Solved patah Hati.doc.exe worm cant remove.

chiefmissile · 2010/10/08

When using panda for my flash stick, i get the message "Vaccination was not possible. This volume format support is not active" not sure what this means but i can't open my flash stick now, keeps telling me to format, when i do this it says unable to format??

broni · 2010/10/08

I suggest, you create new topic in "Hardware" forum, regarding your USB stick.
Here, I want to make sure, your computer is clean.

=================================================================

I can see some Norton's leftovers.
Please, run Norton Removal Tool: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

=============================================================

You posted Extras.txt log twice and 2nd part of OTL.txt log is missing.
Please, repost.

broni · 2010/10/14

Are you still out there?

chiefmissile · 2010/10/15

Hi been away from home with work, back now and ready to get started. Only one log file will create for OTL, i have posted this in two parts as its very big.

chiefmissile · 2010/10/15

OTL logfile created on: 15/10/2010 06:26:25 - Run 3
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\drew\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.7930.16406)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 230.87 Gb Total Space | 77.43 Gb Free Space | 33.54% Space Free | Partition Type: NTFS
Drive D: | 11.50 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 1.90 Gb Total Space | 1.89 Gb Free Space | 99.58% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DREW-PC
Current User Name: drew
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/10/08 09:33:03 | 000,576,512 | ---- | M] (OldTimer Tools) -- C:\Users\drew\Desktop\OTL.exe
PRC - [2010/09/21 14:18:22 | 000,232,912 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10k_ActiveX.exe
PRC - [2010/09/15 04:34:02 | 001,094,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/07/14 22:06:54 | 000,114,688 | ---- | M] () -- C:\Program Files\Broadband Internet\Broadband Internet.exe
PRC - [2010/07/01 12:07:20 | 001,361,128 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
PRC - [2010/07/01 12:07:18 | 000,840,936 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
PRC - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2009/09/23 16:45:50 | 001,287,176 | ---- | M] (Panda Security) -- C:\Program Files\Panda USB Vaccine\USBVaccine.exe
PRC - [2009/08/18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009/08/18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009/07/03 11:40:40 | 002,328,576 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
PRC - [2009/07/03 11:40:30 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/11/20 16:07:54 | 001,940,992 | ---- | M] (mobile concepts GmbH) -- C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe
PRC - [2008/10/10 23:17:50 | 000,132,456 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2008/08/14 17:15:46 | 002,407,184 | ---- | M] () -- C:\Program Files\Logitech\QuickCam\Quickcam.exe
PRC - [2008/08/14 17:11:48 | 000,565,008 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2008/08/14 17:11:14 | 000,447,248 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2008/07/26 08:25:36 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2008/07/26 08:23:42 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007/12/27 15:39:30 | 000,166,520 | ---- | M] () -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
PRC - [2007/12/27 15:39:20 | 000,051,816 | ---- | M] () -- C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
PRC - [2006/10/30 17:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 09:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
PRC - [2005/12/05 19:04:00 | 000,691,200 | ---- | M] () -- C:\Program Files\dvd43\DVD43_Tray.exe

