Solved Unable to complete Virus scans etc...

Just tried again innormal mode and i get the warnings about Comodo AV is still on? I dident go any further until i checked with you and if its ok, do i still use the Combofix that i dragged and dropped that codebox? dont mean to be a pain but i guess its better to ask.

Thanks,

Sean.

 

I ran Combofix in safe mode with networking it updated to a new version, made a restore point, started to install the recovery console and then an error box popped up saying "Boot pertition cannot be enumerated correctly" i clicked yes to continue scanning foe malware, it completed the scan and below are the results.

MANY THANKS to you.

ComboFix 10-12-20.01 - shaun wade 21/12/2010 6:13.4.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1022.758 [GMT 0:00]
Running from: c:\documents and settings\shaun wade\Desktop\ComboFix.exe
AV: COMODO Antivirus *Enabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: Outpost Firewall *Disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\shaun wade\.exe
c:\windows\system32\Oeminfo.ini

.
((((((((((((((((((((((((( Files Created from 2010-11-21 to 2010-12-21 )))))))))))))))))))))))))))))))
.

2010-12-19 19:58 . 2010-12-19 19:58 -------- d-----w- C:\VritualRoot
2010-12-19 07:37 . 2010-12-19 07:37 -------- d-----w- c:\windows\system32\wbem\Repository
2010-12-12 14:28 . 2010-12-21 06:04 91533 ----a-w- c:\windows\cscmondump.bin
2010-12-12 06:17 . 2010-12-12 06:17 2204 -c--a-w- c:\windows\crpf.bin
2010-12-12 06:17 . 2010-12-12 06:17 1552 -c--a-w- c:\windows\crpf_sdum.bin
2010-12-10 07:34 . 2010-12-10 16:03 -------- d-----w- c:\documents and settings\shaun wade\Application Data\Skype
2010-12-09 12:15 . 2010-12-09 12:15 33232 ----a-w- c:\windows\system32\drivers\CFRPD.sys
2010-12-09 12:14 . 2010-12-09 12:14 66584 ----a-w- c:\windows\system32\drivers\CFRMD.sys
2010-12-08 07:42 . 2010-12-08 08:34 -------- d-----w- c:\program files\Codemasters
2010-12-07 23:45 . 2010-12-07 23:45 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2010-12-07 23:45 . 2010-12-07 23:45 -------- d-----w- c:\program files\AIM
2010-12-07 23:45 . 2010-12-07 23:45 -------- d-----w- c:\program files\Common Files\Software Update Utility
2010-12-05 01:58 . 2010-12-11 23:02 -------- d-----r- c:\program files\Skype
2010-12-05 01:58 . 2010-12-05 01:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-11-30 23:55 . 2008-04-15 15:17 295424 -c----w- c:\windows\system32\dllcache\termsrv.dll
2010-11-29 06:20 . 2010-11-29 06:20 -------- d-----w- c:\program files\Common Files\Java
2010-11-29 06:19 . 2010-11-29 06:19 73728 -c--a-w- c:\windows\system32\javacpl.cpl
2010-11-29 06:19 . 2010-11-29 06:19 -------- d-----w- c:\program files\Java
2010-11-22 17:34 . 2009-09-04 17:44 515416 -c--a-w- c:\windows\system32\XAudio2_5.dll
2010-11-22 17:34 . 2009-09-04 17:44 238936 -c--a-w- c:\windows\system32\xactengine3_5.dll
2010-11-22 17:34 . 2009-09-04 17:29 1974616 -c--a-w- c:\windows\system32\D3DCompiler_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 5501792 -c--a-w- c:\windows\system32\d3dcsx_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 453456 -c--a-w- c:\windows\system32\d3dx10_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 235344 -c--a-w- c:\windows\system32\d3dx11_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 22:21 . 2010-03-23 12:37 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-12-20 22:21 . 2010-03-23 12:37 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-11-29 17:42 . 2008-07-19 13:27 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-29 17:42 . 2008-05-08 02:33 20952 -c--a-w- c:\windows\system32\drivers\mbam.sys
2010-11-29 06:19 . 2010-07-17 06:32 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-02 00:20 . 2009-08-15 00:54 235248 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2010-09-24 21:05 . 2010-09-24 21:05 86528 -c--a-w- c:\windows\bnetunin.exe
2010-09-24 21:05 . 2010-09-24 21:05 61440 -c--a-w- c:\windows\diabunin.exe
2010-04-17 16:58 . 2010-04-17 16:58 444 -c--a-w- c:\program files\04201017583831.bat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OutpostMonitor "= "c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"COMODO Internet Security "= "c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-09-10 2500552]

c:\documents and settings\shaun wade\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer "=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"ctfmon.exe "=c:\windows\system32\ctfmon.exe
"WMPNSCFG "=c:\program files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" -atboottime
"PDVD8LanguageShortcut "= "c:\program files\CyberLink\PowerDVD8\Language\Language.exe "
"RemoteControl8 "= "c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001
"FirewallOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\DNA\\btdna.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\AIM\\aim.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56490:TCP "= 56490:TCPando Media Booster
"56490:UDP "= 56490:UDPando Media Booster
"1434:TCP "= 1434:TCP:Akamai NetSession Interface
"5000:UDP "= 5000:UDP:Akamai NetSession Interface
"3776:UDP "= 3776:UDP:Media Center Extender Service
"3390:TCP "= 3390:TCP:Remote Media Center Experience

R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [10/09/2010 23:40 15592]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [30/11/2009 19:30 31128]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [22/01/2008 22:04 33792]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13/07/2008 00:38 717296]
S1 CFRMD;CFRMD;c:\windows\system32\drivers\CFRMD.sys [09/12/2010 12:14 66584]
S1 CFRPD;CFRPD;c:\windows\system32\drivers\CFRPD.sys [09/12/2010 12:15 33232]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [10/09/2010 23:40 239240]
S1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [30/11/2009 19:32 704384]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [30/11/2009 19:30 1195008]
S2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [17/06/2009 21:51 941784]
S2 Cleaner_Validator;COMODO System - Cleaner Service;c:\program files\Comodo\COMODO System-Cleaner\Cleaner_Validator.exe [09/12/2010 12:08 305600]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16/05/2010 03:55 136176]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
S3 aaudstum;aaudstum;\??\c:\docume~1\SHAUNW~1\LOCALS~1\Temp\aaudstum.sys --> c:\docume~1\SHAUNW~1\LOCALS~1\Temp\aaudstum.sys [?]
S3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [30/11/2009 19:31 257432]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\6.tmp --> c:\windows\system32\6.tmp [?]
S3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;c:\windows\system32\drivers\qscnusb.sys [09/04/2010 17:57 103552]
S3 PsSdk30;PsSdk30;\??\c:\windows\system32\Drivers\PsSdk30.drv --> c:\windows\system32\Drivers\PsSdk30.drv [?]
S3 scrcap;scrcap;c:\windows\system32\DRIVERS\scrcap.sys --> c:\windows\system32\DRIVERS\scrcap.sys [?]
S3 V0090VID;Creative WebCam Vista Plus;c:\windows\system32\drivers\V0090Vid.sys [28/01/2007 04:29 138112]
S3 XDva226;XDva226;\??\c:\windows\system32\XDva226.sys --> c:\windows\system32\XDva226.sys [?]
S4 BGEEJA;BGEEJA;c:\docume~1\SHAUNW~1\LOCALS~1\Temp\BGEEJA.exe --> c:\docume~1\SHAUNW~1\LOCALS~1\Temp\BGEEJA.exe [?]
S4 SC;SC;c:\docume~1\SHAUNW~1\LOCALS~1\Temp\SC.exe --> c:\docume~1\SHAUNW~1\LOCALS~1\Temp\SC.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
QWAVE REG_MULTI_SZ QWAVE
.
Contents of the 'Scheduled Tasks' folder

2010-12-20 c:\windows\Tasks\COMODO Updater.job
- c:\program files\COMODO\COMODO System-Cleaner\Updater.exe [2010-12-09 12:08]

2010-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 03:55]

2010-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 03:55]

2010-12-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987269382-2677141407-1074731499-1007Core.job
- c:\documents and settings\kieran wade\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-30 08:17]

