\EUDORA\EUSHLEXT.DLL" [2006-08-17 86016]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WNW Tray Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WNW Tray Agent.lnk
backup=c:\windows\pss\WNW Tray Agent.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"LiveUpdate"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Common Files\\ABC7 QuickCast\\TrueWeather.exe"=
"c:\\Program Files\\Netscape\\Netscape\\Netscp.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Documents and Settings\\Les\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Documents and Settings\\Les\\Application Data\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"50000:UDP"= 50000:UDP:IHA_MessageCenter
.
R0 SymDS;Symantec Data Store;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\SymDS.sys [1/10/2011 1:20 PM 340016]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\SymEFA.sys [1/10/2011 1:20 PM 652336]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110309.001\BHDrvx86.sys [3/10/2011 2:04 PM 800376]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 10:41 AM 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\SYSTEM32\DRIVERS\NIS\1205000.07D\Ironx86.sys [1/10/2011 1:20 PM 136312]
R2 BCMNTIO;BCMNTIO;c:\progra~1\CHECKIT\DIAGNO~1\BCMNTIO.sys [4/8/2009 4:51 PM 3744]
R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [10/13/2010 5:06 PM 98304]
R2 MAPMEM;MAPMEM;c:\progra~1\CHECKIT\DIAGNO~1\MAPMEM.sys [4/8/2009 4:51 PM 3904]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [1/10/2011 1:20 PM 130000]
R2 NProtectService;Norton UnErase Protection;c:\progra~1\NORTON~2\NORTON~1\NPROTECT.EXE [9/25/2008 2:53 PM 95600]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\Nuance\PaperPort\PDFProFiltSrvPP.exe [2/10/2010 10:30 PM 144672]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/16/2010 8:31 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110308.003\IDSXpx86.sys [3/10/2011 10:38 AM 341944]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/5/2010 4:56 PM 135664]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 pmxscan;Visioneer USB Kernel;c:\windows\SYSTEM32\DRIVERS\usbscan.sys [9/12/2008 11:33 AM 15104]
S3 VIASens;Vinyl Sensaura WDM 3D Audio Driver;c:\windows\SYSTEM32\DRIVERS\viasens.sys [11/7/2003 7:07 AM 391680]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - CFCATCHME
*NewlyCreated* - KLMD25
*Deregistered* - CFcatchme
*Deregistered* - klmd25
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-24 01:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 13:42 73216 ----a-w- c:\program files\Outlook Express\setup50.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
2002-12-10 17:57 7168 ----a-w- c:\windows\SYSTEM32\updcrl.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2006-12-20 00:34]
.
2011-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 00:55]
.
2011-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 00:55]
.
2011-03-10 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job
- c:\program files\Norton SystemWorks Basic Edition\OBC.exe [2008-09-25 22:52]
.
2011-03-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1482476501-842925246-854245398-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 22:25]
.
2011-03-11 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1482476501-842925246-854245398-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 22:25]
.
2011-03-11 c:\windows\Tasks\User_Feed_Synchronization-{01EA7816-2C2F-44D4-9017-536659A092B7}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 12:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://finance.yahoo.com/p?v&k=pf_1
mSearch Bar = hxxp://home.netscape.com/home/winsearch200.html
uSearchURL,(Default) = hxxp://keyword.netscape.com/keyword/%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
Name-Space Handler: ftp\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\NZDD.DLL
Name-Space Handler: http\RealDownload - {EBCDDA5E-2A68-11D3-8A43-0060083CFB9C} - c:\windows\SYSTEM32\NZDD.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-10 16:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\$$$\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(800)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-03-10 16:33:51
ComboFix-quarantined-files.txt 2011-03-11 00:33
ComboFix2.txt 2011-03-09 19:24
ComboFix3.txt 2011-03-08 19:05
ComboFix4.txt 2010-01-14 18:57
.
Pre-Run: 153,956,194,816 bytes free
Post-Run: 154,061,060,608 bytes free
.
- - End Of File - - 199A6A5E2B1F7E979CB572972E3072EF