========== Modules (SafeList) ==========

MOD - [2010/10/08 09:33:03 | 000,576,512 | ---- | M] (OldTimer Tools) -- C:\Users\drew\Desktop\OTL.exe
MOD - [2010/08/31 16:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2010/06/07 18:07:08 | 000,541,928 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\rooksbas.dll
MOD - [2008/07/26 08:25:24 | 000,109,080 | ---- | M] (Logitech Inc.) -- C:\Windows\temp\logishrd\LVPrcInj01.dll
MOD - [2008/01/19 08:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/08/18 00:49:16 | 000,797,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2010/07/01 12:07:18 | 000,840,936 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)
SRV - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010/04/28 07:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/11/06 10:18:50 | 000,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/08/18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009/07/03 11:40:30 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService)
SRV - [2008/11/20 16:07:54 | 001,940,992 | ---- | M] (mobile concepts GmbH) [Auto | Running] -- C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe -- (CGVPNCliSrvc)
SRV - [2008/10/10 23:17:50 | 000,132,456 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2008/07/26 08:25:36 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008/07/26 08:23:42 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2008/01/19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/27 15:39:30 | 000,166,520 | ---- | M] () [Auto | Running] -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)
SRV - [2007/12/27 15:39:20 | 000,051,816 | ---- | M] () [Auto | Running] -- C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe -- (Start BT in service)
SRV - [2006/12/14 03:21:20 | 000,045,056 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV)
SRV - [2006/12/14 03:02:08 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2006/12/14 02:46:16 | 000,057,344 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2006/11/18 04:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Stopped] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2005/11/14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\PCASp50.sys -- (PCASp50)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\drew\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2010/09/10 05:43:12 | 004,569,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2010/09/10 05:43:12 | 004,569,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2010/09/10 05:25:51 | 006,628,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2010/07/01 12:07:30 | 000,166,632 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys -- (RapportPG)
DRV - [2010/07/01 12:07:30 | 000,059,240 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportKELL.sys -- (RapportKELL)
DRV - [2010/04/28 07:44:02 | 000,054,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2010/03/25 21:30:22 | 000,151,216 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\MpFilter.sys -- (MpFilter)
DRV - [2010/03/25 21:30:22 | 000,042,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010/02/12 16:54:14 | 000,018,816 | ---- | M] (RIF) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dvd43llh.sys -- (dvd43llh)
DRV - [2009/09/15 21:04:58 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009/04/11 05:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/01/15 14:01:56 | 000,042,880 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2009/01/14 18:46:04 | 000,077,824 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2008/12/11 18:02:20 | 000,054,272 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2008/10/08 06:15:12 | 000,025,216 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2008/10/06 17:56:38 | 000,137,984 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbd.sys -- (Tosrfbd)
DRV - [2008/09/26 18:04:22 | 000,113,152 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2008/09/26 18:04:10 | 000,101,760 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2008/09/26 18:03:26 | 000,023,424 | ---- | M] (Huawei Tech. Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewdcsc.sys -- (Huawei) Vodafone Mobile Broadband - USB Smart Card Reader (Huawei)
DRV - [2008/08/27 18:01:56 | 000,074,240 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008/08/22 13:50:34 | 000,064,000 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2008/07/26 16:26:44 | 004,658,584 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) QuickCam Orbit/Sphere AF(UVC)
DRV - [2008/07/26 16:26:22 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008/07/26 16:26:00 | 000,066,456 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvselsus.sys -- (lvselsus)
DRV - [2008/07/26 16:25:48 | 000,627,864 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2008/07/26 08:25:02 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2008/03/25 13:54:02 | 000,041,472 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)
DRV - [2008/03/04 03:32:00 | 000,188,416 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008/01/29 11:50:59 | 000,020,152 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/29 11:50:59 | 000,019,128 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/29 11:50:59 | 000,017,592 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2008/01/23 22:25:32 | 000,027,136 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tapvpn.sys -- (tapvpn)
DRV - [2007/11/29 09:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2007/06/24 21:56:54 | 000,038,920 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btcusb.sys -- (Btcsrusb)
DRV - [2007/06/24 21:56:40 | 000,027,656 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)
DRV - [2007/06/24 21:56:34 | 000,034,312 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\blueletaudio.sys -- (BlueletAudio)
DRV - [2007/05/01 09:59:30 | 000,160,768 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2007/03/29 01:13:08 | 000,042,496 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTSTOR.sys -- (RTSTOR)
DRV - [2007/03/05 20:59:04 | 000,018,320 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btnetdrv.sys -- (BT)
DRV - [2007/03/05 20:56:18 | 000,035,600 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\BTHidMgr.sys -- (BTHidMgr)
DRV - [2007/03/05 20:55:12 | 000,020,880 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\vbtenum.sys -- (BTHidEnum)
DRV - [2007/03/05 20:53:18 | 000,044,304 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VCommMgr.sys -- (VcommMgr)
DRV - [2007/03/05 20:52:18 | 000,034,448 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VComm.sys -- (VComm)
DRV - [2007/02/25 05:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007/01/15 15:28:20 | 000,070,144 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006/11/02 10:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 08:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/11/02 08:30:53 | 000,167,936 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
DRV - [2006/10/23 10:17:32 | 000,179,896 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2005/11/17 15:36:34 | 000,008,064 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\flash.sys -- (flash)
DRV - [2005/01/07 05:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2004/04/26 23:31:04 | 000,474,304 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvcd.sys -- (QCDonner) Logitech QuickCam Express(PID_0840)
DRV - [2003/04/28 19:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\HOTKEY.sys -- (Hotkey)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "MyWebSearch "
FF - prefs.js..browser.startup.homepage: "http://shop.thefreevpn.com/home.php "
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: msntoolbar@msn.com:4.0
FF - prefs.js..keyword.URL: "http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZUxdm493YYOM&ptb=Wp5oZJJB9aIws8mXG46L0g&psa=&ind=2010040109&ptnrS=ZUxdm493YYOM&si=&st=kwd&n=77cec72d&searchfor= "

FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\Firefox [2010/10/01 06:56:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/03 18:31:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/07 09:54:09 | 000,000,000 | ---D | M]