2010-12-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987269382-2677141407-1074731499-1007UA.job
- c:\documents and settings\kieran wade\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-30 08:17]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\documents and settings\shaun wade\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm
FF - ProfilePath - c:\documents and settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GBfficial
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Ghostery: firefox@ghostery.com - %profile%\extensions\firefox@ghostery.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath "= "\??\c:\windows\system32\6.tmp "

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]
"ImagePath "= "\??\c:\windows\system32\Drivers\PsSdk30.drv "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1987269382-2677141407-1074731499-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1987269382-2677141407-1074731499-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?? "=hex:c5,fa,ca,e0,40,6f,f7,3d,98,65,63,73,7d,3d,59,da,c0,5a,c4,46,e7,bd,36,
7d,96,91,04,e7,9d,b5,c7,e6,8e,ee,ea,f3,75,03,8b,bc,00,92,54,e4,ae,8f,17,f0,\
"?? "=hex:77,41,a4,25,d7,8e,b1,5d,4e,11,b4,f7,db,9b,c4,f9

[HKEY_USERS\S-1-5-21-1987269382-2677141407-1074731499-1006\Software\SecuROM\License information*]
"datasecu "=hex:bc,de,28,ed,8f,36,49,09,8f,e9,98,e2,f4,57,38,c3,47,6b,62,90,e3,
8e,ae,a8,3f,e4,ce,fa,94,20,98,b6,49,00,4a,f0,9f,7f,1a,22,d1,d6,65,21,45,00,\
"rkeysecu "=hex:6c,33,7b,3b,e2,25,e6,76,ff,a4,29,b1,81,c5,11,57

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{61E02159-A14A-FC32-018FB6A6B5E128FA}\{BE08726F-5794-26E4-FF65539D238093C7}\{FD6EFD08-28CD-2519-DC89D4AD1DA3D3A5}*]
"O2CT5QFVF1HWGZGS36NG52TBRG1 "=hex:01,00,01,00,00,00,00,00,c9,e6,15,9c,9d,78,76,
aa,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(952)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-12-21 06:19:34
ComboFix-quarantined-files.txt 2010-12-21 06:19
ComboFix2.txt 2010-12-20 05:54

Pre-Run: 191,722,565,632 bytes free
Post-Run: 191,721,648,128 bytes free

- - End Of File - - 6A9EA2B8B56A6400DD05F48FE60A61F9

 

Got to go to work 7-10am here. i'll check in tonight when i get home.

Good luck,
Sean.

 

Hi broni,

Put machine into safe mode with networking, dragged and dropped the notepad script into the combofix icon, combofix started and updated itself, when it was preparing to run a scan i received the same warnings about comodo AV, attempted to create a new system restore point not sure if it did? Downloading MS recovery console, received the same boot partition error message, clicked yes to continue scanning for malware, machine rebooted itself and produced the log below...


ComboFix 10-12-21.01 - shaun wade 21/12/2010 19:32:15.4.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1022.756 [GMT 0:00]
Running from: c:\documents and settings\shaun wade\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\shaun wade\Desktop\CFScript.txt
AV: COMODO Antivirus *Enabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: Outpost Firewall *Disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AAUDSTUM
-------\Legacy_BGEEJA
-------\Legacy_SC
-------\Service_aaudstum
-------\Service_BGEEJA
-------\Service_SC


((((((((((((((((((((((((( Files Created from 2010-11-21 to 2010-12-21 )))))))))))))))))))))))))))))))
.

2010-12-21 07:12 . 2010-12-21 07:12 91533 ----a-w- c:\windows\cscmondump.bin
2010-12-19 19:58 . 2010-12-19 19:58 -------- d-----w- C:\VritualRoot
2010-12-19 07:37 . 2010-12-19 07:37 -------- d-----w- c:\windows\system32\wbem\Repository
2010-12-12 06:17 . 2010-12-12 06:17 2204 -c--a-w- c:\windows\crpf.bin
2010-12-12 06:17 . 2010-12-12 06:17 1552 -c--a-w- c:\windows\crpf_sdum.bin
2010-12-10 07:34 . 2010-12-10 16:03 -------- d-----w- c:\documents and settings\shaun wade\Application Data\Skype
2010-12-08 07:42 . 2010-12-08 08:34 -------- d-----w- c:\program files\Codemasters
2010-12-07 23:45 . 2010-12-07 23:45 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2010-12-07 23:45 . 2010-12-07 23:45 -------- d-----w- c:\program files\AIM
2010-12-07 23:45 . 2010-12-07 23:45 -------- d-----w- c:\program files\Common Files\Software Update Utility
2010-12-05 01:58 . 2010-12-11 23:02 -------- d-----r- c:\program files\Skype
2010-12-05 01:58 . 2010-12-05 01:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-11-30 23:55 . 2008-04-15 15:17 295424 -c----w- c:\windows\system32\dllcache\termsrv.dll
2010-11-29 06:20 . 2010-11-29 06:20 -------- d-----w- c:\program files\Common Files\Java
2010-11-29 06:19 . 2010-11-29 06:19 73728 -c--a-w- c:\windows\system32\javacpl.cpl
2010-11-29 06:19 . 2010-11-29 06:19 -------- d-----w- c:\program files\Java
2010-11-22 17:34 . 2009-09-04 17:44 515416 -c--a-w- c:\windows\system32\XAudio2_5.dll
2010-11-22 17:34 . 2009-09-04 17:44 238936 -c--a-w- c:\windows\system32\xactengine3_5.dll
2010-11-22 17:34 . 2009-09-04 17:29 1974616 -c--a-w- c:\windows\system32\D3DCompiler_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 5501792 -c--a-w- c:\windows\system32\d3dcsx_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 453456 -c--a-w- c:\windows\system32\d3dx10_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 235344 -c--a-w- c:\windows\system32\d3dx11_42.dll
2010-11-22 17:34 . 2009-09-04 17:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 22:21 . 2010-03-23 12:37 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-12-20 22:21 . 2010-03-23 12:37 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-11-29 17:42 . 2008-07-19 13:27 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-29 17:42 . 2008-05-08 02:33 20952 -c--a-w- c:\windows\system32\drivers\mbam.sys
2010-11-29 06:19 . 2010-07-17 06:32 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-02 00:20 . 2009-08-15 00:54 235248 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2010-09-24 21:05 . 2010-09-24 21:05 86528 -c--a-w- c:\windows\bnetunin.exe
2010-09-24 21:05 . 2010-09-24 21:05 61440 -c--a-w- c:\windows\diabunin.exe
2010-04-17 16:58 . 2010-04-17 16:58 444 -c--a-w- c:\program files\04201017583831.bat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix "= "c:\combofix\CF6856.cfxxe" [X]
"OutpostMonitor "= "c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"COMODO Internet Security "= "c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-09-10 2500552]

c:\documents and settings\shaun wade\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer "=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"ctfmon.exe "=c:\windows\system32\ctfmon.exe
"WMPNSCFG "=c:\program files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" -atboottime
"PDVD8LanguageShortcut "= "c:\program files\CyberLink\PowerDVD8\Language\Language.exe "
"RemoteControl8 "= "c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\DNA\\btdna.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\AIM\\aim.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56490:TCP "= 56490:TCPando Media Booster
"56490:UDP "= 56490:UDPando Media Booster
"1434:TCP "= 1434:TCP:Akamai NetSession Interface
"5000:UDP "= 5000:UDP:Akamai NetSession Interface
"3776:UDP "= 3776:UDP:Media Center Extender Service
"3390:TCP "= 3390:TCP:Remote Media Center Experience

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13/07/2008 00:38 717296]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [10/09/2010 23:40 15592]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [10/09/2010 23:40 239240]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [30/11/2009 19:32 704384]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [17/06/2009 21:51 941784]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [30/11/2009 19:30 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [30/11/2009 19:31 257432]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [22/01/2008 22:04 33792]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [30/11/2009 19:30 1195008]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16/05/2010 03:55 136176]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\6.tmp --> c:\windows\system32\6.tmp [?]
S3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;c:\windows\system32\drivers\qscnusb.sys [09/04/2010 17:57 103552]
S3 PsSdk30;PsSdk30;\??\c:\windows\system32\Drivers\PsSdk30.drv --> c:\windows\system32\Drivers\PsSdk30.drv [?]
S3 scrcap;scrcap;c:\windows\system32\DRIVERS\scrcap.sys --> c:\windows\system32\DRIVERS\scrcap.sys [?]
S3 V0090VID;Creative WebCam Vista Plus;c:\windows\system32\drivers\V0090Vid.sys [28/01/2007 04:29 138112]
S3 XDva226;XDva226;\??\c:\windows\system32\XDva226.sys --> c:\windows\system32\XDva226.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
QWAVE REG_MULTI_SZ QWAVE
.
Contents of the 'Scheduled Tasks' folder

2010-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 03:55]

2010-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 03:55]

2010-12-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987269382-2677141407-1074731499-1007Core.job
- c:\documents and settings\kieran wade\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-30 08:17]

2010-12-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987269382-2677141407-1074731499-1007UA.job
- c:\documents and settings\kieran wade\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-30 08:17]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\documents and settings\shaun wade\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm
FF - ProfilePath - c:\documents and settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GBfficial
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Ghostery: firefox@ghostery.com - %profile%\extensions\firefox@ghostery.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-21 19:41
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath "= "\??\c:\windows\system32\6.tmp "

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]
"ImagePath "= "\??\c:\windows\system32\Drivers\PsSdk30.drv "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1987269382-2677141407-1074731499-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1987269382-2677141407-1074731499-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"?? "=hex:c5,fa,ca,e0,40,6f,f7,3d,98,65,63,73,7d,3d,59,da,c0,5a,c4,46,e7,bd,36,
7d,96,91,04,e7,9d,b5,c7,e6,8e,ee,ea,f3,75,03,8b,bc,00,92,54,e4,ae,8f,17,f0,\
"?? "=hex:77,41,a4,25,d7,8e,b1,5d,4e,11,b4,f7,db,9b,c4,f9

[HKEY_USERS\S-1-5-21-1987269382-2677141407-1074731499-1006\Software\SecuROM\License information*]
"datasecu "=hex:bc,de,28,ed,8f,36,49,09,8f,e9,98,e2,f4,57,38,c3,47,6b,62,90,e3,
8e,ae,a8,3f,e4,ce,fa,94,20,98,b6,49,00,4a,f0,9f,7f,1a,22,d1,d6,65,21,45,00,\
"rkeysecu "=hex:6c,33,7b,3b,e2,25,e6,76,ff,a4,29,b1,81,c5,11,57

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{61E02159-A14A-FC32-018FB6A6B5E128FA}\{BE08726F-5794-26E4-FF65539D238093C7}\{FD6EFD08-28CD-2519-DC89D4AD1DA3D3A5}*]
"O2CT5QFVF1HWGZGS36NG52TBRG1 "=hex:01,00,01,00,00,00,00,00,c9,e6,15,9c,9d,78,76,
aa,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1260)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1328)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(3920)
c:\windows\system32\WININET.dll
c:\windows\system32\guard32.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\libusbd-nt.exe
c:\windows\ehome\RMSvc.exe
c:\windows\ehome\McrdSvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\program files\SpywareGuard\sgbhp.exe
.
**************************************************************************
.
Completion time: 2010-12-21 19:46:34 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-21 19:46
ComboFix2.txt 2010-12-21 06:19
ComboFix3.txt 2010-12-20 05:54

Pre-Run: 192,011,878,400 bytes free
Post-Run: 190,931,701,760 bytes free

- - End Of File - - 28EF3E46441776505EEA1907BFBB25FE

 

Got to go now, i'll check back in the morning before i go to work.

Many thanks for your valuable time.

 

Good morning Broni.

The computer is working really well, before it used to take forever to start up/shut down. I have not tried any malware scans yet until you say so, it wouldn’t let me run any scans before we started; they froze the computer after a short time.

I have tried to post the OTL logs and it says the text is too long, i tried to post them separately one at a time and still it says the text is too long?

Cheers,

Sean.

 

Here we go...

OTL logfile created on: 22/12/2010 03:17:11 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\shaun wade\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,022.00 Mb Total Physical Memory | 568.00 Mb Available Physical Memory | 56.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 292.75 Gb Total Space | 177.66 Gb Free Space | 60.69% Space Free | Partition Type: NTFS

Computer Name: YOUR-7F67FB56EB | User Name: shaun wade | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/22 03:11:15 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\shaun wade\Desktop\OTL.exe
PRC - [2010/09/10 23:41:42 | 001,901,056 | ---- | M] (COMODO) -- C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
PRC - [2010/09/10 23:41:20 | 002,500,552 | ---- | M] (COMODO) -- C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
PRC - [2008/04/14 00:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/03/09 19:50:18 | 000,018,944 | ---- | M] (http://libusb-win32.sourceforge.net) -- C:\WINDOWS\system32\libusbd-nt.exe
PRC - [2003/08/29 19:05:35 | 000,360,448 | ---- | M] () -- C:\Program Files\SpywareGuard\sgmain.exe
PRC - [2003/08/29 11:14:56 | 000,233,472 | ---- | M] () -- C:\Program Files\SpywareGuard\sgbhp.exe


========== Modules (SafeList) ==========

MOD - [2010/12/22 03:11:15 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\shaun wade\Desktop\OTL.exe
MOD - [2010/09/10 23:41:40 | 000,285,480 | ---- | M] (COMODO) -- C:\WINDOWS\system32\guard32.dll
MOD - [2010/08/23 16:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -d -f %ProgramFiles%\WinPcap\rpcapd.ini -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [Disabled | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - File not found [Disabled | Stopped] -- C:\windows\System32\hidserv.dll -- (HidServ)
SRV - [2010/09/10 23:41:42 | 001,901,056 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2009/04/28 10:06:06 | 001,195,008 | ---- | M] (Agnitum Ltd.) [Auto | Running] -- C:\Program Files\Agnitum\Outpost Firewall\acs.exe -- (acssrv)
SRV - [2005/03/09 19:50:18 | 000,018,944 | ---- | M] (http://libusb-win32.sourceforge.net) [Auto | Running] -- C:\WINDOWS\system32\libusbd-nt.exe -- (libusbd)
SRV - [2003/03/09 21:31:02 | 000,065,795 | ---- | M] (HP) [Disabled | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\XDva226.sys -- (XDva226)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\DRIVERS\scrcap.sys -- (scrcap)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\Drivers\PsSdk30.drv -- (PsSdk30)
DRV - File not found [Kernel | Auto | Stopped] -- C:\Nexon\MapleStory\npkcrypt.sys -- (npkcrypt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\6.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\DRIVERS\ManyCam.sys -- (ManyCam)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2010/09/10 23:40:52 | 000,239,240 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2010/09/10 23:40:48 | 000,015,592 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmderd.sys -- (cmderd)
DRV - [2009/09/17 11:50:31 | 000,103,552 | R--- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qscnusb.sys -- (MobileAdapter)
DRV - [2009/04/08 13:29:52 | 000,056,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\xusb21.sys -- (xusb21)
DRV - [2009/04/06 11:37:12 | 000,704,384 | ---- | M] (Agnitum Ltd.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SandBox.sys -- (SandBox)
DRV - [2009/02/18 17:30:56 | 000,031,128 | ---- | M] (Agnitum Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afw.sys -- (afw)
DRV - [2009/02/10 16:15:42 | 000,257,432 | ---- | M] (Agnitum Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afwcore.sys -- (afwcore)
DRV - [2008/07/13 00:38:52 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/04/13 18:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/13 18:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 18:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 16:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/03/11 14:14:54 | 000,941,784 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CAMTHWDM.sys -- (CAMTHWDM)
DRV - [2008/01/22 21:38:03 | 002,845,696 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007/07/20 17:40:10 | 000,084,992 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2007/05/16 23:18:26 | 000,004,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nocashio.sys -- (nocashio)
DRV - [2006/09/18 13:59:08 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se27unic.sys -- (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)
DRV - [2006/09/18 13:59:00 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se27nd5.sys -- (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)
DRV - [2006/09/18 13:58:58 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006/09/18 13:58:54 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006/09/18 13:58:52 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006/08/25 03:47:00 | 000,002,560 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\windows\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2006/08/25 03:47:00 | 000,002,432 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\windows\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2006/07/17 17:33:18 | 000,137,216 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (HdAudAddService)
DRV - [2006/05/15 13:35:48 | 000,086,560 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27obex.sys -- (SE27obex)
DRV - [2006/05/15 13:35:36 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2006/04/25 09:26:18 | 000,250,368 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\windows\SYSTEM32\DRIVERS\IASTOR.SYS -- (iaStor)
DRV - [2005/11/21 05:48:20 | 000,016,512 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (Aspi32)
DRV - [2005/06/30 12:16:00 | 001,094,848 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2005/04/14 01:00:00 | 000,138,112 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\V0090Vid.sys -- (V0090VID)
DRV - [2005/03/09 20:50:16 | 000,033,792 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0)
DRV - [2005/01/04 18:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\npptNT2.sys -- (NPPTNT2)
DRV - [2004/08/10 19:00:00 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2004/08/10 19:00:00 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2004/08/10 19:00:00 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2004/08/10 19:00:00 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2004/08/10 19:00:00 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2004/08/10 19:00:00 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2004/08/10 19:00:00 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2004/08/10 19:00:00 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2004/08/10 19:00:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\asc.sys -- (asc)
DRV - [2004/08/10 19:00:00 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2004/08/10 19:00:00 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2004/08/10 19:00:00 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2004/08/10 19:00:00 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2004/08/10 19:00:00 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2004/08/10 19:00:00 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 14:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GBfficial "
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.1
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.4.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/20 00:07:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/07 23:45:16 | 000,000,000 | ---D | M]