[2010/02/12 12:01:23 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Mozilla\Extensions
[2008/10/25 19:20:01 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2010/09/22 08:05:52 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\0x3g8mve.default\extensions
[2010/08/24 11:45:00 | 000,000,000 | ---D | M] (ooVoo Video Chat Toolbar) -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\0x3g8mve.default\extensions\{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}(90)
[2010/09/03 11:44:45 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions
[2010/05/05 07:14:46 | 000,000,000 | ---D | M] (CS Lite) -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{00084897-021a-4361-8423-083407a033e0}
[2010/06/06 12:28:34 | 000,000,000 | ---D | M] (JonDoFox) -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{437be45a-4114-11dd-b9ab-71d256d89593}
[2010/08/24 11:43:33 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(99)
[2010/08/24 11:43:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(100)
[2010/08/24 11:43:32 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(101)
[2010/08/24 11:43:32 | 000,000,000 | ---D | M] (ProfileSwitcher) -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{fa8476cf-a98c-4e08-99b4-65a69cb4b7d4}
[2010/04/05 08:40:59 | 000,010,025 | ---- | M] () -- C:\Users\drew\AppData\Roaming\Mozilla\Firefox\Profiles\0x3g8mve.default\searchplugins\mywebsearch.xml
[2010/08/12 21:08:08 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/08/12 21:13:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/08/12 21:12:45 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/06/22 09:11:44 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/06/22 09:11:44 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/06/22 09:11:44 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/06/22 09:11:44 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/10/07 06:38:14 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [dvd43] C:\Program Files\dvd43\DVD43_Tray.exe ()
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMovingBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCloseDragDropBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarsOnTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoSecCPL = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDevMgrPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoConfigPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoVirtMemPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoFileSysPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetup = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetupIDPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetupSecurityPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoWorkgroupContents = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoEntireNetwork = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoFileSharingControl = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} http://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20090618123620 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab (Reg Error: Key error.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-gb.cab (MSN Photo Upload Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1280723831996 (MUWebControl Class)
O16 - DPF: {7CF3E7C4-6112-4D72-A0CD-D0AD7EEB5467} http://www.packetix.net/en/special/files/vpn2_5350_en/vpnweb.cab (VpnWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab (EPUImageControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-gb.cab (Windows Live Hotmail Photo Upload Tool)
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\drew\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\drew\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008/04/24 14:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - D:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007/11/07 16:41:52 | 000,000,047 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/10/15 05:29:00 | 000,921,512 | ---- | C] (Symantec Corporation) -- C:\Users\drew\Desktop\Norton_Removal_Tool.exe
[2010/10/08 09:07:09 | 000,576,512 | ---- | C] (OldTimer Tools) -- C:\Users\drew\Desktop\OTL.exe
[2010/10/08 08:27:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2010/10/08 08:27:28 | 000,848,856 | ---- | C] (Panda Security ) -- C:\Users\drew\Desktop\USBVaccineSetup.exe
[2010/10/08 08:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\Panda USB Vaccine
[2010/10/07 09:53:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2010/10/07 06:42:11 | 000,000,000 | ---D | C] -- C:\Users\drew\AppData\Local\temp
[2010/10/07 06:38:18 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2010/10/07 06:22:59 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/10/07 06:14:07 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/10/07 06:13:39 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/10/06 08:46:59 | 000,000,000 | ---D | C] -- C:\Users\drew\AppData\Roaming\Malwarebytes
[2010/10/06 08:46:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/10/06 08:46:47 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/10/06 08:46:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/10/06 08:46:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/10/05 14:25:17 | 000,000,000 | ---D | C] -- C:\Users\drew\Desktop\New Folder
[2010/10/04 07:45:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
[2010/10/04 07:21:01 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2010/10/01 17:07:06 | 000,000,000 | ---D | C] -- C:\DVDVolume
[2010/10/01 06:52:54 | 000,000,000 | ---D | C] -- C:\Rbackup
[2010/09/22 14:37:28 | 000,000,000 | ---D | C] -- C:\Program Files\Feedback Tool
[2010/09/22 09:04:20 | 000,000,000 | ---D | C] -- C:\$AVG
[2010/09/22 08:01:11 | 000,000,000 | ---D | C] -- C:\Users\drew\AppData\Local\Microsoft Corporation
[2010/09/10 06:23:14 | 000,000,000 | ---D | C] -- C:\Windows\System32\Lang
[2010/09/10 05:58:19 | 000,000,000 | ---D | C] -- C:\Program Files\MSN Toolbar
[2010/09/10 05:56:36 | 000,100,896 | ---- | C] (Realtek Semiconductor Corporation) -- C:\Windows\System32\RTNUninst32.dll
[2010/09/10 05:56:20 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2010/09/10 05:54:12 | 000,000,000 | ---D | C] -- C:\Program Files\MSN Toolbar Installer
[2010/09/10 04:40:32 | 000,081,408 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\System32\devcon_x64.exe
[2010/09/10 04:40:31 | 000,000,000 | ---D | C] -- C:\Program Files\Driver Checker
[2010/09/10 04:16:35 | 000,000,000 | ---D | C] -- C:\Program Files\AdvancedDefrag
[2010/09/10 03:56:59 | 000,000,000 | ---D | C] -- C:\Program Files\Perfect Uninstaller
[2010/09/03 18:31:24 | 000,086,016 | ---- | C] (MindVision) -- C:\Windows\unvise32qt.exe
[2010/09/03 18:28:24 | 000,000,000 | ---D | C] -- C:\Windows\System32\QuickTime
[2010/09/03 18:25:54 | 000,000,000 | ---D | C] -- C:\ProgramData\QuickTime
[2010/09/03 18:25:28 | 000,000,000 | ---D | C] -- C:\~QTWTMP.TMP
[2010/09/03 18:13:06 | 000,000,000 | ---D | C] -- C:\Program Files\GSP
[2010/09/03 18:10:04 | 000,000,000 | ---D | C] -- C:\Program Files\DKXP
[2010/09/03 18:10:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\backup
[2010/09/03 17:25:49 | 000,000,000 | ---D | C] -- C:\Program Files\DK Interactive Learning