[2008/08/26 16:59:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Extensions
[2010/12/21 07:51:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\extensions
[2010/06/12 20:26:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/28 04:27:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010/11/03 16:26:38 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/10/28 16:10:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\extensions\firefox@ghostery.com
[2010/10/03 11:38:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\extensions\personas@christopher.beard
[2009/11/19 20:52:53 | 000,000,938 | ---- | M] () -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\searchplugins\facebook.xml
[2007/09/09 04:26:31 | 000,001,406 | ---- | M] () -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\searchplugins\siteadvisor.gif
[2007/09/09 04:26:31 | 000,000,276 | ---- | M] () -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\searchplugins\siteadvisor.src
[2007/05/19 06:35:55 | 000,002,386 | ---- | M] () -- C:\Documents and Settings\shaun wade\Application Data\Mozilla\Firefox\Profiles\xibohe18.default\searchplugins\siteadvisor.xml
[2010/12/21 07:51:27 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/12/05 01:58:43 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/11/29 06:20:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/11/29 06:19:42 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/07/02 21:20:46 | 000,069,632 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
[2010/11/24 19:30:07 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/11/24 19:30:07 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/11/24 19:30:07 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/11/24 19:30:07 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/12/21 19:41:36 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [OutpostMonitor] C:\Program Files\Agnitum\Outpost Firewall\op_mon.exe (Agnitum Ltd.)
O4 - Startup: C:\Documents and Settings\shaun wade\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\shaun wade\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-40e1-a617-af65a72a0465/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1260767348203 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1254718264375 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\windows\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\shaun wade\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\shaun wade\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\windows\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\windows\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\windows\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\windows\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.XFR1 - C:\windows\System32\xfcodec.dll ()
Drivers32: vidc.yv12 - C:\windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56308606093492224)

========== Files/Folders - Created Within 30 Days ==========

[2010/12/22 03:11:15 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\shaun wade\Desktop\OTL.exe
[2010/12/21 19:36:18 | 000,000,000 | ---D | C] -- C:\windows\temp
[2010/12/21 17:06:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\ABOVE STORAGE GUIDELINES
[2010/12/21 06:03:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\COMBOFIX 2
[2010/12/20 20:26:29 | 023,448,640 | ---- | C] (DVDVideoSoft Limited. ) -- C:\Documents and Settings\shaun wade\Desktop\FreeYouTubeToMp3Converter.exe
[2010/12/19 19:58:12 | 000,000,000 | ---D | C] -- C:\VritualRoot
[2010/12/19 19:57:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\NTBR_CD
[2010/12/19 18:44:19 | 000,212,480 | ---- | C] (SteelWerX) -- C:\windows\SWXCACLS.exe
[2010/12/19 18:44:19 | 000,161,792 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2010/12/19 18:44:19 | 000,136,704 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2010/12/19 18:44:19 | 000,031,232 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2010/12/19 18:14:19 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/19 18:00:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\HELP
[2010/12/19 08:13:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\WBBS
[2010/12/19 07:37:23 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\shaun wade\Recent
[2010/12/18 13:01:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\NS
[2010/12/13 16:03:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\ssra LITTER PICKING
[2010/12/13 05:51:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\RA
[2010/12/13 01:57:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\ruth cd
[2010/12/12 17:00:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Desktop\abba
[2010/12/10 07:34:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\Application Data\Skype
[2010/12/08 07:42:01 | 000,000,000 | ---D | C] -- C:\Program Files\Codemasters
[2010/12/07 23:45:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AIM
[2010/12/07 23:45:21 | 000,000,000 | ---D | C] -- C:\Program Files\AIM
[2010/12/07 23:45:14 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Software Update Utility
[2010/12/05 01:58:13 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2010/12/05 01:58:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype
[2010/11/29 19:39:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\shaun wade\My Documents\My Received Files
[2010/11/29 06:20:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/11/29 06:19:31 | 000,000,000 | ---D | C] -- C:\Program Files\Java

========== Files - Modified Within 30 Days ==========

[2023/12/09 11:09:14 | 002,449,046 | ---- | M] () -- C:\Documents and Settings\shaun wade\My Documents\SDC10304.JPG
[2010/12/22 03:23:55 | 001,474,832 | ---- | M] () -- C:\windows\System32\drivers\sfi.dat
[2010/12/22 03:20:03 | 000,000,894 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/12/22 03:15:45 | 000,000,223 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Windows BBS - Help and Support forum for Microsoft Windows. A Wealth of Windows Knowledge..url
[2010/12/22 03:12:01 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Microsoft Office Word 2003.lnk
[2010/12/22 03:11:15 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\shaun wade\Desktop\OTL.exe
[2010/12/22 03:05:04 | 000,001,158 | ---- | M] () -- C:\windows\System32\wpa.dbl
[2010/12/22 03:05:00 | 000,000,890 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/12/22 03:04:08 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat
[2010/12/22 03:04:01 | 1072,156,672 | -HS- | M] () -- C:\hiberfil.sys
[2010/12/21 22:02:02 | 000,001,000 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1987269382-2677141407-1074731499-1007UA.job
[2010/12/21 20:22:21 | 000,000,535 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Sign In.url
[2010/12/21 19:41:36 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts
[2010/12/21 19:25:52 | 003,995,873 | R--- | M] () -- C:\Documents and Settings\shaun wade\Desktop\ComboFix.exe
[2010/12/21 19:02:00 | 000,000,948 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1987269382-2677141407-1074731499-1007Core.job
[2010/12/21 16:52:10 | 000,000,256 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Login Facebook.url
[2010/12/21 16:49:00 | 000,000,377 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Freemans.com - Online catalogue shopping for ladies fashion, electricals, home and garden.url
[2010/12/21 15:54:57 | 000,000,379 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Tesco.com - Signin or Register.url
[2010/12/21 08:32:41 | 000,001,408 | ---- | M] () -- C:\windows\eReg.dat
[2010/12/21 07:12:49 | 000,091,533 | ---- | M] () -- C:\windows\cscmondump.bin
[2010/12/20 22:21:57 | 000,418,480 | ---- | M] (Creative Labs) -- C:\windows\System32\wrap_oal.dll
[2010/12/20 20:26:29 | 023,448,640 | ---- | M] (DVDVideoSoft Limited. ) -- C:\Documents and Settings\shaun wade\Desktop\FreeYouTubeToMp3Converter.exe
[2010/12/20 20:25:37 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Ian and family.doc
[2010/12/19 20:45:05 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\MBRCheck.exe
[2010/12/19 19:56:24 | 002,565,432 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\NTBR_CD.exe
[2010/12/19 13:13:58 | 000,000,000 | ---- | M] () -- C:\windows\MEMORY.DMP
[2010/12/19 12:53:05 | 000,112,640 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Manual Handling Assessment Sports Marking Operations.doc
[2010/12/19 08:07:33 | 000,036,742 | ---- | M] () -- C:\Documents and Settings\shaun wade\Application Data\wklnhst.dat
[2010/12/19 08:07:33 | 000,019,456 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\passwords.wps
[2010/12/18 12:36:24 | 000,000,214 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Findlay Irvine - ICELERT.net Login.url
[2010/12/18 06:06:41 | 000,000,439 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Halifax - Welcome to Online.url
[2010/12/17 05:30:37 | 000,221,696 | ---- | M] () -- C:\Documents and Settings\shaun wade\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/15 06:16:19 | 000,027,136 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\The beginning.doc
[2010/12/14 14:27:55 | 000,000,253 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Parish Church Records.url
[2010/12/13 06:30:51 | 000,082,944 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\The Manual Handling Operations Regulations 1992.doc
[2010/12/13 06:19:36 | 000,113,664 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Manual Handling Assessment Sports Marking Operations blank.doc
[2010/12/12 11:24:59 | 000,002,495 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Microsoft Office Excel 2003.lnk
[2010/12/12 09:49:44 | 000,085,100 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\bowbie.com.jpg
[2010/12/12 06:29:34 | 000,006,292 | ---- | M] () -- C:\windows\System32\cfrpd.PNF
[2010/12/12 06:29:31 | 000,006,292 | ---- | M] () -- C:\windows\System32\cfrmd.PNF
[2010/12/12 06:17:57 | 000,003,884 | ---- | M] () -- C:\windows\csdf.dat
[2010/12/12 06:17:57 | 000,002,204 | ---- | M] () -- C:\windows\crpf.bin
[2010/12/12 06:17:57 | 000,001,862 | ---- | M] () -- C:\windows\csdf_sdum.dat
[2010/12/12 06:17:57 | 000,001,552 | ---- | M] () -- C:\windows\crpf_sdum.bin
[2010/12/09 17:33:26 | 000,430,136 | R--- | M] () -- C:\windows\System32\drivers\etc\hosts.20101218-144848.backup
[2010/12/07 23:45:40 | 000,001,113 | -H-- | M] () -- C:\IPH.PH
[2010/12/06 06:08:14 | 000,000,456 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\Read the ebook The diocese of Meath ancient and modern (Volume 1) by Anthony Cogan.url
[2010/12/05 01:59:45 | 000,000,056 | -H-- | M] () -- C:\windows\System32\ezsidmv.dat
[2010/12/01 00:11:23 | 000,000,418 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2010/11/29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2010/11/27 14:10:14 | 000,429,158 | R--- | M] () -- C:\windows\System32\drivers\etc\hosts.20101209-173326.backup
[2010/11/26 06:24:21 | 000,216,772 | ---- | M] () -- C:\Documents and Settings\shaun wade\My Documents\ANT%20Auditor%20Word%20Report.pdf

========== Files Created - No Company Name ==========

[2010/12/21 19:37:37 | 1072,156,672 | -HS- | C] () -- C:\hiberfil.sys
[2010/12/21 07:12:49 | 000,091,533 | ---- | C] () -- C:\windows\cscmondump.bin
[2010/12/19 20:56:52 | 003,995,873 | R--- | C] () -- C:\Documents and Settings\shaun wade\Desktop\ComboFix.exe
[2010/12/19 20:44:57 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\MBRCheck.exe
[2010/12/19 19:56:24 | 002,565,432 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\NTBR_CD.exe
[2010/12/19 18:44:19 | 000,256,512 | ---- | C] () -- C:\windows\PEV.exe
[2010/12/19 18:44:19 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2010/12/19 18:44:19 | 000,089,088 | ---- | C] () -- C:\windows\MBR.exe
[2010/12/19 18:44:19 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2010/12/19 18:44:19 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2010/12/18 12:48:37 | 000,043,008 | ---- | C] () -- C:\Documents and Settings\shaun wade\My Documents\CV - Shaun Wade Final.doc
[2010/12/15 06:16:18 | 000,027,136 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\The beginning.doc
[2010/12/13 06:25:02 | 000,082,944 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\The Manual Handling Operations Regulations 1992.doc
[2010/12/13 06:16:23 | 000,113,664 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\Manual Handling Assessment Sports Marking Operations blank.doc
[2010/12/13 05:58:32 | 000,112,640 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\Manual Handling Assessment Sports Marking Operations.doc
[2010/12/12 15:37:28 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\Ian and family.doc
[2010/12/12 09:49:44 | 000,085,100 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\bowbie.com.jpg
[2010/12/12 06:29:34 | 000,006,292 | ---- | C] () -- C:\windows\System32\cfrpd.PNF
[2010/12/12 06:29:29 | 000,006,292 | ---- | C] () -- C:\windows\System32\cfrmd.PNF
[2010/12/12 06:17:57 | 000,003,884 | ---- | C] () -- C:\windows\csdf.dat
[2010/12/12 06:17:57 | 000,002,204 | ---- | C] () -- C:\windows\crpf.bin
[2010/12/12 06:17:57 | 000,001,862 | ---- | C] () -- C:\windows\csdf_sdum.dat
[2010/12/12 06:17:57 | 000,001,552 | ---- | C] () -- C:\windows\crpf_sdum.bin
[2010/12/06 06:08:14 | 000,000,456 | ---- | C] () -- C:\Documents and Settings\shaun wade\Desktop\Read the ebook The diocese of Meath ancient and modern (Volume 1) by Anthony Cogan.url
[2010/12/05 01:59:45 | 000,000,056 | -H-- | C] () -- C:\windows\System32\ezsidmv.dat
[2010/11/26 06:24:21 | 000,216,772 | ---- | C] () -- C:\Documents and Settings\shaun wade\My Documents\ANT%20Auditor%20Word%20Report.pdf
[2010/11/16 19:58:29 | 000,778,768 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/09/27 14:12:23 | 000,016,896 | ---- | C] () -- C:\windows\System32\fpsp.dll
[2010/08/20 17:11:47 | 000,000,604 | ---- | C] () -- C:\windows\Sof2.INI
[2010/08/01 17:46:39 | 000,000,159 | ---- | C] () -- C:\windows\wininit.ini
[2010/04/17 16:58:38 | 000,000,444 | ---- | C] () -- C:\Program Files\04201017583831.bat
[2009/12/07 23:03:24 | 000,000,014 | ---- | C] () -- C:\windows\System32\systeminfo.dll
[2009/09/12 14:15:08 | 000,000,040 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ra3.ini
[2009/07/19 20:41:20 | 000,000,848 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2009/07/19 20:41:20 | 000,000,088 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\42CDCD17F7.sys
[2009/07/19 00:28:24 | 000,230,752 | ---- | C] () -- C:\windows\patchw32.dll
[2009/07/19 00:28:22 | 000,118,176 | ---- | C] () -- C:\windows\patchw.dll
[2009/06/17 21:51:56 | 000,941,784 | ---- | C] () -- C:\windows\System32\drivers\CAMTHWDM.sys
[2009/04/11 19:24:22 | 000,000,370 | ---- | C] () -- C:\windows\scummvm.ini
[2009/01/05 14:44:10 | 000,000,453 | ---- | C] () -- C:\windows\bdoscandellang.ini
[2008/12/23 05:43:14 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI
[2008/12/07 11:41:00 | 000,000,097 | ---- | C] () -- C:\windows\System32\PICSDK.ini
[2008/12/07 11:35:02 | 000,000,025 | ---- | C] () -- C:\windows\CDE DX7400DEFGIPS.ini
[2008/11/06 16:37:32 | 003,596,288 | ---- | C] () -- C:\windows\System32\qt-dx331.dll
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\windows\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelFrench.dll
[2008/08/29 20:42:51 | 000,000,736 | ---- | C] () -- C:\windows\SamsungMaster.INI
[2008/08/25 03:02:51 | 000,162,304 | ---- | C] () -- C:\windows\System32\ztvunrar36.dll
[2008/08/25 03:02:51 | 000,153,088 | ---- | C] () -- C:\windows\System32\UNRAR3.dll
[2008/08/25 03:02:51 | 000,077,312 | ---- | C] () -- C:\windows\System32\ztvunace26.dll
[2008/08/25 03:02:51 | 000,075,264 | ---- | C] () -- C:\windows\System32\unacev2.dll
[2008/07/13 00:38:51 | 000,717,296 | ---- | C] () -- C:\windows\System32\drivers\sptd.sys
[2008/07/13 00:27:48 | 000,004,096 | ---- | C] () -- C:\windows\System32\MF.dll
[2008/06/27 15:22:34 | 000,000,017 | ---- | C] () -- C:\windows\Missing.ini
[2008/06/11 23:55:04 | 000,041,296 | ---- | C] () -- C:\windows\System32\xfcodec.dll
[2008/01/22 22:04:43 | 000,033,792 | ---- | C] () -- C:\windows\System32\drivers\libusb0.sys
[2007/11/17 09:30:21 | 000,059,392 | R--- | C] () -- C:\windows\System32\streamhlp.dll
[2007/09/23 21:19:15 | 000,138,056 | ---- | C] () -- C:\Documents and Settings\shaun wade\Application Data\PnkBstrK.sys
[2007/09/23 20:09:18 | 000,000,271 | ---- | C] () -- C:\windows\game.ini
[2007/07/20 19:41:27 | 000,000,210 | ---- | C] () -- C:\windows\cncscore.ini
[2007/07/20 09:23:02 | 000,000,146 | ---- | C] () -- C:\windows\W2W.ini
[2007/07/19 22:22:38 | 000,000,044 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\{5E70RQU4-N865-6307-D5423453040Q}
[2007/07/19 20:36:50 | 000,000,199 | ---- | C] () -- C:\windows\swacnfg.ini
[2007/07/15 14:06:03 | 000,010,240 | ---- | C] () -- C:\windows\System32\vidx16.dll
[2007/07/09 20:37:08 | 000,001,322 | ---- | C] () -- C:\windows\kaillera.ini
[2007/05/16 23:18:26 | 000,004,096 | ---- | C] () -- C:\windows\System32\drivers\nocashio.sys
[2007/05/06 08:51:31 | 000,000,214 | ---- | C] () -- C:\windows\HP_48BitScanUpdatePatch.ini
[2007/04/28 16:30:26 | 000,027,136 | ---- | C] () -- C:\windows\System32\QTUninst.dll
[2007/04/03 08:36:29 | 000,046,592 | ---- | C] () -- C:\windows\System32\shellses.dll
[2007/03/18 17:54:07 | 000,000,056 | RHS- | C] () -- C:\windows\System32\F717CDCD42.sys
[2007/03/18 17:54:03 | 000,001,682 | -HS- | C] () -- C:\windows\System32\KGyGaAvL.sys
[2007/03/05 12:34:28 | 000,676,224 | ---- | C] () -- C:\windows\System32\OGACheckControl.DLL
[2007/02/25 14:33:52 | 000,000,002 | ---- | C] () -- C:\windows\System32\srecorder.dll
[2007/02/11 14:39:50 | 000,000,039 | ---- | C] () -- C:\windows\System32\TEVPXCW60.DLL
[2007/02/11 14:39:50 | 000,000,039 | ---- | C] () -- C:\windows\TDEVXCW60.DLL
[2007/02/11 14:39:50 | 000,000,038 | ---- | C] () -- C:\windows\iltwain.ini
[2007/02/09 18:01:06 | 000,001,394 | ---- | C] () -- C:\windows\cdplayer.ini
[2007/02/04 21:54:50 | 000,000,754 | ---- | C] () -- C:\windows\WORDPAD.INI
[2007/02/04 15:03:11 | 000,000,023 | ---- | C] () -- C:\windows\MegaManager.INI
[2007/01/22 16:58:56 | 000,221,696 | ---- | C] () -- C:\Documents and Settings\shaun wade\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/01/18 16:08:28 | 000,000,228 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007/01/15 06:51:54 | 000,036,742 | ---- | C] () -- C:\Documents and Settings\shaun wade\Application Data\wklnhst.dat
[2007/01/14 23:32:42 | 000,001,395 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/01/14 18:56:09 | 000,000,023 | ---- | C] () -- C:\windows\BlendSettings.ini
[2007/01/14 16:50:17 | 000,000,134 | ---- | C] () -- C:\Documents and Settings\shaun wade\Local Settings\Application Data\fusioncache.dat
[2006/08/22 08:03:17 | 000,001,793 | ---- | C] () -- C:\windows\System32\fxsperf.ini
[2006/08/21 16:23:31 | 000,002,112 | ---- | C] () -- C:\windows\System32\c0cwownt.dll
[2006/07/05 17:09:25 | 000,000,061 | ---- | C] () -- C:\windows\smscfg.ini
[2005/10/19 15:20:38 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI
[2005/09/01 23:39:24 | 000,831,488 | ---- | C] () -- C:\windows\System32\libeay32.dll
[2005/09/01 23:39:24 | 000,159,744 | ---- | C] () -- C:\windows\System32\ssleay32.dll
[2005/08/05 22:01:54 | 000,235,008 | ---- | C] () -- C:\windows\System32\psisdecd.dll
[2003/03/09 21:31:04 | 000,561,152 | ---- | C] () -- C:\windows\System32\hpotscl.dll
[2001/11/19 20:05:18 | 000,003,972 | ---- | C] () -- C:\windows\System32\drivers\PciBus.sys
[1997/06/14 02:56:08 | 000,056,832 | ---- | C] () -- C:\windows\System32\iyvu9_32.dll

 

========== LOP Check ==========

[2010/10/01 12:15:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Agnitum
[2010/12/07 23:45:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
[2009/06/22 00:10:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2009/03/22 11:11:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
[2010/07/03 21:52:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DVD X Studios
[2010/03/28 05:57:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2008/12/07 11:40:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/01/30 21:35:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FlashFXP
[2010/11/02 05:35:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\id Software
[2007/09/25 20:28:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IJJIGame
[2008/01/22 08:40:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kontiki
[2009/07/30 22:35:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
[2007/03/04 09:36:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2007/02/08 04:56:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2010/10/03 18:24:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2010/12/21 05:41:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008/12/07 11:45:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UDL
[2009/06/20 21:56:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WebcamMax
[2008/12/02 17:24:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2010/09/04 06:04:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Codemasters
[2010/11/16 17:37:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Command and Conquer 4
[2010/06/27 05:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\DVDVideoSoftIEHelpers
[2009/02/25 13:04:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\EPSON
[2010/06/28 16:37:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Facebook
[2009/08/31 10:46:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Gearbox Software
[2008/06/13 18:04:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\HiYo
[2010/03/22 16:04:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\id Software
[2010/03/26 06:35:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\IObit
[2007/11/24 15:07:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Leadertech
[2007/01/14 17:21:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\MSNInstaller
[2007/09/15 06:43:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\OfficeUpdate12
[2010/04/17 13:39:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\PlayFirst
[2009/09/12 14:23:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Red Alert 3
[2008/07/23 05:40:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Teleca
[2007/01/15 06:52:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Template
[2007/12/15 16:53:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\Uniblue
[2009/04/09 05:03:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\WeGame
[2009/03/14 16:25:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\shaun wade\Application Data\wsInspector

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/12/21 19:46:35 | 000,016,019 | ---- | M] () -- C:\ComboFix.txt
[2009/12/12 22:12:26 | 000,000,000 | ---- | M] () -- C:\dxva.log
[2010/12/22 03:04:01 | 1072,156,672 | -HS- | M] () -- C:\hiberfil.sys
[2008/12/07 09:52:59 | 000,000,522 | ---- | M] () -- C:\hpfr3420.xml
[2008/12/07 09:52:59 | 000,072,078 | ---- | M] () -- C:\hpfr3425.log
[2005/10/19 22:29:26 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/12/07 23:45:40 | 000,001,113 | -H-- | M] () -- C:\IPH.PH
[2006/07/05 16:51:01 | 000,000,021 | ---- | M] () -- C:\LOCAL
[2010/05/03 02:34:49 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2006/07/05 16:51:01 | 000,000,021 | ---- | M] () -- C:\MINI
[2005/10/19 22:29:26 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/10 19:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/07/12 06:56:46 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2007/04/16 15:52:53 | 000,000,864 | -HS- | M] () -- C:\nvfjaomn.sys
[2010/10/27 20:16:54 | 000,921,632 | ---- | M] () -- C:\PA7302.DAT
[2010/12/22 03:04:00 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
[2010/04/17 14:21:35 | 000,042,119 | ---- | M] () -- C:\playground.log
[2009/05/05 22:48:42 | 000,000,270 | ---- | M] () -- C:\RecorderSDKLog.txt
[2010/12/19 18:13:23 | 000,000,359 | ---- | M] () -- C:\rkill.log
[2008/08/21 18:00:55 | 000,000,232 | -H-- | M] () -- C:\sqmdata00.sqm
[2008/09/22 05:25:56 | 000,000,232 | -H-- | M] () -- C:\sqmdata01.sqm
[2008/09/03 19:43:33 | 000,000,232 | -H-- | M] () -- C:\sqmdata02.sqm
[2008/11/30 10:36:24 | 000,000,232 | -H-- | M] () -- C:\sqmdata03.sqm
[2008/11/13 06:36:24 | 000,000,232 | -H-- | M] () -- C:\sqmdata04.sqm
[2008/06/23 04:20:18 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2008/11/13 06:38:31 | 000,000,232 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/04/23 05:27:14 | 000,000,232 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/04/26 11:11:34 | 000,000,232 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/07/01 04:13:58 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2008/06/15 07:17:11 | 000,000,232 | -H-- | M] () -- C:\sqmdata10.sqm
[2008/06/15 10:33:29 | 000,000,232 | -H-- | M] () -- C:\sqmdata11.sqm
[2008/06/15 11:36:10 | 000,000,232 | -H-- | M] () -- C:\sqmdata12.sqm
[2008/06/15 13:07:09 | 000,000,232 | -H-- | M] () -- C:\sqmdata13.sqm
[2008/06/15 13:39:18 | 000,000,232 | -H-- | M] () -- C:\sqmdata14.sqm
[2008/06/15 14:44:12 | 000,000,232 | -H-- | M] () -- C:\sqmdata15.sqm
[2008/06/15 16:15:24 | 000,000,232 | -H-- | M] () -- C:\sqmdata16.sqm
[2008/06/15 17:12:37 | 000,000,232 | -H-- | M] () -- C:\sqmdata17.sqm
[2008/06/15 17:25:08 | 000,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
[2008/06/15 17:26:51 | 000,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
[2008/08/21 18:00:55 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2008/09/22 05:25:56 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2008/09/03 19:43:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2008/11/30 10:36:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2008/11/13 06:36:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2008/06/23 04:20:18 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2008/11/13 06:38:31 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/04/23 05:27:14 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/04/26 11:11:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/07/01 04:13:58 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2008/06/15 07:17:11 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2008/06/15 10:33:29 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2008/06/15 11:36:10 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2008/06/15 13:07:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2008/06/15 13:39:18 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2008/06/15 14:44:12 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2008/06/15 16:15:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2008/06/15 17:12:36 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2008/06/15 17:25:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2008/06/15 17:26:51 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2009/12/12 23:38:52 | 000,000,009 | ---- | M] () -- C:\VO.log
[2007/11/12 17:49:45 | 000,000,150 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 19:00:00 | 000,000,067 | ---- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 12:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2004/03/22 19:17:08 | 000,025,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 10:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2010/04/17 16:58:38 | 000,000,444 | ---- | M] () -- C:\Program Files\04201017583831.bat

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/10/19 15:19:08 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2005/10/19 15:19:08 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005/10/19 15:19:07 | 000,876,544 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/07/12 07:02:36 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2008/02/12 18:27:50 | 000,000,568 | -H-- | M] () -- C:\Documents and Settings\All Users\Start Menu\hpothb07.dat
[2008/02/12 18:27:50 | 000,000,789 | -H-- | M] () -- C:\Documents and Settings\All Users\Start Menu\hpothb07.tif

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/01/14 16:50:28 | 000,000,170 | -HS- | M] () -- C:\Documents and Settings\shaun wade\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/10/19 22:34:04 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\shaun wade\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2008/05/03 16:03:25 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\shaun wade\Desktop\ATF-Cleaner new.exe
[2010/12/21 19:25:52 | 003,995,873 | R--- | M] () -- C:\Documents and Settings\shaun wade\Desktop\ComboFix.exe
[2010/12/20 20:26:29 | 023,448,640 | ---- | M] (DVDVideoSoft Limited. ) -- C:\Documents and Settings\shaun wade\Desktop\FreeYouTubeToMp3Converter.exe
[2010/12/19 20:45:05 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\MBRCheck.exe
[2010/12/19 19:56:24 | 002,565,432 | ---- | M] () -- C:\Documents and Settings\shaun wade\Desktop\NTBR_CD.exe
[2010/12/22 03:11:15 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\shaun wade\Desktop\OTL.exe
[2010/10/30 16:00:27 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\shaun wade\Desktop\TFC.exe
[2010/08/08 06:05:08 | 000,037,888 | ---- | M] (NirSoft) -- C:\Documents and Settings\shaun wade\Desktop\whoistd.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2008/04/19 13:24:43 | 000,204,496 | ---- | M] (Malwarebytes) -- C:\Documents and Settings\shaun wade\My Documents\StartUpLite.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/10 19:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/01/14 16:50:27 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\shaun wade\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2007/05/15 05:25:50 | 000,000,253 | -H-- | M] () -- C:\Documents and Settings\All Users\hpothb07.tif
[2010/12/01 00:11:23 | 000,000,418 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/12/22 03:16:57 | 000,032,768 | -HS- | M] () -- C:\Documents and Settings\shaun wade\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 00:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 08:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 08:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 14:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 17:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 00:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 08:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 08:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 08:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2008/09/11 19:47:25 | 000,005,120 | -HS- | M] () -- C:\Program Files\Messenger\Thumbs.db
[2004/08/04 08:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 08:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 513 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF
@Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C46995DA
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E8BE05FA
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0CE7F3C9
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:63238B95
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B71D0B4
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:84098FD3
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:54AA54AA
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD30FA91
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B7BEAFF
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP9A27D00

< End of report >

 

OTL Extras logfile created on: 22/12/2010 03:17:11 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\shaun wade\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,022.00 Mb Total Physical Memory | 568.00 Mb Available Physical Memory | 56.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 292.75 Gb Total Space | 177.66 Gb Free Space | 60.69% Space Free | Partition Type: NTFS

Computer Name: YOUR-7F67FB56EB | User Name: shaun wade | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"56490:TCP" = 56490:TCP:*:Enabledando Media Booster
"56490:UDP" = 56490:UDP:*:Enabledando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"56490:TCP" = 56490:TCP:*:Enabledando Media Booster
"56490:UDP" = 56490:UDP:*:Enabledando Media Booster
"1434:TCP" = 1434:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"3776:UDP" = 3776:UDP:*:Enabled:Media Center Extender Service
"3390:TCP" = 3390:TCP:*:Enabled:Remote Media Center Experience

 

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)
"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:EnabledNA -- ()
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player -- (Veoh Networks)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{152B782A-05F3-48EC-9AAC-4D3EB68D9E20}" = Quake 4(TM)
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23FE964A-853B-4176-86D7-9E18B5CA1FC0}" = Media Center Extender
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2DFF2906-52BB-4222-8062-1509259FC013}" = GUN (TM)
"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager
"{318AB667-3230-41B5-A617-CB3BF748D371}" = iTunes
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"{3D78F2A2-C893-4ABD-B5FE-AD7011837755}" = EPSON Easy Photo Print
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{49FC50FC-F965-40D9-89B4-CBFF80941033}" = Windows Movie Maker 2.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{66D6F3BD-CA23-41A4-9FA3-96B26B32528C}" = Command & Conquer The First Decade
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{784D1110-7A5D-4BE9-8AAA-CC70FA2D1CBA}" = WindSlayer
"{7914BE1E-F186-4790-B8F4-9F63C52A41C1}" = Medal of Honor Allied Assault(tm) Spearhead
"{7AF32AB1-CB97-11D4-9607-0050BA84F5F7}" = Baldur's Gate(TM) II - Shadows of Amn(TM)
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{7F9129B6-C438-4CCB-80CB-A97E9F3B6B8C}" = Taksi Desktop Video Recorder v0.765
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{823A68CC-3049-4A6B-8F63-7DC85E4BB1C9}" = Medal of Honor Allied Assault(tm) Breakthrough
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8565AD28-C8EB-46C8-8AC1-F43BC32F11D3}" = WindSlayer
"{86D6A20D-3910-4441-A3E5-EB6977251C86}" = Samsung USB Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AAB4176-A747-493A-A42C-B63CFADFD8E3}" = NVIDIA PhysX
"{8CAE7CB3-B7C0-41A2-B2E3-9BD16124A091}" = EasyInfo
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Roxio Burn Engine
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
"{AD48AAF7-82BD-42F3-91AD-09FD114AFE80}" = ATI Catalyst Control Center
"{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Samsung Master
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{EBB05CE8-52DF-4B7C-BDF4-ECC6BB0C3BB1}" = Taksi Desktop Video Recorder
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F958CA02-BB40-4007-894B-258729456EE4}" = QuickTime
"{FD8E178D-8B4E-42DA-B434-EFF270329B1C}" = COMODO Internet Security
"{FEB209CE-C6F5-4604-B9BB-37DC12EDCABB}" = blueMSX
"7-Zip" = 7-Zip 4.42
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agnitum Outpost Firewall_is1" = Outpost Firewall 2009
"AIM_7" = AIM 7
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"Battle.net" = Battle.net
"CCleaner" = CCleaner (remove only)
"Creative VF0090" = Creative WebCam Vista Plus Driver (1.02.02.0414)
"Creatix V.92 Data Fax Modem" = Creatix V.92 Data Fax Modem
"DeleteProdRunControl_UK" = IBM ViaVoice Command and Control Runtime 5.3 - UK English
"Diablo" = Diablo
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"DVD X Player 5.4 Professional_is1" = DVD X Player 5.4 Professional
"EHome Devices" = Media Center Extender
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"EPSON Stylus CX7300_CX8300_DX7400_DX8400 User’s Guide" = EPSON Stylus CX7300_CX8300_DX7400_DX8400 Manual
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.7
"GameSpy Arcade" = GameSpy Arcade
"Halo Trial" = Microsoft Halo Trial
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"LastFM_is1" = Last.fm 1.5.4.27091
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.10.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MRU-Blaster_is1" = MRU-Blaster v1.5 (Database 3/28/2004)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MS-MPEG4" = Microsoft MPEG-4 VKI Video Codec V1/V2/V3
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OcaHistoryUpd" = OCA Client history tool install
"OpenAL" = OpenAL
"QuickTime 3.0" = QuickTime 3.0
"RealPlayer 6.0" = RealPlayer
"RPG Maker VX RTP_is1" = RPG Maker VX RTP
"RPG Maker VX_is1" = RPG Maker VX
"Saitek Dual Analog Rumble Pad" = Saitek Dual Analog Rumble Pad
"Snes9x" = Snes9x
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SpywareBlaster_is1" = SpywareBlaster 4.4
"SpywareGuard_is1" = SpywareGuard v2.2
"Total Video Converter 3.10_is1" = Total Video Converter 3.10
"Total Video Converter 3.21_is1" = Total Video Converter 3.21 090220
"Uninstall_is1" = Uninstall 1.0.0.1
"VV_Outloud_En_UK" = IBM ViaVoice Outloud Runtime - UK English
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

 

Hi Broni.

Just sneaked home from work to check the ESET Scanner.

Here's the results of the different instuctions you gave me...

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
C:\Program Files\04201017583831.bat moved successfully.
C:\Documents and Settings\All Users\Application Data\42CDCD17F7.sys moved successfully.
C:\WINDOWS\system32\F717CDCD42.sys moved successfully.
Folder C:\Documents and Settings\shaun wade\Application Data\Uniblue\ not found.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:C46995DA deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:E8BE05FA deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:0CE7F3C9 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:63238B95 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:3B71D0B4 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:84098FD3 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:54AA54AA deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:CD30FA91 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:4B7BEAFF deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP9A27D00 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: kieran wade
->Temp folder emptied: 2408 bytes
->Temporary Internet Files folder emptied: 1977357 bytes
->Java cache emptied: 3738 bytes
->FireFox cache emptied: 43078599 bytes
->Google Chrome cache emptied: 301087316 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 11118 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: shaun wade
->Temp folder emptied: 9364298 bytes
->Temporary Internet Files folder emptied: 5411151 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 45810423 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 3765 bytes

User: TEMP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17048 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 388.00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: kieran wade
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: shaun wade
->Flash cache emptied: 0 bytes

User: TEMP
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.18.0 log created on 12222010_053704

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temp\Perflib_Perfdata_a14.dat not found!
File\Folder C:\windows\temp\Perflib_Perfdata_4fc.dat not found!

Registry entries deleted on Reboot...


Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
Outpost Firewall 2009
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
CCleaner (remove only)
Java(TM) 6 Update 23
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Adobe Reader 8.2.5
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Comodo Firewall cmdagent.exe
Comodo Firewall cfp.exe
``````````End of Log````````````



C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch3.zip Win32/Bagle.gen.zip worm
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch7.zip Win32/Bagle.gen.zip worm
C:\Documents and Settings\shaun wade\Desktop\SEAN'S\unlocker1.8.7.exe Win32/Adware.ADON application


Many Thanks,

Sean.

 

Good evening broni.

The computer is running like a dream and its all down to you the magician

Many, many thanks to you for all your help with this evil £%+$ and a very merry Christmas and a happy new year to you and yours

Cheerio and god bless you.


Removed old Adobe and installed the latest version.

Run all instructed OTL scans, results below and installed WOT and latest MS updates

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch3.zip moved successfully.
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch7.zip moved successfully.
File\Folder C:\Documents and Settings\shaun wade\Desktop\SEAN'S\unlocker1.8.7.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56502 bytes

User: kieran wade
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: shaun wade
->Temp folder emptied: 90881 bytes
->Temporary Internet Files folder emptied: 11531495 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 13766661 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1084 bytes

User: TEMP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17048 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 1036145 bytes

Total Files Cleaned = 25.00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: kieran wade
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: shaun wade
->Flash cache emptied: 0 bytes

User: TEMP
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.18.0 log created on 12222010_174829

Files\Folders moved on Reboot...
File\Folder C:\windows\temp\Perflib_Perfdata_b30.dat not found!

Registry entries deleted on Reboot...



All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: kieran wade
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: shaun wade
->Temp folder emptied: 33438 bytes
->Temporary Internet Files folder emptied: 667940 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: TEMP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17048 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: kieran wade
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: shaun wade
->Flash cache emptied: 0 bytes

User: TEMP
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.18.0 log created on 12222010_175533

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\chunks[1].jsp not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\chunks[2].jsp not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\chunks[3].jsp not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\color[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\connection-min[1].js not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\core_11278[1].js not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\createlink[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\data_11278[1].js not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\debug_10486[1].js not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\facebook_logo[1].png not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\favicon[1].ico not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\Freesat_728x90[1].swf not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\front[1].asp not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\ga[1].js not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\gradient_nav[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\icon4[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\lastpost[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\navbits_dash[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\newthread[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\paperclip[1].gif not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\pixel[1] not found!
File\Folder C:\Documents and Settings\shaun wade\Local Settings\Temporary Internet Files\Content.IE5\WJ7DDM2H\pixel[1].htm not found!
File\Folder C:\windows\temp\Perflib_Perfdata_878.dat not found!

Registry entries deleted on Reboot...