chiefmissile · 2010/10/15

[2010/09/03 17:22:49 | 000,299,520 | ---- | C] (InstallShield Corporation, Inc.) -- C:\Windows\uninst.exe
[2010/09/03 10:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\NOS(52)
[2010/08/24 11:51:57 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
[2010/08/12 21:12:40 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/08/12 17:22:29 | 000,000,000 | ---D | C] -- C:\Users\drew\AppData\Roaming\EasyMP3Downloader
[2010/08/12 17:22:29 | 000,000,000 | ---D | C] -- C:\ProgramData\EasyMP3Downloader
[2010/08/12 11:37:41 | 000,000,000 | ---D | C] -- C:\ss43_dll
[2010/08/12 10:16:03 | 000,000,000 | ---D | C] -- C:\Users\drew\Desktop\LocalCDInfo
[2010/08/02 09:13:51 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/05/05 06:57:13 | 012,378,640 | ---- | C] (JonDos GmbH) -- C:\ProgramData\JonDoFox.paf.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/10/15 06:25:38 | 004,456,448 | ---- | M] () -- C:\Users\drew\ntuser.dat
[2010/10/15 06:24:00 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{71ED678C-C26F-4ABD-964A-D9AD68E5DB89}.job
[2010/10/15 05:41:28 | 009,647,288 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/10/15 05:41:28 | 004,784,606 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/10/15 05:41:28 | 000,005,954 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/10/15 05:40:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/15 05:36:06 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/15 05:35:02 | 000,003,168 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/15 05:35:01 | 000,003,168 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/15 05:34:59 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/10/15 05:34:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/10/15 05:33:06 | 000,524,288 | -HS- | M] () -- C:\Users\drew\ntuser.dat{b9f65e64-b297-11df-b58d-e53be88d7964}.TMContainer00000000000000000001.regtrans-ms
[2010/10/15 05:33:06 | 000,065,536 | -HS- | M] () -- C:\Users\drew\ntuser.dat{b9f65e64-b297-11df-b58d-e53be88d7964}.TM.blf
[2010/10/15 05:33:05 | 002,468,325 | -H-- | M] () -- C:\Users\drew\AppData\Local\IconCache.db
[2010/10/15 05:29:58 | 000,921,512 | ---- | M] (Symantec Corporation) -- C:\Users\drew\Desktop\Norton_Removal_Tool.exe
[2010/10/15 03:18:08 | 000,440,888 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/10/14 21:21:23 | 000,000,948 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk
[2010/10/14 21:14:29 | 000,000,240 | ---- | M] () -- C:\Windows\win.ini
[2010/10/13 19:40:30 | 000,000,600 | ---- | M] () -- C:\Users\drew\PUTTY.RND
[2010/10/12 18:00:00 | 000,000,440 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2010/10/10 03:44:01 | 000,000,414 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2010/10/08 09:33:03 | 000,576,512 | ---- | M] (OldTimer Tools) -- C:\Users\drew\Desktop\OTL.exe
[2010/10/08 06:31:51 | 000,024,064 | ---- | M] () -- C:\Users\drew\Documents\What.doc
[2010/10/08 06:27:36 | 000,024,064 | ---- | M] () -- C:\Users\drew\Documents\I want to eat you.doc
[2010/10/07 09:54:09 | 000,001,893 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/10/07 06:38:24 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/10/07 06:38:14 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/10/07 03:57:20 | 003,874,403 | R--- | M] () -- C:\Users\drew\Desktop\ComboFix.exe
[2010/10/06 08:46:51 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/03 13:18:44 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2010/10/02 17:44:52 | 328,593,747 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/10/02 08:02:04 | 000,000,376 | ---- | M] () -- C:\Windows\ODBC.INI
[2010/10/01 07:37:24 | 000,000,949 | ---- | M] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/09/29 12:59:35 | 000,002,079 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010/09/24 16:20:41 | 000,024,576 | ---- | M] () -- C:\Users\drew\Documents\A great big thank you for my wonderful birthday present.doc
[2010/09/24 04:40:41 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010/09/22 14:42:41 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2010/09/22 14:42:41 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2010/09/22 08:04:10 | 000,000,760 | ---- | M] () -- C:\Users\drew\AppData\Roaming\setup_ldm.iss
[2010/09/16 18:17:56 | 000,024,064 | ---- | M] () -- C:\Users\drew\Documents\17th September 2010.doc
[2010/09/12 06:50:15 | 000,105,984 | ---- | M] () -- C:\Users\drew\Desktop\2011-year-planner.doc
[2010/09/10 06:22:17 | 000,001,356 | ---- | M] () -- C:\Users\drew\AppData\Local\d3d9caps.dat
[2010/09/10 06:11:55 | 000,000,116 | ---- | M] () -- C:\Windows\System32\SpywareCease.lie
[2010/09/10 05:43:14 | 000,039,872 | ---- | M] () -- C:\Windows\System32\iglhxs32.vp
[2010/09/10 05:43:14 | 000,002,096 | ---- | M] () -- C:\Windows\System32\iglhxo32.vp
[2010/09/10 05:43:14 | 000,002,096 | ---- | M] () -- C:\Windows\System32\iglhxc32.vp
[2010/09/10 05:43:13 | 001,498,564 | ---- | M] () -- C:\Windows\System32\igkrng400.bin
[2010/09/10 05:29:29 | 000,100,896 | ---- | M] (Realtek Semiconductor Corporation) -- C:\Windows\System32\RTNUninst32.dll
[2010/09/10 05:29:29 | 000,080,416 | ---- | M] () -- C:\Windows\System32\RtNicProp32.dll
[2010/09/10 05:21:29 | 000,053,248 | ---- | M] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll
[2010/09/10 04:55:08 | 000,000,749 | RH-- | M] () -- C:\Windows\WindowsShell.Manifest
[2010/09/10 04:40:36 | 000,000,837 | ---- | M] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\Driver Checker.lnk
[2010/09/10 04:40:36 | 000,000,813 | ---- | M] () -- C:\Users\drew\Desktop\Driver Checker.lnk
[2010/09/10 04:16:37 | 000,000,842 | ---- | M] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\AdvancedDefrag.lnk
[2010/09/10 04:16:37 | 000,000,595 | ---- | M] () -- C:\Users\Public\Desktop\AdvancedDefrag.lnk
[2010/09/10 04:08:02 | 000,000,042 | ---- | M] () -- C:\Windows\System32\scud.udf
[2010/09/10 03:57:08 | 000,000,042 | ---- | M] () -- C:\Windows\System32\AK083E209605E394C.lie
[2010/09/10 03:57:02 | 000,000,801 | ---- | M] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\Perfect Uninstaller.lnk
[2010/09/10 03:57:02 | 000,000,777 | ---- | M] () -- C:\Users\drew\Desktop\Perfect Uninstaller.lnk
[2010/09/10 03:48:09 | 000,000,042 | ---- | M] () -- C:\Windows\System32\RegistryEasy.lie
[2010/09/09 09:37:17 | 000,473,735 | ---- | M] () -- C:\Users\drew\jap.conf
[2010/09/05 16:30:45 | 000,182,531 | ---- | M] () -- C:\Users\drew\Desktop\newsletter.pdf
[2010/09/05 16:29:44 | 000,031,149 | ---- | M] () -- C:\Users\drew\Desktop\Topics List.pdf
[2010/09/03 18:28:48 | 000,000,876 | ---- | M] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2010/09/03 18:28:26 | 000,000,852 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/09/03 18:25:47 | 000,000,812 | ---- | M] () -- C:\Windows\QT$INST$.~PC
[2010/09/03 18:25:24 | 000,000,030 | ---- | M] () -- C:\Windows\RESULT.QTW
[2010/09/03 18:10:22 | 000,524,288 | -HS- | M] () -- C:\Users\drew\ntuser.dat{b9f65e64-b297-11df-b58d-e53be88d7964}.TMContainer00000000000000000002.regtrans-ms
[2010/09/03 18:10:07 | 000,000,016 | ---- | M] () -- C:\Windows\WinInit.Ini
[2010/09/03 17:27:38 | 000,000,510 | ---- | M] () -- C:\Windows\wordpad.INI
[2010/09/03 14:35:39 | 000,501,760 | ---- | M] () -- C:\Users\drew\Desktop\U998.exe
[2010/09/03 10:59:35 | 000,524,288 | -HS- | M] () -- C:\Users\drew\ntuser.dat{331ad534-aa86-11df-a15a-e7ff79d35157}.TMContainer00000000000000000001.regtrans-ms
[2010/09/03 10:59:35 | 000,065,536 | -HS- | M] () -- C:\Users\drew\ntuser.dat{331ad534-aa86-11df-a15a-e7ff79d35157}.TM.blf
[2010/09/01 00:36:52 | 000,072,533 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2010/08/28 11:31:41 | 000,029,696 | ---- | M] () -- C:\Users\drew\Desktop\APPLICIATION TO VIEWING ACCESS TO BFBS 1 DAY LATER AND BFBS TV CHANNEL 2.doc
[2010/08/18 07:59:47 | 000,524,288 | -HS- | M] () -- C:\Users\drew\ntuser.dat{331ad534-aa86-11df-a15a-e7ff79d35157}.TMContainer00000000000000000002.regtrans-ms
[2010/08/18 05:33:44 | 000,524,288 | -HS- | M] () -- C:\Users\drew\ntuser.dat{ad28554f-a5f5-11df-884a-cbdb6d024916}.TMContainer00000000000000000001.regtrans-ms
[2010/08/18 05:33:44 | 000,065,536 | -HS- | M] () -- C:\Users\drew\ntuser.dat{ad28554f-a5f5-11df-884a-cbdb6d024916}.TM.blf
[2010/08/15 12:55:04 | 000,021,504 | ---- | M] () -- C:\Users\drew\Documents\Compound Cocktails.doc
[2010/08/12 11:02:28 | 000,524,288 | -HS- | M] () -- C:\Users\drew\ntuser.dat{ad28554f-a5f5-11df-884a-cbdb6d024916}.TMContainer00000000000000000002.regtrans-ms
[2010/08/12 10:55:13 | 000,524,288 | -HS- | M] () -- C:\Users\drew\ntuser.dat{0cc788b7-1f17-11df-a7f6-a8e06d20943a}.TMContainer00000000000000000001.regtrans-ms
[2010/08/12 10:55:13 | 000,065,536 | -HS- | M] () -- C:\Users\drew\ntuser.dat{0cc788b7-1f17-11df-a7f6-a8e06d20943a}.TM.blf
[2010/08/10 06:57:35 | 000,019,968 | ---- | M] () -- C:\Users\drew\Documents\Reception Topics 2010.doc
[2010/08/02 05:46:56 | 000,001,961 | ---- | M] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/08/01 15:04:14 | 000,002,560 | ---- | M] () -- C:\Windows\_MSRSTRT.EXE
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/08 10:25:53 | 000,053,760 | ---- | C] () -- C:\Users\drew\Desktop\CHAPTER EIGHT Annex A.doc
[2010/10/08 06:31:51 | 000,024,064 | ---- | C] () -- C:\Users\drew\Documents\What.doc
[2010/10/08 06:27:35 | 000,024,064 | ---- | C] () -- C:\Users\drew\Documents\I want to eat you.doc
[2010/10/07 09:54:09 | 000,001,893 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/10/07 04:12:36 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/10/07 04:12:36 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/10/07 03:56:50 | 003,874,403 | R--- | C] () -- C:\Users\drew\Desktop\ComboFix.exe
[2010/10/06 08:46:51 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/04 07:45:45 | 000,000,948 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk
[2010/10/02 17:44:52 | 328,593,747 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/10/01 07:09:18 | 000,000,949 | ---- | C] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/09/29 12:59:35 | 000,002,079 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010/09/24 16:20:41 | 000,024,576 | ---- | C] () -- C:\Users\drew\Documents\A great big thank you for my wonderful birthday present.doc
[2010/09/22 14:40:24 | 000,072,533 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2010/09/22 08:04:10 | 000,000,760 | ---- | C] () -- C:\Users\drew\AppData\Roaming\setup_ldm.iss
[2010/09/16 18:17:56 | 000,024,064 | ---- | C] () -- C:\Users\drew\Documents\17th September 2010.doc
[2010/09/10 06:53:32 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2010/09/10 06:53:32 | 000,121,232 | ---- | C] () -- C:\Windows\System32\IScrNB.bmp
[2010/09/10 06:11:55 | 000,000,116 | ---- | C] () -- C:\Windows\System32\SpywareCease.lie
[2010/09/10 05:56:36 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2010/09/10 05:43:14 | 000,039,872 | ---- | C] () -- C:\Windows\System32\iglhxs32.vp
[2010/09/10 05:43:14 | 000,002,096 | ---- | C] () -- C:\Windows\System32\iglhxo32.vp
[2010/09/10 05:43:14 | 000,002,096 | ---- | C] () -- C:\Windows\System32\iglhxc32.vp
[2010/09/10 05:43:13 | 001,498,564 | ---- | C] () -- C:\Windows\System32\igkrng400.bin
[2010/09/10 04:40:36 | 000,000,837 | ---- | C] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\Driver Checker.lnk
[2010/09/10 04:40:36 | 000,000,813 | ---- | C] () -- C:\Users\drew\Desktop\Driver Checker.lnk
[2010/09/10 04:16:37 | 000,000,842 | ---- | C] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\AdvancedDefrag.lnk
[2010/09/10 04:16:37 | 000,000,595 | ---- | C] () -- C:\Users\Public\Desktop\AdvancedDefrag.lnk
[2010/09/10 04:08:02 | 000,000,042 | ---- | C] () -- C:\Windows\System32\scud.udf
[2010/09/10 03:57:08 | 000,000,042 | ---- | C] () -- C:\Windows\System32\AK083E209605E394C.lie
[2010/09/10 03:57:02 | 000,000,801 | ---- | C] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\Perfect Uninstaller.lnk
[2010/09/10 03:57:02 | 000,000,777 | ---- | C] () -- C:\Users\drew\Desktop\Perfect Uninstaller.lnk
[2010/09/10 03:48:09 | 000,000,042 | ---- | C] () -- C:\Windows\System32\RegistryEasy.lie
[2010/09/09 11:38:30 | 000,105,984 | ---- | C] () -- C:\Users\drew\Desktop\2011-year-planner.doc
[2010/09/05 16:30:45 | 000,182,531 | ---- | C] () -- C:\Users\drew\Desktop\newsletter.pdf
[2010/09/05 16:29:37 | 000,031,149 | ---- | C] () -- C:\Users\drew\Desktop\Topics List.pdf
[2010/09/03 18:28:48 | 000,000,876 | ---- | C] () -- C:\Users\drew\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2010/09/03 18:28:26 | 000,000,852 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/09/03 18:24:33 | 000,000,812 | ---- | C] () -- C:\Windows\QT$INST$.~PC
[2010/09/03 18:24:32 | 000,000,030 | ---- | C] () -- C:\Windows\RESULT.QTW
[2010/09/03 18:13:34 | 000,000,000 | ---- | C] () -- C:\Windows\undergroundernie.ini
[2010/09/03 18:10:07 | 000,000,016 | ---- | C] () -- C:\Windows\WinInit.Ini
[2010/09/03 18:09:51 | 000,168,207 | ---- | C] () -- C:\Windows\System32\Unstall.exe
[2010/09/03 17:27:38 | 000,000,510 | ---- | C] () -- C:\Windows\wordpad.INI
[2010/09/03 14:35:39 | 000,501,760 | ---- | C] () -- C:\Users\drew\Desktop\U998.exe
[2010/09/03 11:13:59 | 000,524,288 | -HS- | C] () -- C:\Users\drew\ntuser.dat{b9f65e64-b297-11df-b58d-e53be88d7964}.TMContainer00000000000000000002.regtrans-ms
[2010/09/03 11:13:59 | 000,524,288 | -HS- | C] () -- C:\Users\drew\ntuser.dat{b9f65e64-b297-11df-b58d-e53be88d7964}.TMContainer00000000000000000001.regtrans-ms
[2010/09/03 11:13:58 | 000,065,536 | -HS- | C] () -- C:\Users\drew\ntuser.dat{b9f65e64-b297-11df-b58d-e53be88d7964}.TM.blf
[2010/08/28 06:12:25 | 000,029,696 | ---- | C] () -- C:\Users\drew\Desktop\APPLICIATION TO VIEWING ACCESS TO BFBS 1 DAY LATER AND BFBS TV CHANNEL 2.doc
[2010/08/18 06:07:23 | 000,524,288 | -HS- | C] () -- C:\Users\drew\ntuser.dat{331ad534-aa86-11df-a15a-e7ff79d35157}.TMContainer00000000000000000002.regtrans-ms
[2010/08/18 06:07:23 | 000,524,288 | -HS- | C] () -- C:\Users\drew\ntuser.dat{331ad534-aa86-11df-a15a-e7ff79d35157}.TMContainer00000000000000000001.regtrans-ms
[2010/08/18 06:07:23 | 000,065,536 | -HS- | C] () -- C:\Users\drew\ntuser.dat{331ad534-aa86-11df-a15a-e7ff79d35157}.TM.blf
[2010/08/15 12:43:03 | 000,021,504 | ---- | C] () -- C:\Users\drew\Documents\Compound Cocktails.doc
[2010/08/12 11:02:28 | 000,524,288 | -HS- | C] () -- C:\Users\drew\ntuser.dat{ad28554f-a5f5-11df-884a-cbdb6d024916}.TMContainer00000000000000000002.regtrans-ms
[2010/08/12 11:02:28 | 000,524,288 | -HS- | C] () -- C:\Users\drew\ntuser.dat{ad28554f-a5f5-11df-884a-cbdb6d024916}.TMContainer00000000000000000001.regtrans-ms
[2010/08/12 11:02:28 | 000,065,536 | -HS- | C] () -- C:\Users\drew\ntuser.dat{ad28554f-a5f5-11df-884a-cbdb6d024916}.TM.blf
[2010/08/10 06:46:41 | 000,019,968 | ---- | C] () -- C:\Users\drew\Documents\Reception Topics 2010.doc
[2010/06/15 08:30:23 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/06/08 12:33:30 | 000,000,000 | ---- | C] () -- C:\Windows\ka.ini
[2010/05/09 08:48:39 | 000,000,180 | ---- | C] () -- C:\Users\drew\AppData\Roaming\setup.log
[2010/01/23 18:54:45 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009/12/11 13:22:23 | 000,532,480 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Sony.dll
[2009/09/17 09:05:02 | 000,004,981 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2009/08/09 05:35:45 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/06/16 13:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2009/04/08 10:13:35 | 000,066,482 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2009/04/01 13:59:16 | 000,008,064 | ---- | C] () -- C:\Windows\System32\drivers\flash.sys
[2009/04/01 13:59:16 | 000,008,064 | ---- | C] () -- C:\Windows\flash.sys
[2009/03/16 14:49:15 | 000,000,024 | ---- | C] () -- C:\Users\drew\AppData\Local\SkyNewsGadget.log
[2009/02/02 18:36:00 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmsbfn32.dll
[2009/02/02 18:33:43 | 000,000,412 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2009/02/02 17:50:39 | 000,003,584 | ---- | C] () -- C:\Windows\System32\CNCFLfNL.DLL
[2008/12/23 10:51:20 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1624.dll
[2008/11/21 15:08:59 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/11/12 09:02:15 | 000,001,356 | ---- | C] () -- C:\Users\drew\AppData\Local\d3d9caps.dat
[2008/10/22 20:31:08 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/10/18 17:11:34 | 000,008,704 | ---- | C] () -- C:\Users\drew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/10 23:59:06 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys
[2008/07/26 08:25:02 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2008/02/11 20:55:18 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll
[2008/01/29 11:47:39 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008/01/29 11:47:28 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2008/01/29 11:47:28 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll
[2007/11/20 18:48:25 | 000,040,448 | ---- | C] () -- C:\Windows\REGOBJ.DLL
[2006/11/02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2009/04/24 09:36:45 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\aAvgApi
[2010/06/25 23:19:18 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Bytemobile
[2010/05/04 16:51:51 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Canon
[2008/10/10 17:01:03 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/01/26 12:58:24 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\DriverCure
[2010/08/12 17:22:29 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\EasyMP3Downloader
[2009/01/07 19:28:43 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Gizmo5
[2009/12/04 07:22:38 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\gtk-2.0
[2010/09/01 09:19:17 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\JonDo
[2009/04/08 10:14:01 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Leadertech
[2009/11/02 12:17:54 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\LimeWire
[2009/02/02 18:45:16 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\NewSoft
[2010/04/14 04:22:54 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\NVD
[2010/03/29 07:27:16 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\ooVoo Details
[2009/08/09 08:27:34 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\ParetoLogic
[2009/02/02 18:33:21 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\ScanSoft
[2009/03/31 12:51:31 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Serif
[2010/04/16 15:37:26 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\SoftGrid Client
[2009/10/10 09:16:44 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\System Tweaker
[2010/06/25 15:56:22 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\TelefÃ³nica MÃ³viles
[2008/10/25 19:19:56 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\TomTom
[2010/04/14 04:21:09 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\TP
[2010/03/02 06:42:53 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Trusteer
[2009/08/30 05:51:05 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\uniblue
[2010/06/25 23:20:05 | 000,000,000 | ---D | M] -- C:\Users\drew\AppData\Roaming\Vodafone
[2010/10/12 18:00:00 | 000,000,440 | ---- | M] () -- C:\Windows\Tasks\ParetoLogic Registration.job
[2010/10/10 03:44:01 | 000,000,414 | ---- | M] () -- C:\Windows\Tasks\ParetoLogic Update Version2.job
[2010/10/15 05:33:08 | 000,032,604 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/10/15 06:24:00 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{71ED678C-C26F-4ABD-964A-D9AD68E5DB89}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2010/10/07 06:42:09 | 000,023,439 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010/05/05 06:00:56 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/05/05 06:00:56 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/10/15 05:34:07 | 3524,788,224 | -HS- | M] () -- C:\pagefile.sys
[2010/06/26 11:23:44 | 011,636,572 | ---- | M] () -- C:\Vodafone Mobile Connect.msi
[1 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/08/09 05:51:14 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/10/28 21:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNMPD98.DLL
[2007/10/28 21:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNMPP98.DLL
[2006/11/02 13:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007/04/09 14:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 00:04:40 | 000,306,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2010/09/10 04:55:08 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/10/01 07:37:24 | 000,000,286 | -HS- | M] () -- C:\Users\drew\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/10/07 03:57:20 | 003,874,403 | R--- | M] () -- C:\Users\drew\Desktop\ComboFix.exe
[2010/10/15 05:29:58 | 000,921,512 | ---- | M] (Symantec Corporation) -- C:\Users\drew\Desktop\Norton_Removal_Tool.exe
[2010/10/08 09:33:03 | 000,576,512 | ---- | M] (OldTimer Tools) -- C:\Users\drew\Desktop\OTL.exe
[2010/09/03 14:35:39 | 000,501,760 | ---- | M] () -- C:\Users\drew\Desktop\U998.exe
[2009/10/23 13:02:34 | 000,848,856 | ---- | M] (Panda Security ) -- C:\Users\drew\Desktop\USBVaccineSetup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2004/09/16 17:05:50 | 000,001,714 | R--- | M] () -- C:\Windows\AppPatch\Custom\{69f9566d-f2e9-4956-b9ca-3e96e6baa769}.sdb
[2002/08/06 09:57:32 | 000,018,506 | ---- | M] () -- C:\Windows\AppPatch\Custom\{abe7844e-4d49-4c7e-9d03-7329a6b9feac}.sdb

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/10/01 07:37:22 | 000,000,402 | -HS- | M] () -- C:\Users\drew\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/02/11 07:52:05 | 000,000,040 | -HS- | M] () -- C:\ProgramData\.zreglib
[2009/06/16 13:25:02 | 000,121,512 | R--- | M] () -- C:\ProgramData\DeviceManager.xml.rc4
[2010/05/05 07:04:26 | 012,378,640 | ---- | M] (JonDos GmbH) -- C:\ProgramData\JonDoFox.paf.exe
[2009/09/17 09:05:02 | 000,004,981 | ---- | M] () -- C:\ProgramData\mtbjfghn.xbe
[2010/06/15 08:30:23 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:89E253FE
< End of report >

broni · 2010/10/15

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

===============================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O16 - DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/tech...bs/tgctlcm.cab (Reg Error: Key error.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[2010/09/22 09:04:20 | 000,000,000 | ---D | C] -- C:\$AVG
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
[2010/09/10 03:48:09 | 000,000,042 | ---- | M] () -- C:\Windows\System32\RegistryEasy.lie
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:89E253FE

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
===============================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

chiefmissile · 2010/10/15

Files\Folders moved on Reboot...
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCA8HOYG\blank[1].htm moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCA8HOYG\fc[6].htm moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\J4MZU0I3\blank[1].htm moved successfully.

Registry entries deleted on Reboot...

chiefmissile · 2010/10/15

Results of screen317's Security Check version 0.99.5
Windows Vista Service Pack 2 (UAC is enabled)
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 22
Out of date Java installed!
Adobe Flash Player 10.0.45.2
Adobe Reader 9.4.0
Mozilla Firefox (3.6.3) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
````````````````````````````````
DNS Vulnerability Check:
Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?)

``````````End of Log````````````

broni · 2010/10/15

Please, update Firefox.

chiefmissile · 2010/10/15

Firefox updated

broni · 2010/10/15

Eset

chiefmissile · 2010/10/16

Many thanks for all your help, it was much appreciated, a great service thanks.

Andrew

broni · 2010/10/16

You're very welcome, but we're not totally done yet.

What happened with Eset scan?

chiefmissile · 2010/10/17

Thanks for the reminder, all done no report, seems to be all clear? Is that it?

broni · 2010/10/17

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how is your computer doing.

chiefmissile · 2010/10/17

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: drew
->Temp folder emptied: 22056237 bytes
->Temporary Internet Files folder emptied: 40284396 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 22048652 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1595 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 690225 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 81.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: drew
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 10172010_082751

Files\Folders moved on Reboot...
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XJGVPEAM\fc[2].htm moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XJGVPEAM\st[2] moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T7MV9JTZ\blank[2].htm moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T7MV9JTZ\blank[3].htm moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T7MV9JTZ\openmail.app[1].htm moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CX47IGX0\openmail.app[1].htm moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\C9320E64-EE0F-4422-B6DA-C0F3768C080E.dat moved successfully.
C:\Users\drew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

broni · 2010/10/17

12. Please, let me know, how is your computer doing.
Click to expand...

.....

chiefmissile · 2010/10/17

Hi,

All seems ok, having a problem getting windows defender to work, when i try to turn it on it just comes up with an error code? Also my wifes sony sonicstage becomes un responsive after a while, and freezes up the system? I tried to download and install WOT but it asked to search the net for a program to open it, when i did this the page went blank, tried several times. Apart from these gremlins everything is fine and working normally thanks to you.

Regards

Andrew

broni · 2010/10/17

when i try to turn it on it just comes up with an error code
Click to expand...

Please, post full error message.

Try to reinstall SonicStage.

I tried to download and install WOT but it asked to search the net for a program to open it
Click to expand...

For which browser?

Log in or Sign up

Solved patah Hati.doc.exe worm cant remove.

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

chiefmissile Well-Known Member Thread Starter

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved patah Hati.doc.exe worm cant remove.

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

chiefmissile Well-Known Member Thread Starter

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

chiefmissile Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches