Solved Virus

malady · 2011/12/13

[Resolved] Virus

Downloaded a free program from Hiren's called "Copylock" to my flash drive.Avira Free AV immediately caught it. When I clicked on the "E" flahdrive it immediately changed to "Q ". Figured an autorun.inf virus. Enclosed Avira Scan which caught the other copy in my Chrome downloads file.

Data\Default\Cache\
f_000104
[0] Archive type: ZIP
--> cmdtest.bat
--> CopyLock.exe
[DETECTION] Contains recognition pattern of the APPL/Tool.Replacer.B application
--> psapi.dll
--> ReadMe.txt
[NOTE] The file was moved to the quarantine directory under the name '4d752d2f.qua'.

Ran Kapersky TDSS Killer which killed my keyboard when I deleted the 12 suspicious files. Ran a full Malware Bytes scan and it found a program 4X from Nirsoft called product key which I think are flase positives. I have my E drive back but still have the "access denied" Q drive.

Logged in via safe mode as administrator and still could not open my user files which seemed strange. All said "access denied ". I could take ownership but not change permissions.

Here are the logs minus GMER which crashed after running for 8 hours. Why does that program take so long then continually freeze? Thanks!
-------------------------
Avira AntiVir Personal
Report file date: Sunday, December 11, 2011 23:53

Scanning for 3552762 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - Free Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : T

Version information:
BUILD.DAT : 10.2.0.704 35934 Bytes 9/28/2011 13:34:00
AVSCAN.EXE : 10.3.0.7 484008 Bytes 8/5/2011 23:15:26
AVSCAN.DLL : 10.0.5.0 47464 Bytes 8/5/2011 23:15:26
LUKE.DLL : 10.3.0.5 45416 Bytes 8/5/2011 23:15:27
LUKERES.DLL : 10.0.0.1 12648 Bytes 2/11/2010 04:40:49
AVSCPLR.DLL : 10.3.0.7 119656 Bytes 8/5/2011 23:15:27
AVREG.DLL : 10.3.0.9 88833 Bytes 8/5/2011 23:15:27
VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 14:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 12/14/2010 11:53:55
VBASE002.VDF : 7.11.3.0 1950720 Bytes 2/9/2011 11:53:56
VBASE003.VDF : 7.11.5.225 1980416 Bytes 4/7/2011 15:30:38
VBASE004.VDF : 7.11.8.178 2354176 Bytes 5/31/2011 15:30:40
VBASE005.VDF : 7.11.10.251 1788416 Bytes 7/7/2011 15:30:41
VBASE006.VDF : 7.11.13.60 6411776 Bytes 8/16/2011 14:46:11
VBASE007.VDF : 7.11.15.106 2389504 Bytes 10/5/2011 21:37:47
VBASE008.VDF : 7.11.18.32 2132992 Bytes 11/24/2011 17:23:29
VBASE009.VDF : 7.11.18.33 2048 Bytes 11/24/2011 17:23:29
VBASE010.VDF : 7.11.18.34 2048 Bytes 11/24/2011 17:23:29
VBASE011.VDF : 7.11.18.35 2048 Bytes 11/24/2011 17:23:29
VBASE012.VDF : 7.11.18.36 2048 Bytes 11/24/2011 17:23:29
VBASE013.VDF : 7.11.18.89 204800 Bytes 11/28/2011 18:18:11
VBASE014.VDF : 7.11.18.145 143872 Bytes 12/1/2011 19:31:58
VBASE015.VDF : 7.11.18.180 173056 Bytes 12/2/2011 19:32:06
VBASE016.VDF : 7.11.18.208 164864 Bytes 12/5/2011 17:30:10
VBASE017.VDF : 7.11.18.239 177152 Bytes 12/6/2011 19:16:59
VBASE018.VDF : 7.11.19.36 171520 Bytes 12/9/2011 16:18:38
VBASE019.VDF : 7.11.19.37 2048 Bytes 12/9/2011 16:18:38
VBASE020.VDF : 7.11.19.38 2048 Bytes 12/9/2011 16:18:39
VBASE021.VDF : 7.11.19.39 2048 Bytes 12/9/2011 16:18:39
VBASE022.VDF : 7.11.19.40 2048 Bytes 12/9/2011 16:18:39
VBASE023.VDF : 7.11.19.41 2048 Bytes 12/9/2011 16:18:39
VBASE024.VDF : 7.11.19.42 2048 Bytes 12/9/2011 16:18:40
VBASE025.VDF : 7.11.19.43 2048 Bytes 12/9/2011 16:18:40
VBASE026.VDF : 7.11.19.44 2048 Bytes 12/9/2011 16:18:41
VBASE027.VDF : 7.11.19.45 2048 Bytes 12/9/2011 16:18:41
VBASE028.VDF : 7.11.19.46 2048 Bytes 12/9/2011 16:18:42
VBASE029.VDF : 7.11.19.47 2048 Bytes 12/9/2011 16:18:42
VBASE030.VDF : 7.11.19.48 2048 Bytes 12/9/2011 16:18:42
VBASE031.VDF : 7.11.19.57 46592 Bytes 12/9/2011 16:18:44
Engineversion : 8.2.6.134
AEVDF.DLL : 8.1.2.2 106868 Bytes 10/31/2011 21:38:39
AESCRIPT.DLL : 8.1.3.90 491899 Bytes 12/8/2011 19:17:43
AESCN.DLL : 8.1.7.2 127349 Bytes 4/21/2011 11:53:27
AESBX.DLL : 8.2.4.5 434549 Bytes 12/2/2011 19:36:13
AERDL.DLL : 8.1.9.15 639348 Bytes 9/11/2011 19:06:20
AEPACK.DLL : 8.2.14.5 741751 Bytes 12/8/2011 19:17:40
AEOFFICE.DLL : 8.1.2.21 201084 Bytes 12/2/2011 19:35:15
AEHEUR.DLL : 8.1.3.6 3895670 Bytes 12/8/2011 19:17:24
AEHELP.DLL : 8.1.18.0 254327 Bytes 10/31/2011 21:38:16
AEGEN.DLL : 8.1.5.17 405877 Bytes 12/8/2011 19:17:09
AEEMU.DLL : 8.1.3.0 393589 Bytes 4/21/2011 11:53:14
AECORE.DLL : 8.1.24.0 196983 Bytes 10/31/2011 21:38:12
AEBB.DLL : 8.1.1.0 53618 Bytes 4/21/2011 11:53:14
AVWINLL.DLL : 10.0.0.0 19304 Bytes 4/21/2011 11:53:36
AVPREF.DLL : 10.0.3.2 44904 Bytes 8/5/2011 23:15:26
AVREP.DLL : 10.0.0.10 174120 Bytes 8/5/2011 23:15:27
AVARKT.DLL : 10.0.26.1 255336 Bytes 8/5/2011 23:15:25
AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 8/5/2011 23:15:26
SQLITE3.DLL : 3.6.19.0 355688 Bytes 7/20/2011 20:40:24
AVSMTP.DLL : 10.0.0.17 63848 Bytes 4/21/2011 11:53:36
NETNT.DLL : 10.0.0.0 11624 Bytes 4/21/2011 11:53:46
RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 8/5/2011 23:15:25
RCTEXT.DLL : 10.0.64.0 97640 Bytes 8/5/2011 23:15:25

Configuration settings for the scan:
Jobname.............................: avguard_async_scan
Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVGUARD_4f23e1b6\guard_slideup.avp
Logging.............................: Complete
Primary action......................: repair
Secondary action....................: quarantine
Scan master boot sector.............: on
Scan boot sector....................: off
Process scan........................: on
Scan registry.......................: off
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Deviating archive types.............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, +ISO 9660,
Macro heuristic.....................: on
File heuristic......................: Complete
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,
Expanded scan settings..............: 0x08000000
Expanded scan settings..............: 0x00300002

Start of the scan: Sunday, December 11, 2011 23:53

Starting search for hidden objects.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Avira\AntiVir Desktop\avscan.exe>
Scan process 'NOTEPAD.EXE' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\notepad.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Java\jre6\bin\jqs.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe>
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\explorer.exe>
Scan process 'CVHSVC.EXE' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE>
Scan process 'sftlist.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe>
Scan process 'sftvsa.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe>
Scan process 'OSPPSVC.EXE' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE>
Scan process 'YankClip.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Yankee Clipper\YankClip.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\ctfmon.exe>
Scan process 'RoboTaskBarIcon.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe>
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>
Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Avira\AntiVir Desktop\avgnt.exe>
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\ati2evxx.exe>
Scan process 'msdtc.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\msdtc.exe>
Scan process 'alg.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\alg.exe>
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\dllhost.exe>
Scan process 'vssvc.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\vssvc.exe>
Scan process 'swupdtmr.exe' - '1' Module(s) have been scanned
Module is OK -> <c:\TOSHIBA\IVP\swupdate\swupdtmr.exe>
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\dllhost.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\HPZipm12.exe>
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe>
Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe>
Scan process 'CFSvcs.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'sched.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Avira\AntiVir Desktop\sched.exe>
Scan process 'acs.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\acs.exe>
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\spoolsv.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\svchost.exe>
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\ati2evxx.exe>
Scan process 'avshadow.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Avira\AntiVir Desktop\avshadow.exe>
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\Program Files\Avira\AntiVir Desktop\avguard.exe>
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\lsass.exe>
Scan process 'services.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\services.exe>
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\winlogon.exe>
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\csrss.exe>
Scan process 'smss.exe' - '1' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\system32\smss.exe>

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Owner\My Documents\Downloads\1B2.tmp'
Search path C:\Documents and Settings\Owner\My Documents\Downloads\1B2.tmp could not be opened!
System error [2]: The system cannot find the file specified.
Begin scan in 'C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_000104'
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\
f_000104
[0] Archive type: ZIP
--> cmdtest.bat
--> CopyLock.exe
[DETECTION] Contains recognition pattern of the APPL/Tool.Replacer.B application
--> psapi.dll
--> ReadMe.txt
[NOTE] The file was moved to the quarantine directory under the name '4d752d2f.qua'.

End of the scan: Monday, December 12, 2011 00:06
Used time: 13:32 Minute(s)

The scan has been done completely.

0 Scanned directories
57 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
56 Files not concerned
1 Archives were scanned
0 Warnings
1 Notes
90170 Objects were scanned with rootkit scan
0 Hidden objects were found

--------------------------------

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8365

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

12/13/2011 12:48:50 PM
mbam-log-2011-12-13 (12-48-50).txt

Scan type: Full scan (C:\|D:\|E:\|Q:\|)
Objects scanned: 298588
Time elapsed: 1 hour(s), 35 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\program files\nirsof produkey 12-11-11\ProduKey.exe (PUP.PSWTool.ProductKey) -> Quarantined and deleted successfully.
c:\program files\nirsoft product key 12-11-11\ProduKey.exe (PUP.PSWTool.ProductKey) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f6221601-babc-4b69-922d-f7e899fb13e9}\RP19\A0006859.exe (PUP.PSWTool.ProductKey) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f6221601-babc-4b69-922d-f7e899fb13e9}\RP19\A0006858.exe (PUP.PSWTool.ProductKey) -> Quarantined and deleted successfully.
-----------------
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-12-13 19:20:21

19:20:21.250 OS Version: Windows 5.1.2600 Service Pack 3
19:20:21.250 Number of processors: 1 586 0xD08
19:20:21.250 ComputerName: T UserName:
19:20:23.531 Initialize success
19:28:16.250 AVAST engine defs: 11121302
19:28:49.265 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
19:28:49.265 Disk 0 Vendor: TOSHIBA_MK4026GAX PA100U Size: 38154MB BusType: 3
19:28:51.328 Disk 0 MBR read successfully
19:28:51.328 Disk 0 MBR scan
19:28:51.484 Disk 0 unknown MBR code
19:28:51.484 Disk 0 scanning sectors +78124095
19:28:51.578 Disk 0 scanning C:\WINDOWS\system32\drivers
19:29:07.812 Service scanning
19:29:10.562 Modules scanning
19:29:28.609 Disk 0 trace - called modules:
19:29:28.640 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
19:29:28.640 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84f84030]
19:29:28.640 3 CLASSPNP.SYS[f7790fd7] -> nt!IofCallDriver -> \Device\00000077[0x84f7b7d0]
19:29:29.140 5 ACPI.sys[f7707620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x84f7b8e8]
19:29:29.875 AVAST engine scan C:\WINDOWS
19:29:40.734 AVAST engine scan C:\WINDOWS\system32
19:32:37.171 AVAST engine scan C:\WINDOWS\system32\drivers
19:33:00.578 AVAST engine scan C:\Documents and Settings\Owner
19:45:09.000 AVAST engine scan C:\Documents and Settings\All Users
19:47:52.453 Scan finished successfully
19:59:03.468 Disk 0 MBR has been saved successfully to "F:\Toshiba Troubleshooting 12--12-11\WindowsBBS-Run these\MBR.dat "
19:59:03.546 The log file has been saved successfully to "F:\Toshiba Troubleshooting 12--12-11\WindowsBBS-Run these\aswMBR.txt "
------------------
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.5730.13
Run by Owner at 20:03:22 on 2011-12-13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.129 [GMT -5:00]
.
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dllhost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yankee Clipper\YankClip.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com/
mSearch Bar = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchURL = hxxp://www.google.com/
mURLSearchHooks: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: {52706EF7-D7A2-49AD-A615-E903858CF284} - No File
BHO: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll
BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll
TB: {E166B4A2-83E7-11D3-B4FD-004005A47AAA} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe "
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe "
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\yankee~1.lnk - c:\program files\yankee clipper\YankClip.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Display All Images with Full Quality - "c:\program files\netzero\qsacc\appres.dll/228 "
IE: Display Image with Full Quality - "c:\program files\netzero\qsacc\appres.dll/227 "
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - hxxp://www.sidestep.com/get/k00722/sb02d.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E6639D27-0BD0-43DD-8B8A-FE8D2DB86ABF} : DhcpNameServer = 192.168.1.1
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-8-5 11608]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-8-5 66616]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-1 22216]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [2009-12-2 581480]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [2009-12-2 209640]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [2009-12-2 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [2009-12-2 18280]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\androidusb.sys --> c:\windows\system32\drivers\ANDROIDUSB.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 Wdm1;USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc.sys [2007-2-8 15576]
.
=============== Created Last 30 ================
.
2011-12-13 20:46:18 319 ----a-w- C:\temp474.bat
2011-12-13 20:09:09 -------- d-----w- c:\program files\Windows Repair (All in One)Tweaking.com
2011-12-13 20:03:10 -------- d-----w- c:\program files\Sysinternals 12-13-11
2011-12-13 20:02:34 -------- d-----w- c:\program files\Sysinternals --
2011-12-13 18:27:52 105814912 ----a-w- C:\setup_11.0.0.1245.x01_2011_12_13_04_23.exe
2011-12-13 18:27:23 2429576 ----a-w- C:\MGtools.exe
2011-12-13 18:26:47 -------- d-----w- C:\Super AntiSpyware 12-8-11
2011-12-13 18:25:22 302592 ----a-w- C:\gmer.exe
2011-12-13 07:29:36 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2011-12-13 07:29:36 21504 ----a-w- c:\windows\system32\hidserv.dll
2011-12-13 06:33:49 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-12-13 06:33:49 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-13 06:31:29 -------- d-----w- c:\program files\Nirsoft Product Key 12-11-11
2011-12-13 06:31:20 -------- d-----w- c:\program files\IVT Corporation
2011-12-12 23:47:10 -------- d-----w- c:\program files\New Folder (2)(2)
2011-12-12 07:54:13 -------- d-----w- c:\program files\Free Window Registry Repair
2011-12-12 07:10:59 -------- d-----w- C:\TDSSKiller_Quarantine
2011-12-12 07:07:12 -------- d-----w- c:\program files\Kapersky TDDs Killer 12-11-11
2011-12-12 03:22:12 -------- d-----w- c:\program files\Java Ra 12-11-11
2011-12-12 01:09:58 -------- d-----w- c:\documents and settings\all users\application data\VirtualizedApplications
2011-12-11 22:52:42 -------- d-----w- c:\documents and settings\owner\local settings\application data\SoftGrid Client
2011-12-11 22:52:28 -------- d-----w- c:\documents and settings\owner\application data\SoftGrid Client
2011-12-11 22:48:11 -------- d-----w- c:\program files\Microsoft Application Virtualization Client
2011-12-11 22:48:11 -------- d-----w- c:\documents and settings\all users\Microsoft
2011-12-11 20:24:46 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2011-12-11 20:22:16 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2011-12-11 20:21:08 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2011-12-11 20:18:55 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-12-11 20:18:52 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-12-11 20:14:38 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-12-11 20:11:29 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2011-12-11 19:34:58 -------- d-----w- c:\program files\NirSof ProduKey 12-11-11
2011-12-11 18:47:28 -------- d-----w- c:\program files\common files\ODBC
2011-12-11 18:16:07 -------- d-----w- c:\program files\Messenger
2011-12-11 18:15:43 -------- d-----w- c:\windows\system32\scripting
2011-12-11 18:15:41 -------- d-----w- c:\windows\l2schemas
2011-12-11 18:15:39 -------- d-----w- c:\windows\system32\en
2011-12-11 18:15:39 -------- d-----w- c:\windows\system32\bits
2011-12-11 18:03:47 -------- d-----w- c:\windows\EHome
2011-12-11 04:12:24 -------- d-----w- c:\program files\DriveImage XML 12-10-11
2011-12-10 18:52:58 -------- d-----w- c:\program files\Belarc
2011-12-10 05:21:12 -------- d-----w- c:\documents and settings\owner\application data\TP
2011-12-09 21:52:10 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-12-09 21:50:11 134464 ----a-w- c:\windows\system32\LnkProtect.dll
2011-12-09 21:48:31 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro
2011-12-05 20:43:52 -------- d-----w- C:\Program Downloads 12-5-11
2011-12-04 21:00:05 155232 ----a-w- C:\WntIpcfg_setup.exe
2011-12-03 03:13:27 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-12-03 03:09:42 -------- d-----w- c:\program files\Toolbar Cleaner
2011-11-30 20:15:40 -------- d-----w- C:\US Boot 11-30-11
2011-11-30 18:45:43 -------- d-----w- c:\program files\Sardu Installer 11-30-11
2011-11-30 18:00:08 -------- d-----w- c:\program files\Regpair Reg Fixer 11-30-11
2011-11-30 17:52:57 -------- d-----w- c:\program files\SyncBack Freeware 11-30-11
2011-11-25 23:18:24 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-11-25 23:18:00 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-11-25 23:17:54 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-11-25 23:17:47 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2011-11-25 23:17:41 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-11-25 23:17:39 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-11-25 23:17:36 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-11-25 23:17:21 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-11-25 23:17:15 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-11-25 23:17:05 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2011-11-25 23:15:57 86073 -c--a-w- c:\windows\system32\dllcache\voicesub.dll
2011-11-25 23:15:57 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-11-25 23:15:56 426041 -c--a-w- c:\windows\system32\dllcache\voicepad.dll
2011-11-25 23:15:51 604253 -c--a-w- c:\windows\system32\dllcache\vmodem.sys
2011-11-25 23:15:46 249402 -c--a-w- c:\windows\system32\dllcache\vinwm.sys
2011-11-25 23:15:40 24576 -c--a-w- c:\windows\system32\dllcache\viairda.sys
2011-11-25 23:15:30 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-11-25 23:15:25 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys
2011-11-25 23:15:19 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2011-11-25 23:15:14 7556 -c--a-w- c:\windows\system32\dllcache\usroslba.sys
2011-11-25 23:15:09 224802 -c--a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-11-25 23:15:03 794399 -c--a-w- c:\windows\system32\dllcache\usr1806v.sys
2011-11-25 23:14:58 793598 -c--a-w- c:\windows\system32\dllcache\usr1806.sys
2011-11-25 23:14:53 794654 -c--a-w- c:\windows\system32\dllcache\usr1801.sys
2011-11-25 23:14:46 32384 -c--a-w- c:\windows\system32\dllcache\usb101et.sys
2011-11-25 23:14:42 76288 -c--a-w- c:\windows\system32\dllcache\uniime.dll
2011-11-25 23:14:31 94720 -c--a-w- c:\windows\system32\dllcache\umaxud32.dll
2011-11-25 23:14:20 28160 -c--a-w- c:\windows\system32\dllcache\umaxu40.dll
2011-11-25 23:14:09 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-11-25 23:13:58 69632 -c--a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-11-25 23:13:47 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-11-25 23:13:36 22912 -c--a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-11-25 23:13:25 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-11-25 23:13:14 47616 -c--a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-11-25 23:13:01 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2011-11-25 23:12:50 216064 -c--a-w- c:\windows\system32\dllcache\um34scan.dll
2011-11-25 23:12:39 36736 -c--a-w- c:\windows\system32\dllcache\ultra.sys
2011-11-25 23:12:22 11520 -c--a-w- c:\windows\system32\dllcache\twotrack.sys
2011-11-25 23:12:21 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2011-11-25 23:12:09 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-11-25 23:11:58 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2011-11-25 23:11:47 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-11-25 23:11:36 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll
2011-11-25 23:11:25 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-11-25 23:11:14 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll
2011-11-25 23:11:03 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys
2011-11-25 23:10:52 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll
2011-11-25 23:10:39 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll
2011-11-25 23:10:27 4992 -c--a-w- c:\windows\system32\dllcache\toside.sys
2011-11-25 23:10:22 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-11-25 23:10:17 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-11-25 23:10:12 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-11-25 23:10:11 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll
2011-11-25 23:10:06 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe
2011-11-25 23:10:06 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe
2011-11-25 23:10:06 123995 -c--a-w- c:\windows\system32\dllcache\tjisdn.sys
2011-11-25 23:10:05 185344 -c--a-w- c:\windows\system32\dllcache\thawbrkr.dll
2011-11-25 23:10:00 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-11-25 23:08:56 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll
2011-11-25 23:08:51 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys
2011-11-25 23:08:47 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-11-25 23:08:42 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-11-25 23:08:38 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-11-25 23:08:33 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-11-25 23:08:28 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-11-25 23:08:23 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-11-25 23:08:18 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-11-25 23:08:13 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys
2011-11-25 23:08:08 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2011-11-25 23:08:03 48736 -c--a-w- c:\windows\system32\dllcache\srwlnd5.sys
2011-11-25 23:07:57 99328 -c--a-w- c:\windows\system32\dllcache\srusd.dll
2011-11-25 23:07:57 101376 -c--a-w- c:\windows\system32\dllcache\srusbusd.dll
2011-11-25 23:07:51 24660 -c--a-w- c:\windows\system32\dllcache\spxupchk.dll
2011-11-25 23:07:38 61824 -c--a-w- c:\windows\system32\dllcache\speed.sys
2011-11-25 23:07:28 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll
2011-11-25 23:07:18 19072 -c--a-w- c:\windows\system32\dllcache\sparrow.sys
2011-11-25 23:07:08 37040 -c--a-w- c:\windows\system32\dllcache\sonypi.sys
2011-11-25 23:06:59 114688 -c--a-w- c:\windows\system32\dllcache\sonypi.dll
2011-11-25 23:06:49 20752 -c--a-w- c:\windows\system32\dllcache\sonync.sys
2011-11-25 23:06:39 9600 -c--a-w- c:\windows\system32\dllcache\sonymc.sys
2011-11-25 23:06:37 143422 -c--a-w- c:\windows\system32\dllcache\softkey.dll
2011-11-25 23:06:27 7168 -c--a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll
2011-11-25 23:06:27 7040 -c--a-w- c:\windows\system32\dllcache\snyaitmc.sys
2011-11-25 23:06:25 10240 -c--a-w- c:\windows\system32\dllcache\snmpstup.dll
2011-11-25 23:06:20 12288 -c--a-w- c:\windows\system32\dllcache\EXCH_smtpctrs.dll
2011-11-25 23:06:19 5632 -c--a-w- c:\windows\system32\dllcache\smimsgif.dll
2011-11-25 23:06:10 58368 -c--a-w- c:\windows\system32\dllcache\smiminib.sys
2011-11-25 23:06:09 5632 -c--a-w- c:\windows\system32\dllcache\smierrsy.dll
2011-11-25 23:06:08 15872 -c--a-w- c:\windows\system32\dllcache\smierrsm.dll
2011-11-25 23:05:59 147200 -c--a-w- c:\windows\system32\dllcache\smidispb.dll
2011-11-25 23:05:49 25034 -c--a-w- c:\windows\system32\dllcache\smcpwr2n.sys
2011-11-25 23:05:39 35913 -c--a-w- c:\windows\system32\dllcache\smcirda.sys
2011-11-25 23:05:29 24576 -c--a-w- c:\windows\system32\dllcache\smc8000n.sys
2011-11-25 23:05:20 6784 -c--a-w- c:\windows\system32\dllcache\smbhc.sys
2011-11-25 23:05:14 31744 -c--a-w- c:\windows\system32\dllcache\smb6w.dll
2011-11-25 23:05:05 45568 -c--a-w- c:\windows\system32\dllcache\smb3w.dll
2011-11-25 23:05:00 33792 -c--a-w- c:\windows\system32\dllcache\smb0w.dll
2011-11-25 23:05:00 31744 -c--a-w- c:\windows\system32\dllcache\sma3w.dll
2011-11-25 23:03:56 252032 -c--a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-11-25 23:03:51 18944 -c--a-w- c:\windows\system32\dllcache\simptcp.dll
2011-11-25 23:03:51 101760 -c--a-w- c:\windows\system32\dllcache\sis300ip.sys
2011-11-25 23:03:32 161568 -c--a-w- c:\windows\system32\dllcache\sgsmusb.sys
2011-11-25 23:03:28 18400 -c--a-w- c:\windows\system32\dllcache\sgsmld.sys
2011-11-25 23:03:24 98080 -c--a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2011-11-25 23:03:19 386560 -c--a-w- c:\windows\system32\dllcache\sgiul50.dll
2011-11-25 23:03:14 36480 -c--a-w- c:\windows\system32\dllcache\sfmanm.sys
2011-11-25 23:03:07 6784 -c--a-w- c:\windows\system32\dllcache\serscan.sys
2011-11-25 23:03:03 26112 -c--a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2011-11-25 23:03:03 17664 -c--a-w- c:\windows\system32\dllcache\sermouse.sys
2011-11-25 23:02:57 6912 -c--a-w- c:\windows\system32\dllcache\seaddsmc.sys
2011-11-25 23:02:47 57856 -c--a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-11-25 23:02:47 11648 -c--a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-11-25 23:02:41 17280 -c--a-w- c:\windows\system32\dllcache\scr111.sys
2011-11-25 23:02:36 16640 -c--a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-11-25 23:02:30 23936 -c--a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-11-25 23:02:26 23936 -c--a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-11-25 23:02:12 495616 -c--a-w- c:\windows\system32\dllcache\sblfx.dll
2011-11-25 23:02:04 75392 -c--a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-11-25 23:02:00 245632 -c--a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-11-25 23:00:49 19017 -c--a-w- c:\windows\system32\dllcache\rtl8029.sys
2011-11-25 23:00:44 30720 -c--a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-11-25 23:00:39 9216 -c--a-w- c:\windows\system32\dllcache\rsmgrstr.dll
2011-11-25 23:00:33 3840 -c--a-w- c:\windows\system32\dllcache\rpfun.sys
2011-11-25 23:00:24 37563 -c--a-w- c:\windows\system32\dllcache\rlnet5.sys
2011-11-25 23:00:18 86097 -c--a-w- c:\windows\system32\dllcache\reslog32.dll
2011-11-25 23:00:16 23040 -c--a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2011-11-25 23:00:15 14848 -c--a-w- c:\windows\system32\dllcache\register.exe
2011-11-25 23:00:14 13776 -c--a-w- c:\windows\system32\dllcache\recagent.sys
2011-11-25 23:00:00 19584 -c--a-w- c:\windows\system32\dllcache\rasirda.sys
2011-11-25 22:59:52 714762 -c--a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2011-11-25 22:59:48 899146 -c--a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2011-11-25 22:59:43 41472 -c--a-w- c:\windows\system32\dllcache\qvusd.dll
2011-11-25 22:59:36 9728 -c--a-w- c:\windows\system32\dllcache\query.exe
2011-11-25 22:59:36 3328 -c--a-w- c:\windows\system32\dllcache\qv2kux.sys
2011-11-25 22:59:36 16384 -c--a-w- c:\windows\system32\dllcache\quser.exe
2011-11-25 22:59:28 49024 -c--a-w- c:\windows\system32\dllcache\ql1280.sys
2011-11-25 22:59:23 40448 -c--a-w- c:\windows\system32\dllcache\ql1240.sys
2011-11-25 22:59:19 45312 -c--a-w- c:\windows\system32\dllcache\ql12160.sys
2011-11-25 22:59:14 33152 -c--a-w- c:\windows\system32\dllcache\ql10wnt.sys
2011-11-25 22:59:08 40320 -c--a-w- c:\windows\system32\dllcache\ql1080.sys
2011-11-25 22:58:59 130942 -c--a-w- c:\windows\system32\dllcache\ptserlv.sys
2011-11-25 22:58:54 112574 -c--a-w- c:\windows\system32\dllcache\ptserlp.sys
2011-11-25 22:58:44 128286 -c--a-w- c:\windows\system32\dllcache\ptserli.sys
2011-11-25 22:58:32 5632 -c--a-w- c:\windows\system32\dllcache\ptpusb.dll
2011-11-25 22:58:21 35328 -c--a-w- c:\windows\system32\dllcache\psisload.dll
2011-11-25 22:58:10 16128 -c--a-w- c:\windows\system32\dllcache\pscr.sys
2011-11-25 22:56:49 5504 -c--a-w- c:\windows\system32\dllcache\perc2hib.sys
2011-11-25 22:55:58 39424 -c--a-w- c:\windows\system32\dllcache\ovcoms.exe
2011-11-25 22:55:54 20480 -c--a-w- c:\windows\system32\dllcache\ovcomc.dll
2011-11-25 22:55:50 351616 -c--a-w- c:\windows\system32\dllcache\ovcodek2.sys
2011-11-25 22:55:46 116736 -c--a-w- c:\windows\system32\dllcache\ovcodec2.dll
2011-11-25 22:55:41 31872 -c--a-w- c:\windows\system32\dllcache\ovce.sys
2011-11-25 22:55:37 28032 -c--a-w- c:\windows\system32\dllcache\ovcd.sys
2011-11-25 22:55:33 48000 -c--a-w- c:\windows\system32\dllcache\ovcam2.sys
2011-11-25 22:55:29 25088 -c--a-w- c:\windows\system32\dllcache\ovca.sys
2011-11-25 22:55:25 54186 -c--a-w- c:\windows\system32\dllcache\otcsercb.sys
2011-11-25 22:55:20 43689 -c--a-w- c:\windows\system32\dllcache\otceth5.sys
2011-11-25 22:55:16 27209 -c--a-w- c:\windows\system32\dllcache\otc06x5.sys
2011-11-25 22:55:10 54528 -c--a-w- c:\windows\system32\dllcache\opl3sax.sys
2011-11-25 22:55:04 1897408 -c--a-w- c:\windows\system32\dllcache\nv4_mini.sys
2011-11-25 22:54:59 198144 -c--a-w- c:\windows\system32\dllcache\nv3.sys
2011-11-25 22:54:54 123776 -c--a-w- c:\windows\system32\dllcache\nv3.dll
2011-11-25 22:54:52 180360 -c--a-w- c:\windows\system32\dllcache\ntmtlfax.sys
2011-11-25 22:54:40 51552 -c--a-w- c:\windows\system32\dllcache\ntgrip.sys
2011-11-25 22:54:40 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2011-11-25 22:54:31 9344 -c--a-w- c:\windows\system32\dllcache\ntapm.sys
2011-11-25 22:54:22 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys
2011-11-25 22:54:08 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys
2011-11-25 22:52:58 52255 -c--a-w- c:\windows\system32\dllcache\n1000nt5.sys
2011-11-25 22:51:51 35200 -c--a-w- c:\windows\system32\dllcache\msgame.sys
2011-11-25 22:51:46 6016 -c--a-w- c:\windows\system32\dllcache\msfsio.sys
2011-11-25 22:51:35 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys
2011-11-25 22:51:28 16128 -c--a-w- c:\windows\system32\dllcache\modemcsa.sys
2011-11-25 22:51:22 6528 -c--a-w- c:\windows\system32\dllcache\miniqic.sys
2011-11-25 22:51:19 34304 -c--a-w- c:\windows\system32\dllcache\migisol.exe
2011-11-25 22:51:14 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys
2011-11-25 22:51:10 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys
2011-11-25 22:51:10 235648 -c--a-w- c:\windows\system32\dllcache\mgaud.dll
2011-11-25 22:51:09 92032 -c--a-w- c:\windows\system32\dllcache\mga.dll
2011-11-25 22:51:04 47616 -c--a-w- c:\windows\system32\dllcache\memgrp.dll
2011-11-25 22:51:00 8320 -c--a-w- c:\windows\system32\dllcache\memcard.sys
2011-11-25 22:49:57 20573 -c--a-w- c:\windows\system32\dllcache\lne100.sys
2011-11-25 22:49:54 25065 -c--a-w- c:\windows\system32\dllcache\lmndis3.sys
2011-11-25 22:49:50 15744 -c--a-w- c:\windows\system32\dllcache\lit220p.sys
2011-11-25 22:49:43 26442 -c--a-w- c:\windows\system32\dllcache\lanepic5.sys
2011-11-25 22:49:40 19016 -c--a-w- c:\windows\system32\dllcache\ktc111.sys
2011-11-25 22:49:34 70656 -c--a-w- c:\windows\system32\dllcache\korwbrkr.dll
2011-11-25 22:49:34 37376 -c--a-w- c:\windows\system32\dllcache\kousd.dll
2011-11-25 22:49:24 5632 -c--a-w- c:\windows\system32\dllcache\kbdusa.dll
2011-11-25 22:49:21 9216 -c--a-w- c:\windows\system32\dllcache\kbdnecat.dll
2011-11-25 22:49:21 7680 -c--a-w- c:\windows\system32\dllcache\kbdnecnt.dll
2011-11-25 22:49:20 7168 -c--a-w- c:\windows\system32\dllcache\kbdnec95.dll
2011-11-25 22:49:16 8192 -c--a-w- c:\windows\system32\dllcache\kbdkor.dll
2011-11-25 22:49:12 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2011-11-25 22:47:58 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
2011-11-25 22:46:58 10129408 -c--a-w- c:\windows\system32\dllcache\hwxkor.dll
2011-11-25 22:45:57 5760 -c--a-w- c:\windows\system32\dllcache\hpt4qic.sys
2011-11-25 22:44:58 8576 -c--a-w- c:\windows\system32\dllcache\hidgame.sys
2011-11-25 22:43:57 71680 -c--a-w- c:\windows\system32\dllcache\fnfilter.dll
2011-11-25 22:42:59 595647 -c--a-w- c:\windows\system32\dllcache\es56cvmp.sys
2011-11-25 22:41:58 26141 -c--a-w- c:\windows\system32\dllcache\el589nd5.sys
2011-11-25 22:40:59 41046 -c--a-w- c:\windows\system32\dllcache\digiisdn.dll
2011-11-25 22:39:58 14848 -c--a-w- c:\windows\system32\dllcache\cyclom-y.sys
2011-11-25 22:38:53 49182 -c--a-w- c:\windows\system32\dllcache\cem56n5.sys
2011-11-25 22:37:55 31529 -c--a-w- c:\windows\system32\dllcache\brzwlan.sys
2011-11-25 22:36:59 28672 -c--a-w- c:\windows\system32\dllcache\atinsnxx.sys
2011-11-25 22:35:59 96256 -c--a-w- c:\windows\system32\dllcache\ac97intc.sys
2011-11-25 22:35:57 231552 -c--a-w- c:\windows\system32\dllcache\ac97ali.sys
2011-11-25 22:35:56 462848 -c--a-w- c:\windows\system32\dllcache\a3dapi.dll
2011-11-25 22:35:56 23552 -c--a-w- c:\windows\system32\dllcache\abp480n5.sys
2011-11-25 22:35:55 98304 -c--a-w- c:\windows\system32\dllcache\a3d.dll
2011-11-25 22:35:54 38400 -c--a-w- c:\windows\system32\dllcache\8514a.dll
2011-11-25 22:35:51 689216 -c--a-w- c:\windows\system32\dllcache\3dfxvs.dll
2011-11-25 22:35:51 148352 -c--a-w- c:\windows\system32\dllcache\3dfxvsm.sys
2011-11-25 22:35:50 762780 -c--a-w- c:\windows\system32\dllcache\3cwmcru.sys
2011-11-25 22:35:49 11264 -c--a-w- c:\windows\system32\dllcache\1394vdbg.sys
2011-11-25 22:35:11 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
2011-11-24 23:04:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-11-24 21:21:36 -------- d-----w- c:\program files\CCleaner
2011-11-24 19:20:18 -------- d-----w- c:\program files\Yankee Clipper
.
==================== Find3M ====================
.
2011-12-12 08:03:39 0 ----a-w- c:\windows\system32\ATHPRXY(2).DLL
2011-11-25 00:52:12 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-11-25 00:52:11 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 16:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 16:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 16:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
.
============= FINISH: 20:05:52.64 ===============
Please see next post for other DDS log if needed. Thx.

malady · 2011/12/13

Other DDS Log Here

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 12/30/2005 7:41:12 PM
System Uptime: 12/13/2011 6:53:26 PM (2 hours ago)
.
Motherboard: TOSHIBA | | Satellite L25
Processor: Intel(R) Celeron(R) M processor 1.50GHz | U23 | 1496/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 37 GiB total, 1.04 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Device ID: ACPI\PNP0303\4&BF7C77B&0
Manufacturer: (Standard keyboards)
Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&BF7C77B&0
Service: i8042prt
.
Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: Synaptics PS/2 Port Pointing Device
Device ID: ACPI\PNP0F13\4&BF7C77B&0
Manufacturer: Synaptics
Name: Synaptics PS/2 Port Pointing Device
PNP Device ID: ACPI\PNP0F13\4&BF7C77B&0
Service: i8042prt
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8139/810x Family Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_FF311179&REV_10\4&13826118&0&10A4
Manufacturer: Realtek Semiconductor Corp.
Name: Realtek RTL8139/810x Family Fast Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_FF311179&REV_10\4&13826118&0&10A4
Service: RTL8023xp
.
==== System Restore Points ===================
.
RP23: 12/13/2011 3:36:11 PM - System Checkpoint
.
==== Installed Programs ======================
.
AC3Filter 1.63b
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0
Adobe Reader X (10.1.0)
Adobe Shockwave Player 11.5
AI RoboForm (All Users)
Atheros Client Utility
Atheros Wireless LAN MiniPCI card Driver
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Avira AntiVir Personal - Free Antivirus
Belarc Advisor 8.2
Bulk Rename Utility 2.7.1.2
CCleaner
CD/DVD Drive Acoustic Silencer
Conexant AC-Link Audio
Critical Update for Windows Media Player 11 (KB959772)
DriveImage XML (Private Edition)
ERUNT 1.1j
FileSeek 2.1.3
Google Chrome
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB981793)
InterVideo WinDVD for TOSHIBA
Java(TM) 6 Update 26
Logitech Vid HD
Logitech Webcam Software
Logitech Webcam Software Driver Package
Malwarebytes' Anti-Malware version 1.51.2.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft National Language Support Downlevel APIs
Microsoft Office Click-to-Run 2010
Microsoft Office Home and Student 2010 - English
Microsoft Office XP Professional
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB973685)
MSXML 6 Service Pack 2 (KB973686)
NirSoft ProduKey
OpenMG Limited Patch 4.6-06-09-04-01
OpenMG Secure Module 4.6.00
Picasa 3
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
REALTEK Gigabit and Fast Ethernet NIC Driver
RealUpgrade 1.1
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB2544521)
Security Update for Windows Internet Explorer 7 (KB2586448)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
SonicStage 4.1
Spybot - Search & Destroy
Synaptics Pointing Device Driver
TOSHIBA Assist
TOSHIBA ConfigFree
Toshiba Hotkey Utility
TOSHIBA PC Diagnostic Tool
Toshiba Q4 Retail Demo ScreenSaver
Toshiba Registration
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
Toshiba Tbiosdrv Driver
Toshiba Touchpad Utility
Toshiba Utility
TOSHIBA Zooming Utility
Touch and Launch
U3Launcher
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2641690)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Live Mail
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
Yahoo! Detect
Yahoo! Messenger
Yankee Clipper III
.
==== Event Viewer Messages From Past Week ========
.
12/13/2011 6:55:07 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BANTExt i8042prt StarOpen
12/13/2011 6:27:14 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
12/13/2011 2:41:59 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
12/13/2011 2:39:38 AM, error: Dhcp [1002] - The IP address lease 192.168.1.26 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/13/2011 2:31:38 PM, error: Service Control Manager [7023] - The Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: A device attached to the system is not functioning.
12/13/2011 2:26:17 PM, error: Service Control Manager [7001] - The Network DDE service depends on the Network DDE DSDM service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
12/13/2011 2:22:42 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
12/12/2011 9:02:19 PM, error: Dhcp [1002] - The IP address lease 192.168.1.25 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/12/2011 9:00:17 PM, error: Dhcp [1002] - The IP address lease 192.168.1.24 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/12/2011 5:51:32 PM, error: Removable Storage Service [111] - RSM could not load media in drive Drive 0 of library Kingston DT 101 G2 USB Device.
12/12/2011 5:46:59 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BANTExt i8042prt Imapi PxHelp20 StarOpen
12/12/2011 5:46:53 PM, error: Service Control Manager [7023] - The Human Interface Device Access service terminated with the following error: The specified module could not be found.
12/12/2011 5:46:53 PM, error: Service Control Manager [7000] - The TOSHIBA Network Device Usermode I/O Protocol service failed to start due to the following error: The system cannot find the file specified.
12/12/2011 5:46:53 PM, error: Service Control Manager [7000] - The TBiosDrv service failed to start due to the following error: The system cannot find the file specified.
12/12/2011 5:46:53 PM, error: Service Control Manager [7000] - The AEGIS Protocol (IEEE 802.1x) v3.2.0.3 service failed to start due to the following error: The system cannot find the file specified.
12/12/2011 5:44:46 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/12/2011 4:24:06 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
12/12/2011 4:22:55 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
12/12/2011 4:22:44 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments " " in order to run the server: {000C101C-0000-0000-C000-000000000046}
12/12/2011 4:22:14 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
12/12/2011 3:25:38 AM, error: Dhcp [1002] - The IP address lease 192.168.1.21 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/12/2011 2:44:02 AM, error: Dhcp [1002] - The IP address lease 192.168.1.18 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/12/2011 2:39:10 AM, error: Dhcp [1002] - The IP address lease 192.168.1.20 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/12/2011 12:50:00 PM, error: Dhcp [1002] - The IP address lease 192.168.1.23 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/12/2011 12:47:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avgio avipbb BANTExt Cdrom Fips i8042prt Imapi intelppm IPSec MRxSmb NetBIOS NetBT PxHelp20 RasAcd Rdbss ssmdrv StarOpen Tcpip
12/12/2011 12:47:36 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
12/12/2011 12:47:36 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/12/2011 12:47:36 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/12/2011 12:47:36 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
12/12/2011 12:33:00 AM, error: Removable Storage Service [111] - RSM could not load media in drive Drive 0 of library TOSHIBA TransMemory USB Device.
12/12/2011 12:12:24 PM, error: Dhcp [1002] - The IP address lease 192.168.1.22 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/12/2011 1:37:41 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio avipbb BANTExt Cdrom Fips i8042prt Imapi intelppm PxHelp20 ssmdrv StarOpen
12/12/2011 1:37:41 PM, error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.
12/12/2011 1:36:12 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
12/11/2011 5:19:39 PM, error: Dhcp [1002] - The IP address lease 192.168.1.17 for the Network Card with network address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================

broni · 2011/12/13

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================================================

Please keep all info in one topic.
This time I merged both your topics.

Download Bootkit Remover to your Desktop.

Unzip downloaded file to your Desktop.

Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).

It will show a Black screen with some data on it.

Right click on the screen and click Select All.

Press CTRL+C

Open a Notepad and press CTRL+V

Post the output back here.

========================================================

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

malady · 2011/12/14

Logs

"broni said: ↑

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.I
Click to expand...

Didn't see above.Ran Rkill twice.Logs enclosed.Thx.

Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
Boot sector MD5 is: 99ed1954602173ef14b43a708afaa354

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

Done;
Press any key to quit...
-------------------------
ComboFix 11-12-13.03 - Owner 12/14/2011 2:11.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.197 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\EventSystem.log
c:\windows\system32\1DED216279.dll
c:\windows\system32\ATHPRXY(2).DLL
.
.
((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))
.
.
2011-12-13 20:46 . 2011-12-13 20:46 319 ----a-w- C:\temp474.bat
2011-12-13 20:10 . 2011-12-13 20:53 181064 ----a-w- c:\windows\PSEXESVC.EXE
2011-12-13 20:09 . 2011-12-13 20:09 -------- d-----w- c:\program files\Windows Repair (All in One)Tweaking.com
2011-12-13 20:03 . 2011-12-13 20:04 -------- d-----w- c:\program files\Sysinternals 12-13-11
2011-12-13 20:02 . 2011-12-13 20:02 -------- d-----w- c:\program files\Sysinternals --
2011-12-13 18:27 . 2011-12-13 01:50 105814912 ----a-w- C:\setup_11.0.0.1245.x01_2011_12_13_04_23.exe
2011-12-13 18:27 . 2011-12-11 16:04 2429576 ----a-w- C:\MGtools.exe
2011-12-13 18:26 . 2011-12-13 18:26 -------- d-----w- C:\Super AntiSpyware 12-8-11
2011-12-13 18:25 . 2011-07-17 03:21 302592 ----a-w- C:\gmer.exe
2011-12-13 07:29 . 2008-04-14 00:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2011-12-13 07:29 . 2008-04-14 00:11 21504 ----a-w- c:\windows\system32\hidserv.dll
2011-12-13 06:33 . 2011-12-13 06:33 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-13 06:31 . 2011-12-13 17:48 -------- d-----w- c:\program files\Nirsoft Product Key 12-11-11
2011-12-13 06:31 . 2011-12-13 06:31 -------- d-----w- c:\program files\IVT Corporation
2011-12-12 23:47 . 2011-12-13 06:31 -------- d-----w- c:\program files\New Folder (2)(2)
2011-12-12 07:54 . 2011-12-13 06:32 -------- d-----w- c:\program files\Free Window Registry Repair
2011-12-12 07:10 . 2011-12-12 07:10 -------- d-----w- C:\TDSSKiller_Quarantine
2011-12-12 07:07 . 2011-12-13 06:33 -------- d-----w- c:\program files\Kapersky TDDs Killer 12-11-11
2011-12-12 03:22 . 2011-12-13 06:33 -------- d-----w- c:\program files\Java Ra 12-11-11
2011-12-12 01:09 . 2011-12-12 01:09 -------- d-----w- c:\documents and settings\All Users\Application Data\VirtualizedApplications
2011-12-11 22:52 . 2011-12-11 22:52 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
2011-12-11 22:52 . 2011-12-14 05:19 -------- d-----w- c:\documents and settings\Owner\Application Data\SoftGrid Client
2011-12-11 22:51 . 2011-12-14 05:20 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
2011-12-11 20:24 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2011-12-11 20:22 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2011-12-11 20:21 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2011-12-11 20:18 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-12-11 20:18 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-12-11 20:14 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-12-11 20:11 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2011-12-11 19:34 . 2011-12-13 06:31 -------- d-----w- c:\program files\NirSof ProduKey 12-11-11
2011-12-11 18:15 . 2011-12-11 18:15 -------- d-----w- c:\windows\system32\scripting
2011-12-11 18:15 . 2011-12-11 18:15 -------- d-----w- c:\windows\l2schemas
2011-12-11 18:15 . 2011-12-11 18:15 -------- d-----w- c:\windows\system32\en
2011-12-11 18:15 . 2011-12-11 18:15 -------- d-----w- c:\windows\system32\bits
2011-12-11 18:03 . 2011-12-11 18:03 -------- d-----w- c:\windows\EHome
2011-12-11 04:12 . 2011-12-11 04:32 -------- d-----w- c:\program files\DriveImage XML 12-10-11
2011-12-10 18:52 . 2011-12-10 18:52 -------- d-----w- c:\program files\Belarc
2011-12-10 05:21 . 2011-12-11 22:58 -------- d-----w- c:\documents and settings\Owner\Application Data\TP
2011-12-09 21:52 . 2011-12-09 21:52 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-12-09 21:50 . 2011-12-09 21:50 134464 ----a-w- c:\windows\system32\LnkProtect.dll
2011-12-09 21:48 . 2011-12-09 21:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2011-12-06 08:02 . 2011-12-06 08:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira
2011-12-05 20:43 . 2011-12-11 00:42 -------- d-----w- C:\Program Downloads 12-5-11
2011-12-04 21:00 . 2011-12-04 20:59 155232 ----a-w- C:\WntIpcfg_setup.exe
2011-12-03 03:13 . 2011-12-03 03:13 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-12-03 03:09 . 2011-12-03 03:09 -------- d-----w- c:\program files\Toolbar Cleaner
2011-12-03 03:06 . 2011-12-13 07:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2011-11-30 20:15 . 2011-11-30 20:16 -------- d-----w- C:\US Boot 11-30-11
2011-11-30 18:45 . 2011-11-30 18:56 -------- d-----w- c:\program files\Sardu Installer 11-30-11
2011-11-30 18:00 . 2011-11-30 18:00 -------- d-----w- c:\program files\Regpair Reg Fixer 11-30-11
2011-11-30 17:52 . 2011-11-30 17:54 -------- d-----w- c:\program files\SyncBack Freeware 11-30-11
2011-11-29 08:05 . 2011-11-29 08:06 -------- d-----w- c:\program files\ERUNT
2011-11-25 23:18 . 2001-08-18 03:36 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-11-25 23:18 . 2001-08-18 03:37 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-11-25 23:17 . 2001-08-18 03:37 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-11-25 23:17 . 2001-08-18 03:37 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2011-11-25 23:17 . 2001-08-17 17:11 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-11-25 23:17 . 2004-08-04 03:29 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-11-25 23:17 . 2004-08-04 03:29 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-11-25 23:17 . 2004-08-04 03:31 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-11-25 23:17 . 2001-08-17 17:12 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-11-25 23:17 . 2001-08-17 18:28 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2011-11-25 23:15 . 2008-04-14 00:11 86073 -c--a-w- c:\windows\system32\dllcache\voicesub.dll
2011-11-25 23:15 . 2001-08-17 18:28 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-11-25 23:15 . 2008-04-14 00:11 426041 -c--a-w- c:\windows\system32\dllcache\voicepad.dll
2011-11-25 23:15 . 2001-08-17 18:28 604253 -c--a-w- c:\windows\system32\dllcache\vmodem.sys
2011-11-25 23:15 . 2001-08-17 17:14 249402 -c--a-w- c:\windows\system32\dllcache\vinwm.sys
2011-11-25 23:15 . 2001-08-17 18:49 24576 -c--a-w- c:\windows\system32\dllcache\viairda.sys
2011-11-25 23:15 . 2001-08-17 18:28 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-11-25 23:15 . 2001-08-17 18:28 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys
2011-11-25 23:15 . 2001-08-17 18:28 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2011-11-25 23:15 . 2001-08-17 18:28 7556 -c--a-w- c:\windows\system32\dllcache\usroslba.sys
2011-11-25 23:15 . 2001-08-17 18:28 224802 -c--a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-11-25 23:15 . 2001-08-17 18:28 794399 -c--a-w- c:\windows\system32\dllcache\usr1806v.sys
2011-11-25 23:14 . 2001-08-17 18:28 793598 -c--a-w- c:\windows\system32\dllcache\usr1806.sys
2011-11-25 23:14 . 2001-08-17 18:28 794654 -c--a-w- c:\windows\system32\dllcache\usr1801.sys
2011-11-25 23:14 . 2004-08-04 03:31 32384 -c--a-w- c:\windows\system32\dllcache\usb101et.sys
2011-11-25 23:14 . 2008-04-14 00:11 76288 -c--a-w- c:\windows\system32\dllcache\uniime.dll
2011-11-25 23:14 . 2001-08-18 03:36 94720 -c--a-w- c:\windows\system32\dllcache\umaxud32.dll
2011-11-25 23:14 . 2001-08-18 03:36 28160 -c--a-w- c:\windows\system32\dllcache\umaxu40.dll
2011-11-25 23:14 . 2001-08-18 03:36 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-11-25 23:13 . 2001-08-18 03:36 69632 -c--a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-11-25 23:13 . 2001-08-18 03:36 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-11-25 23:13 . 2001-08-17 18:58 22912 -c--a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-11-25 23:13 . 2001-08-18 03:36 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-11-25 23:13 . 2001-08-18 03:36 47616 -c--a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-11-25 23:13 . 2001-08-18 03:36 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2011-11-25 23:12 . 2001-08-18 03:36 216064 -c--a-w- c:\windows\system32\dllcache\um34scan.dll
2011-11-25 23:12 . 2001-08-17 18:52 36736 -c--a-w- c:\windows\system32\dllcache\ultra.sys
2011-11-25 23:12 . 2001-08-17 18:48 11520 -c--a-w- c:\windows\system32\dllcache\twotrack.sys
2011-11-25 23:12 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2011-11-25 23:12 . 2001-08-17 17:51 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-11-25 23:11 . 2001-08-18 03:36 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2011-11-25 23:11 . 2001-08-17 17:51 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-11-25 23:11 . 2001-08-17 19:56 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll
2011-11-25 23:11 . 2001-08-17 17:51 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-11-25 23:11 . 2001-08-17 19:56 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll
2011-11-25 23:11 . 2001-08-17 17:12 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys
2011-11-25 23:10 . 2001-08-18 03:35 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll
2011-11-25 23:10 . 2001-08-18 03:36 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll
2011-11-25 23:10 . 2001-08-17 18:51 4992 -c--a-w- c:\windows\system32\dllcache\toside.sys
2011-11-25 23:10 . 2001-08-17 19:02 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-11-25 23:10 . 2001-08-17 19:01 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-11-25 23:10 . 2001-08-17 17:10 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-11-25 23:10 . 2008-04-14 00:10 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll
2011-11-25 23:10 . 2004-08-04 12:00 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe
2011-11-25 23:10 . 2004-08-04 12:00 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe
2011-11-25 23:10 . 2001-08-17 17:14 123995 -c--a-w- c:\windows\system32\dllcache\tjisdn.sys
2011-11-25 23:10 . 2004-08-04 12:00 185344 -c--a-w- c:\windows\system32\dllcache\thawbrkr.dll
2011-11-25 23:10 . 2001-08-17 17:51 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-11-25 23:08 . 2001-08-18 03:36 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll
2011-11-25 23:08 . 2001-08-17 18:50 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys
2011-11-25 23:08 . 2001-08-17 19:02 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-11-25 23:08 . 2001-08-18 03:36 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-11-25 23:08 . 2001-08-18 03:36 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-11-25 23:08 . 2001-08-18 03:36 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-11-25 23:08 . 2001-08-18 03:36 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-11-25 23:08 . 2001-08-18 03:36 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-11-25 23:08 . 2001-08-18 03:36 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-11-25 23:08 . 2001-08-17 17:18 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys
2011-11-25 23:08 . 2001-08-17 18:51 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2011-11-25 23:08 . 2001-08-17 17:11 48736 -c--a-w- c:\windows\system32\dllcache\srwlnd5.sys
2011-11-25 23:07 . 2004-08-04 12:00 101376 -c--a-w- c:\windows\system32\dllcache\srusbusd.dll
2011-11-25 23:07 . 2001-08-18 03:36 99328 -c--a-w- c:\windows\system32\dllcache\srusd.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 00:52 . 2003-02-22 03:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-11-25 00:52 . 2003-03-19 19:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-10-10 14:22 . 2005-08-09 21:16 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2005-08-09 20:37 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 16:41 . 2008-07-29 23:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 16:41 . 2005-08-09 20:38 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 16:41 . 2005-08-09 20:38 20480 ----a-w- c:\windows\system32\oleaccrc.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm "= "c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-12-15 160592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"SynTPLpr "= "c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 98394]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 688218]
"Malwarebytes' Anti-Malware "= "c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm "= "c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-12-15 160592]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
Yankee Clipper III.lnk - c:\program files\Yankee Clipper\YankClip.exe [2011-11-24 1368064]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Retrospect Helper "=2 (0x2)
"nmservice "=2 (0x2)
"nmraapache "=3 (0x3)
"gupdate1c9f536c5212976 "=2 (0x2)
"DVD-RAM_Service "=2 (0x2)
"RetroWDSvc "=2 (0x2)
"RetroLauncher "=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe "=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe "= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Toshiba\\ConfigFree\\CFXFER.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil_.exe "=
"c:\\Program Files\\Logitech\\Vid HD\\Vid.exe "=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP "= 1700:TCP:MioNet Remote Drive Access
"1641:TCP "= 1641:TCP:MioNet Remote Drive Verification
"1723:TCP "= 1723:TCPxpsp2res.dll,-22015
"1701:UDP "= 1701:UDPxpsp2res.dll,-22016
"500:UDP "= 500:UDPxpsp2res.dll,-22017
.
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/5/2011 9:27 AM 136360]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/1/2011 6:26 PM 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/1/2011 6:26 PM 22216]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys --> c:\windows\system32\Drivers\ANDROIDUSB.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE [12/13/2011 3:10 PM 181064]
S3 Wdm1;USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc.sys [2/8/2007 4:38 AM 15576]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com/
mSearch Bar = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchURL = hxxp://www.google.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Display All Images with Full Quality - "c:\program files\NetZero\qsacc\appres.dll/228 "
IE: Display Image with Full Quality - "c:\program files\NetZero\qsacc\appres.dll/227 "
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: DhcpNameServer = 192.168.1.1
DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - hxxp://www.sidestep.com/get/k00722/sb02d.cab
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll
Toolbar-{6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-14 02:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(500)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2011-12-14 02:37:25
ComboFix-quarantined-files.txt 2011-12-14 07:37
.
Pre-Run: 2,148,442,112 bytes free
Post-Run: 2,624,905,216 bytes free
.
- - End Of File - - 58EEFB8738DFBA61241143CDACCC8436
-----------------------------------------------
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 12/14/2011 at 13:08:32.
Operating System: Microsoft Windows XP
Processes terminated by Rkill or while it was running:
Rkill completed on 12/14/2011 at 13:08:42

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 12/14/2011 at 13:13:01.
Operating System: Microsoft Windows XP
Processes terminated by Rkill or while it was running:
Rkill completed on 12/14/2011 at 13:13:07.

broni · 2011/12/14

How is computer doing now?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

malady · 2011/12/14

Hey that virus created drive Q is gone. Thx. Noticed in my msconfig that the highlighted boot.ini is cmd cons...recovery console type thing. Didn't know if this was correct.Running OTL. Thx.

broni · 2011/12/14

Noticed in my msconfig that the highlighted boot.ini is cmd cons...recovery console type thing
Click to expand...

Didn't understand a thing...LOL

malady · 2011/12/14

OTL Log

"The text that you have entered is too long (99464 characters). Please shorten it to 55000 characters long." Will take several posts.Thx.

OTL logfile created on: 12/14/2011 6:28:39 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.17 Mb Total Physical Memory | 219.62 Mb Available Physical Memory | 49.22% Memory free
1.03 Gb Paging File | 0.61 Gb Available in Paging File | 59.53% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 2.39 Gb Free Space | 6.41% Space Free | Partition Type: NTFS
Drive E: | 7.26 Gb Total Space | 2.19 Gb Free Space | 30.15% Space Free | Partition Type: FAT32
Drive F: | 3.65 Gb Total Space | 0.56 Gb Free Space | 15.39% Space Free | Partition Type: FAT32

Computer Name: T | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/14 18:25:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/08/05 18:15:26 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/04/21 06:54:05 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/04/21 06:53:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/21 06:53:33 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/01/17 18:38:38 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2004/09/29 12:14:36 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe

========== Modules (No Company Name) ==========

MOD - [2011/07/20 15:40:24 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/12/13 15:53:48 | 000,181,064 | ---- | M] (Sysinternals) [On_Demand | Stopped] -- C:\WINDOWS\PSEXESVC.EXE -- (PSEXESVC)
SRV - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/08/05 18:15:26 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/21 06:53:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/10/07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2006/09/05 03:25:10 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- (SSScsiSV)
SRV - [2006/08/11 01:42:38 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV)
SRV - [2006/08/11 01:31:18 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2006/08/11 01:20:48 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2005/07/12 19:14:42 | 000,040,960 | ---- | M] () [Auto | Stopped] -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe -- (Swupdtmr)
SRV - [2005/07/08 03:13:14 | 000,036,864 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\acs.exe -- (ACS)
SRV - [2005/01/17 18:38:38 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2004/09/29 12:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Unknown | Running] -- -- (SASKUTIL)
DRV - [2011/08/31 16:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/08/05 18:15:27 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/08/05 18:15:27 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/06/17 14:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/17 14:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/10/07 03:49:50 | 000,023,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2009/10/07 03:49:38 | 006,756,632 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam E3500(UVC)
DRV - [2009/10/07 03:47:54 | 000,266,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS)
DRV - [2009/10/07 00:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/04/12 16:47:24 | 000,000,206 | ---- | M] () [File_System | System | Stopped] -- C:\Program Files\Samsung\Samsung PC Studio 3\StarOpen.reg -- (StarOpen)
DRV - [2008/04/13 13:56:49 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2006/03/22 17:27:10 | 000,488,992 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SHP5211.sys -- (AR5211)
DRV - [2005/06/29 01:01:58 | 001,241,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/06/17 17:17:48 | 000,352,000 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6hal.sys -- (CAMCHALA)
DRV - [2005/06/17 17:17:00 | 000,038,144 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6aud.sys -- (CAMCAUD)
DRV - [2005/06/10 23:42:00 | 000,005,504 | ---- | M] (Quanta Computer Corp) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BoiHwSetup.sys -- (BoiHwsetup)
DRV - [2004/12/02 18:36:08 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004/08/03 17:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2003/01/10 16:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2001/01/08 04:53:24 | 000,015,576 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbbc.sys -- (Wdm1)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html

IE - HKU\.DEFAULT\..\URLSearchHook: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart

IE - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: MapShare-status@tomtom.com:1.5.1
FF - prefs.js..extensions.enabledItems: baseTheme@tomtom.com:1.0.1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picassa 3.8 5-6-11\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.0.198: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

[2009/03/12 18:53:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2009/03/12 18:53:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions\home2@tomtom.com
File not found (No name found) -- C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\MAPSHARE-STATUS@TOMTOM.COM

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Chrome NaCl (Enabled) = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.57\npGoogleUpdate3.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picassa 3.8 5-6-11\Picasa3\npPicasa3.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: WOT = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.2.9_0\
CHR - Extension: Speedtest.net = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cgbncpmdcgnaoplhdfakiogmpejpogmj\0.0.0.4_0\
CHR - Extension: Read Later Fast = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\decdfngdidijkdjgbknlnepdljfaepji\1.3.4_0\
CHR - Extension: Hipmunk = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jeabbdefhlelidlhahnfpbllaomkioke\1.2_0\
CHR - Extension: InvisibleHand = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lghjfnfolmcikomdjmoiemllfnlmmoko\3.3.14_0\
CHR - Extension: Google Mail Checker = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\3.2_0\
CHR - Extension: Quick Note = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.2.9_0\
CHR - Extension: CanIStream.It = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nefjaladmbgpekhpikihnnchgbdfojpk\3_0\

O1 HOSTS File: ([2011/12/14 02:29:04 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {52706EF7-D7A2-49AD-A615-E903858CF284} - No CLSID value found.
O2 - BHO: (Reg Error: Value error.) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O3 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\..\Toolbar\ShellBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O3 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKU\.DEFAULT..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-18..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Yankee Clipper III.lnk = C:\Program Files\Yankee Clipper\YankClip.exe (inteleXual.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Display All Images with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/228" File not found
O8 - Extra context menu item: Display Image with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/227" File not found
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html File not found
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O15 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab (Disney Online Games ActiveX Control)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} http://www.sidestep.com/get/k00722/sb02d.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E6639D27-0BD0-43DD-8B8A-FE8D2DB86ABF}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/09 16:19:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/12/02 22:44:46 | 000,000,000 | ---D | M] - E:\Autoruns by sysinternals 11-20-11 -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/14 18:25:25 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/12/14 16:17:55 | 000,000,000 | ---D | C] -- C:\Program Files\Super Anti Spyware 12-14-11
[2011/12/14 14:37:58 | 013,521,328 | ---- | C] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Owner\Desktop\SUPERAntiSpyware.exe
[2011/12/14 14:29:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Major Geels-Toshiba 12-14-11
[2011/12/14 14:27:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\JavaRa
[2011/12/14 02:37:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/12/14 02:04:12 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/12/14 02:04:12 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/12/14 02:04:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/12/14 02:04:12 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/12/14 02:03:49 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/12/14 01:56:58 | 004,339,049 | R--- | C] (Swearware) -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/12/14 01:49:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\bootkit_remover
[2011/12/14 00:40:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\WindowsBBS
[2011/12/13 19:19:09 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/12/13 19:18:36 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/12/13 15:10:03 | 000,181,064 | ---- | C] (Sysinternals) -- C:\WINDOWS\PSEXESVC.EXE
[2011/12/13 15:09:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2011/12/13 15:09:09 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Repair (All in One)Tweaking.com
[2011/12/13 15:03:10 | 000,000,000 | ---D | C] -- C:\Program Files\Sysinternals 12-13-11
[2011/12/13 15:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\Sysinternals --
[2011/12/13 13:26:47 | 000,000,000 | ---D | C] -- C:\Super AntiSpyware 12-8-11
[2011/12/13 01:33:01 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent
[2011/12/13 01:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Nirsoft Product Key 12-11-11
[2011/12/13 01:31:20 | 000,000,000 | ---D | C] -- C:\Program Files\IVT Corporation
[2011/12/13 01:31:16 | 000,000,000 | ---D | C] -- C:\Program Files\AOL
[2011/12/12 18:47:10 | 000,000,000 | ---D | C] -- C:\Program Files\New Folder (2)(2)
[2011/12/12 02:54:13 | 000,000,000 | ---D | C] -- C:\Program Files\Free Window Registry Repair
[2011/12/12 02:10:59 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011/12/12 02:07:12 | 000,000,000 | ---D | C] -- C:\Program Files\Kapersky TDDs Killer 12-11-11
[2011/12/12 00:31:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Repair 12-11-11
[2011/12/11 22:22:12 | 000,000,000 | ---D | C] -- C:\Program Files\Java Ra 12-11-11
[2011/12/11 20:09:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2011/12/11 18:30:20 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Owner\Desktop\.picasaoriginals
[2011/12/11 17:52:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\SoftGrid Client
[2011/12/11 17:52:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\SoftGrid Client
[2011/12/11 17:48:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2011/12/11 14:34:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Start Menu\Programs\NirSoft ProduKey 12-11-11
[2011/12/11 14:34:58 | 000,000,000 | ---D | C] -- C:\Program Files\NirSof ProduKey 12-11-11
[2011/12/11 13:47:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2011/12/11 13:38:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2011/12/11 13:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger
[2011/12/11 13:15:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting
[2011/12/11 13:15:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas
[2011/12/11 13:15:39 | 000,000,000 | ---D | C] -- C:\Program Files\msn
[2011/12/11 13:15:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en
[2011/12/11 13:15:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits
[2011/12/11 13:03:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\$NtServicePackUninstall$
[2011/12/11 13:03:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\EHome
[2011/12/10 23:12:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\DriveImage XML
[2011/12/10 23:12:24 | 000,000,000 | ---D | C] -- C:\Program Files\DriveImage XML 12-10-11
[2011/12/10 13:52:58 | 000,000,000 | ---D | C] -- C:\Program Files\Belarc
[2011/12/10 00:21:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\TP
[2011/12/09 16:50:11 | 000,134,464 | ---- | C] (SurfRight B.V.) -- C:\WINDOWS\System32\LnkProtect.dll
[2011/12/09 16:48:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/12/06 21:04:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Super AntiMalware
[2011/12/05 15:43:52 | 000,000,000 | ---D | C] -- C:\Program Downloads 12-5-11
[2011/12/05 13:12:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Reg Backup 12-5-11
[2011/12/04 16:43:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Sony Repair 12-4-11
[2011/12/02 22:13:27 | 000,101,720 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/12/02 22:09:42 | 000,000,000 | ---D | C] -- C:\Program Files\Toolbar Cleaner
[2011/12/02 22:06:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2011/12/01 12:44:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Kingston USB
[2011/11/30 15:15:40 | 000,000,000 | ---D | C] -- C:\US Boot 11-30-11
[2011/11/30 13:45:43 | 000,000,000 | ---D | C] -- C:\Program Files\Sardu Installer 11-30-11
[2011/11/30 13:00:08 | 000,000,000 | ---D | C] -- C:\Program Files\Regpair Reg Fixer 11-30-11
[2011/11/30 12:52:57 | 000,000,000 | ---D | C] -- C:\Program Files\SyncBack Freeware 11-30-11
[2011/11/29 03:05:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/11/29 03:05:35 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011/11/25 18:18:24 | 000,023,040 | ---- | C] (Xerox Corporation) -- C:\WINDOWS\System32\dllcache\xrxwbtmp.dll
[2011/11/25 18:17:47 | 000,099,865 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\xlog.exe
[2011/11/25 18:17:41 | 000,016,970 | ---- | C] (US Robotics MCD (Megahertz)) -- C:\WINDOWS\System32\dllcache\xem336n5.sys
[2011/11/25 18:17:21 | 000,154,624 | ---- | C] (Lucent Technologies) -- C:\WINDOWS\System32\dllcache\wlluc48.sys
[2011/11/25 18:17:15 | 000,034,890 | ---- | C] (Raytheon Corp.) -- C:\WINDOWS\System32\dllcache\wlandrv2.sys
[2011/11/25 18:17:05 | 000,771,581 | ---- | C] (Rockwell) -- C:\WINDOWS\System32\dllcache\winacisa.sys
[2011/11/25 18:16:38 | 000,035,871 | ---- | C] (Winbond Electronics Corp.) -- C:\WINDOWS\System32\dllcache\wbfirdma.sys
[2011/11/25 18:16:18 | 000,016,925 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w940nd.sys
[2011/11/25 18:16:13 | 000,019,016 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w926nd.sys
[2011/11/25 18:16:08 | 000,019,528 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w840nd.sys
[2011/11/25 18:16:02 | 000,064,605 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vvoice.sys
[2011/11/25 18:15:57 | 000,397,502 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vpctcom.sys
[2011/11/25 18:15:51 | 000,604,253 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\vmodem.sys
[2011/11/25 18:15:46 | 000,249,402 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\vinwm.sys
[2011/11/25 18:15:25 | 000,765,884 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usrti.sys
[2011/11/25 18:15:03 | 000,794,399 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806v.sys
[2011/11/25 18:14:58 | 000,793,598 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806.sys
[2011/11/25 18:14:53 | 000,794,654 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1801.sys
[2011/11/25 18:14:46 | 000,032,384 | ---- | C] (KLSI USA, Inc.) -- C:\WINDOWS\System32\dllcache\usb101et.sys
[2011/11/25 18:13:47 | 000,050,688 | ---- | C] (UMAX DATA SYSTEMS INC.) -- C:\WINDOWS\System32\dllcache\umaxscan.dll
[2011/11/25 18:13:01 | 000,211,968 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um54scan.dll
[2011/11/25 18:12:50 | 000,216,064 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um34scan.dll
[2011/11/25 18:12:09 | 000,166,784 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxpm.sys
[2011/11/25 18:11:58 | 000,525,568 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxp.dll
[2011/11/25 18:11:47 | 000,159,232 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkbm.sys
[2011/11/25 18:11:36 | 000,440,576 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkb.dll
[2011/11/25 18:11:25 | 000,222,336 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3dm.sys
[2011/11/25 18:11:14 | 000,315,520 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3d.dll
[2011/11/25 18:10:06 | 000,123,995 | ---- | C] (Tiger Jet Network) -- C:\WINDOWS\System32\dllcache\tjisdn.sys
[2011/11/25 18:10:00 | 000,138,528 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiulnt5.sys
[2011/11/25 18:09:55 | 000,081,408 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiul50.dll
[2011/11/25 18:09:48 | 000,017,129 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdkcd31.sys
[2011/11/25 18:09:43 | 000,037,961 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdk100b.sys
[2011/11/25 18:09:26 | 000,036,640 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\t2r4mini.sys
[2011/11/25 18:09:22 | 000,172,768 | ---- | C] (Number Nine Visual Technology) -- C:\WINDOWS\System32\dllcache\t2r4disp.dll
[2011/11/25 18:08:23 | 000,155,648 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnprop.dll
[2011/11/25 18:08:18 | 000,053,248 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlncoin.dll
[2011/11/25 18:08:13 | 000,285,760 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnata.sys
[2011/11/25 18:08:08 | 000,016,896 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\stcusb.sys
[2011/11/25 18:08:03 | 000,048,736 | ---- | C] (3Com) -- C:\WINDOWS\System32\dllcache\srwlnd5.sys
[2011/11/25 18:07:18 | 000,019,072 | ---- | C] (Adaptec, Inc.) -- C:\WINDOWS\System32\dllcache\sparrow.sys
[2011/11/25 18:06:10 | 000,058,368 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smiminib.sys
[2011/11/25 18:05:59 | 000,147,200 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smidispb.dll
[2011/11/25 18:05:49 | 000,025,034 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smcpwr2n.sys
[2011/11/25 18:05:39 | 000,035,913 | ---- | C] (SMC) -- C:\WINDOWS\System32\dllcache\smcirda.sys
[2011/11/25 18:05:29 | 000,024,576 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smc8000n.sys
[2011/11/25 18:04:40 | 000,063,547 | ---- | C] (Symbol Technologies) -- C:\WINDOWS\System32\dllcache\sla30nd5.sys
[2011/11/25 18:04:35 | 000,091,294 | ---- | C] (SysKonnect, a business unit of Schneider & Koch & Co. Datensysteme GmbH.) -- C:\WINDOWS\System32\dllcache\skfpwin.sys
[2011/11/25 18:04:30 | 000,094,698 | ---- | C] (SysKonnect GmbH.) -- C:\WINDOWS\System32\dllcache\sk98xwin.sys
[2011/11/25 18:04:20 | 000,032,768 | ---- | C] (SiS Corporation) -- C:\WINDOWS\System32\dllcache\sisnic.sys
[2011/11/25 18:03:32 | 000,161,568 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmusb.sys
[2011/11/25 18:03:28 | 000,018,400 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmld.sys
[2011/11/25 18:03:24 | 000,098,080 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiulnt5.sys
[2011/11/25 18:03:19 | 000,386,560 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiul50.dll
[2011/11/25 18:02:41 | 000,017,280 | ---- | C] (SCM Microsystems) -- C:\WINDOWS\System32\dllcache\scr111.sys
[2011/11/25 18:02:30 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmusbm.sys
[2011/11/25 18:02:26 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmn50m.sys
[2011/11/25 18:01:55 | 000,077,824 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4m.sys
[2011/11/25 18:01:51 | 000,198,400 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4.dll
[2011/11/25 18:01:46 | 000,061,504 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3dm.sys
[2011/11/25 18:01:42 | 000,179,264 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3d.dll
[2011/11/25 18:01:38 | 000,210,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mvirge.dll
[2011/11/25 18:01:33 | 000,062,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mtrio.dll
[2011/11/25 18:01:28 | 000,041,216 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.sys
[2011/11/25 18:01:24 | 000,182,272 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.dll
[2011/11/25 18:01:19 | 000,166,720 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3m.sys
[2011/11/25 18:01:09 | 000,082,432 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia450.dll
[2011/11/25 18:01:04 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia430.dll
[2011/11/25 18:01:04 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2011/11/25 18:01:03 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2011/11/25 18:00:39 | 000,009,216 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\rsmgrstr.dll
[2011/11/25 18:00:24 | 000,037,563 | ---- | C] (RadioLAN) -- C:\WINDOWS\System32\dllcache\rlnet5.sys
[2011/11/25 18:00:18 | 000,086,097 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\reslog32.dll
[2011/11/25 17:59:52 | 000,714,762 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdmkxx.sys
[2011/11/25 17:59:48 | 000,899,146 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdkxga.sys
[2011/11/25 17:58:59 | 000,130,942 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlv.sys
[2011/11/25 17:58:54 | 000,112,574 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlp.sys
[2011/11/25 17:58:44 | 000,128,286 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserli.sys
[2011/11/25 17:58:10 | 000,016,128 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\pscr.sys
[2011/11/25 17:56:39 | 000,086,016 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\pctspk.exe
[2011/11/25 17:56:22 | 000,029,502 | ---- | C] (Marconi Communications, Inc.) -- C:\WINDOWS\System32\dllcache\pca200e.sys
[2011/11/25 17:56:22 | 000,026,153 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pcmlm56.sys
[2011/11/25 17:56:17 | 000,030,495 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pc100nds.sys
[2011/11/25 17:55:25 | 000,054,186 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otcsercb.sys
[2011/11/25 17:55:20 | 000,043,689 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otceth5.sys
[2011/11/25 17:55:16 | 000,027,209 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otc06x5.sys
[2011/11/25 17:55:10 | 000,054,528 | ---- | C] (Yamaha Corp.) -- C:\WINDOWS\System32\dllcache\opl3sax.sys
[2011/11/25 17:54:40 | 000,051,552 | ---- | C] (Kensington Technology Group) -- C:\WINDOWS\System32\dllcache\ntgrip.sys
[2011/11/25 17:54:08 | 000,087,040 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm6wdm.sys
[2011/11/25 17:53:59 | 000,126,080 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm5a2wdm.sys
[2011/11/25 17:53:52 | 000,132,695 | ---- | C] (802.11b) -- C:\WINDOWS\System32\dllcache\netwlan5.sys
[2011/11/25 17:53:41 | 000,039,264 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.sys
[2011/11/25 17:53:37 | 000,060,480 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.dll
[2011/11/25 17:53:26 | 000,091,488 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3disp.dll
[2011/11/25 17:53:22 | 000,027,936 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3d.sys
[2011/11/25 17:53:18 | 000,033,088 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.sys
[2011/11/25 17:53:14 | 000,059,104 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.dll
[2011/11/25 17:53:10 | 000,013,664 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.sys
[2011/11/25 17:53:06 | 000,035,392 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.dll
[2011/11/25 17:52:54 | 000,075,520 | ---- | C] (Moxa Technologies Co., Ltd.) -- C:\WINDOWS\System32\dllcache\mxport.sys
[2011/11/25 17:52:50 | 000,007,168 | ---- | C] (Moxa Technologies Co., Ltd) -- C:\WINDOWS\System32\dllcache\mxport.dll
[2011/11/25 17:52:46 | 000,019,968 | ---- | C] (Macronix International Co., Ltd. ) -- C:\WINDOWS\System32

malady · 2011/12/14

[2011/11/25 17:37:51 | 000,005,120 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\System32\dllcache\brscnrsm.dll
[2011/11/25 17:37:50 | 000,039,552 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparwdm.sys
[2011/11/25 17:37:49 | 000,003,168 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparimg.sys
[2011/11/25 17:37:47 | 000,041,472 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfusb.dll
[2011/11/25 17:37:47 | 000,032,256 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfrsmg.exe
[2011/11/25 17:37:46 | 000,029,696 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmflpt.dll
[2011/11/25 17:37:44 | 000,015,360 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfbidi.dll
[2011/11/25 17:37:44 | 000,003,968 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltup.sys
[2011/11/25 17:37:43 | 000,012,160 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2011/11/25 17:37:42 | 000,002,944 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brfilt.sys
[2011/11/25 17:37:41 | 000,012,800 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brevif.dll
[2011/11/25 17:37:40 | 000,019,456 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brbidiif.dll
[2011/11/25 17:37:40 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brcoinst.dll
[2011/11/25 17:37:35 | 000,871,388 | ---- | C] (BCM) -- C:\WINDOWS\System32\dllcache\bcmdm.sys
[2011/11/25 17:37:31 | 000,342,336 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.dll
[2011/11/25 17:37:31 | 000,036,128 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.sys
[2011/11/25 17:37:29 | 000,089,952 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\b1cbase.sys
[2011/11/25 17:37:29 | 000,036,992 | ---- | C] (Aztech Systems Ltd) -- C:\WINDOWS\System32\dllcache\aztw2320.sys
[2011/11/25 17:37:28 | 000,037,568 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmwan.sys
[2011/11/25 17:37:27 | 000,144,384 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmenum.dll
[2011/11/25 17:37:27 | 000,087,552 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2011/11/25 17:36:37 | 000,097,354 | ---- | C] (Bay Networks, Inc.) -- C:\WINDOWS\System32\dllcache\aspndis3.sys
[2011/11/25 17:36:30 | 000,016,969 | ---- | C] (AmbiCom, Inc.) -- C:\WINDOWS\System32\dllcache\amb8002.sys
[2011/11/25 17:36:07 | 000,046,112 | ---- | C] (Adaptec, Inc ) -- C:\WINDOWS\System32\dllcache\adptsf50.sys
[2011/11/25 17:36:06 | 000,010,880 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\admjoy.sys
[2011/11/25 17:36:05 | 000,747,392 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8830.sys
[2011/11/25 17:36:05 | 000,553,984 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8820.sys
[2011/11/25 17:36:04 | 000,584,448 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8810.sys
[2011/11/25 17:36:02 | 000,061,440 | ---- | C] (Color Flatbed Scanner) -- C:\WINDOWS\System32\dllcache\acerscad.dll
[2011/11/25 17:35:56 | 000,462,848 | ---- | C] (Aureal Inc.) -- C:\WINDOWS\System32\dllcache\a3dapi.dll
[2011/11/25 17:35:55 | 000,098,304 | ---- | C] (Aureal Semiconductor) -- C:\WINDOWS\System32\dllcache\a3d.dll
[2011/11/25 17:35:51 | 000,689,216 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2011/11/25 17:35:51 | 000,148,352 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2011/11/25 17:35:50 | 000,762,780 | ---- | C] (3Com, Inc.) -- C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2011/11/24 18:04:57 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/11/24 16:21:36 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/11/24 16:19:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Downloads
[2011/11/24 14:20:18 | 000,000,000 | ---D | C] -- C:\Program Files\Yankee Clipper
[2011/11/24 13:00:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Docs 11-24-11
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/14 18:25:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/12/14 14:39:45 | 002,441,780 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\MGtools.exe
[2011/12/14 14:38:53 | 000,465,298 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\RootRepeal.rar
[2011/12/14 14:37:58 | 013,521,328 | ---- | M] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Owner\Desktop\SUPERAntiSpyware.exe
[2011/12/14 14:26:28 | 000,160,350 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\JavaRa.zip
[2011/12/14 14:06:04 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Owner\defogger_reenable
[2011/12/14 14:05:50 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Defogger.exe
[2011/12/14 14:04:51 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/12/14 13:11:02 | 001,008,120 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/12/14 13:07:05 | 001,008,120 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\rkill.com
[2011/12/14 02:29:04 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/14 01:57:11 | 004,339,049 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/12/14 01:49:19 | 000,044,607 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\bootkit_remover.zip
[2011/12/14 00:34:15 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/14 00:25:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/14 00:25:44 | 467,914,752 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/14 00:20:54 | 000,446,842 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/12/14 00:20:54 | 000,074,344 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/12/13 19:20:20 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/12/13 19:19:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/12/13 15:53:48 | 000,181,064 | ---- | M] (Sysinternals) -- C:\WINDOWS\PSEXESVC.EXE
[2011/12/13 15:46:18 | 000,000,319 | ---- | M] () -- C:\temp474.bat
[2011/12/13 15:09:10 | 000,001,861 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Tweaking.com - Windows Repair (All in One).lnk
[2011/12/12 20:50:06 | 105,814,912 | ---- | M] () -- C:\setup_11.0.0.1245.x01_2011_12_13_04_23.exe
[2011/12/11 17:18:47 | 000,162,728 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/11 13:52:52 | 000,001,606 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\System Restore.lnk
[2011/12/11 13:47:28 | 000,000,045 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2011/12/11 13:09:56 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/12/11 11:04:34 | 002,429,576 | ---- | M] () -- C:\MGtools.exe
[2011/12/10 23:12:25 | 000,000,712 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2011/12/10 23:12:25 | 000,000,694 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\DriveImage XML.lnk
[2011/12/10 19:05:12 | 000,806,533 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\photoshop7.pdf
[2011/12/10 13:53:06 | 000,001,713 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk
[2011/12/09 16:52:10 | 000,023,624 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/12/09 16:50:11 | 000,134,464 | ---- | M] (SurfRight B.V.) -- C:\WINDOWS\System32\LnkProtect.dll
[2011/12/08 22:37:13 | 000,340,630 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\wob_cm_12-11.pdf
[2011/12/08 18:47:53 | 000,340,630 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\wob_cm_12-11 (1).pdf
[2011/12/06 09:45:19 | 000,000,012 | ---- | M] () -- C:\WINDOWS\dirsaver.ini
[2011/12/04 16:25:23 | 000,126,137 | ---- | M] () -- C:\forensic-analysis-windows-registry.pdf
[2011/12/02 22:13:27 | 000,101,720 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/11/30 12:51:52 | 001,861,020 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\SyncBack_NI.zip
[2011/11/29 03:49:04 | 011,534,336 | ---- | M] () -- C:\Documents and Settings\Owner\ntuser.bak
[2011/11/29 03:05:38 | 000,000,619 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2011/11/29 03:05:38 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2011/11/24 19:53:50 | 000,000,747 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/11/24 19:52:21 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll
[2011/11/24 18:05:10 | 000,000,941 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2011/11/24 16:21:42 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/24 14:36:45 | 000,000,032 | ---- | M] () -- C:\WINDOWS\0
[2011/11/24 14:20:21 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Yankee Clipper III.lnk
[2011/11/24 12:15:33 | 000,002,292 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk
[2011/11/24 12:15:33 | 000,002,270 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/14 14:39:30 | 002,441,780 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\MGtools.exe
[2011/12/14 14:38:49 | 000,465,298 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\RootRepeal.rar
[2011/12/14 14:26:43 | 000,160,350 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\JavaRa.zip
[2011/12/14 14:06:04 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Owner\defogger_reenable
[2011/12/14 14:05:45 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Defogger.exe
[2011/12/14 13:10:57 | 001,008,120 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/12/14 13:06:35 | 001,008,120 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\rkill.com
[2011/12/14 02:04:12 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/12/14 02:04:12 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/12/14 02:04:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/12/14 02:04:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/12/14 02:04:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/12/14 01:49:02 | 000,044,607 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\bootkit_remover.zip
[2011/12/13 18:54:02 | 467,914,752 | -HS- | C] () -- C:\hiberfil.sys
[2011/12/13 15:46:18 | 000,000,319 | ---- | C] () -- C:\temp474.bat
[2011/12/13 15:09:10 | 000,001,861 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Tweaking.com - Windows Repair (All in One).lnk
[2011/12/13 13:27:52 | 105,814,912 | ---- | C] () -- C:\setup_11.0.0.1245.x01_2011_12_13_04_23.exe
[2011/12/13 13:27:23 | 002,429,576 | ---- | C] () -- C:\MGtools.exe
[2011/12/13 13:25:22 | 000,302,592 | ---- | C] () -- C:\gmer.exe
[2011/12/10 23:12:25 | 000,000,712 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2011/12/10 23:12:25 | 000,000,694 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\DriveImage XML.lnk
[2011/12/10 19:05:25 | 000,806,533 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\photoshop7.pdf
[2011/12/10 13:53:06 | 000,001,713 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk
[2011/12/10 13:53:05 | 000,001,719 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Belarc Advisor.lnk
[2011/12/09 16:52:10 | 000,023,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/12/08 22:37:25 | 000,340,630 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\wob_cm_12-11.pdf
[2011/12/08 18:48:05 | 000,340,630 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\wob_cm_12-11 (1).pdf
[2011/12/04 16:25:27 | 000,126,137 | ---- | C] () -- C:\forensic-analysis-windows-registry.pdf
[2011/11/30 12:52:00 | 001,861,020 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\SyncBack_NI.zip
[2011/11/29 03:05:38 | 000,000,619 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2011/11/29 03:05:38 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2011/11/25 18:18:00 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xrxftplt.exe
[2011/11/25 17:57:33 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2011/11/25 17:49:34 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2011/11/25 17:48:12 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2011/11/25 17:48:09 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2011/11/25 17:48:05 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2011/11/25 17:46:56 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2011/11/25 17:45:38 | 000,165,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt53.dll
[2011/11/25 17:45:31 | 000,093,696 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt42.dll
[2011/11/25 17:45:25 | 000,101,376 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt34.dll
[2011/11/25 17:45:19 | 000,089,088 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt33.dll
[2011/11/25 17:45:12 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt21.dll
[2011/11/25 17:44:49 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2011/11/25 17:41:20 | 000,029,768 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divasu.dll
[2011/11/25 17:41:18 | 000,037,962 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaprop.dll
[2011/11/25 17:41:16 | 000,006,216 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaci.dll
[2011/11/25 17:39:08 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2011/11/25 17:37:13 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativxbar.sys
[2011/11/25 17:37:13 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atixbar.sys
[2011/11/25 17:37:12 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativttxx.sys
[2011/11/25 17:37:08 | 000,009,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2011/11/25 17:37:07 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2011/11/25 17:37:07 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitunep.sys
[2011/11/25 17:37:06 | 000,026,880 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2011/11/25 17:37:05 | 000,049,920 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtcap.sys
[2011/11/25 17:37:04 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2011/11/25 17:36:50 | 000,046,464 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atibt829.sys
[2011/11/24 19:53:50 | 000,000,747 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/11/24 18:05:10 | 000,000,941 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2011/11/24 16:21:42 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/24 14:20:21 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Yankee Clipper III.lnk
[2011/11/24 14:20:21 | 000,000,674 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Yankee Clipper III.lnk
[2011/07/31 17:18:03 | 000,082,289 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2009/10/07 00:46:36 | 000,025,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009/10/07 00:23:08 | 000,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2009/09/13 12:32:29 | 000,031,536 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009/06/24 21:27:04 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009/04/12 16:11:56 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/03/17 11:51:48 | 000,000,010 | ---- | C] () -- C:\WINDOWS\PureEdgeAPI.ini
[2009/01/28 11:16:08 | 000,000,178 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2008/12/21 22:06:45 | 000,001,751 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/10/03 09:43:56 | 000,000,067 | ---- | C] () -- C:\WINDOWS\swupdate.INI
[2008/05/16 19:51:02 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2007/05/18 16:55:36 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2007/04/25 16:25:53 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2007/02/08 06:39:59 | 000,000,075 | ---- | C] () -- C:\WINDOWS\USBBC.ini
[2007/02/08 06:39:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MDI.INI
[2007/02/08 04:38:08 | 000,015,576 | R--- | C] () -- C:\WINDOWS\System32\drivers\usbbc.sys
[2007/02/08 04:38:08 | 000,003,953 | R--- | C] () -- C:\WINDOWS\System32\coinst.dll
[2006/11/30 00:07:45 | 000,000,723 | ---- | C] () -- C:\WINDOWS\aolback.exe.lnk
[2006/11/22 23:13:37 | 000,000,006 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/08/14 21:26:15 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/07/23 13:53:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcfriend.INI
[2006/06/16 20:11:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSBrow.INI
[2006/06/05 20:28:27 | 000,000,047 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006/01/17 17:17:34 | 000,012,474 | ---- | C] () -- C:\WINDOWS\ePrompter.ini
[2006/01/11 22:21:04 | 000,000,037 | ---- | C] () -- C:\WINDOWS\Viewer.ini
[2006/01/07 00:51:05 | 000,044,032 | ---- | C] () -- C:\WINDOWS\Unwash5.exe
[2005/12/30 19:41:08 | 000,266,240 | ---- | C] () -- C:\WINDOWS\System32\ControlWZCS.exe
[2005/12/30 19:41:05 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\acs.exe
[2005/12/30 19:41:01 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\AegisI5.exe
[2005/12/30 19:40:46 | 000,270,336 | ---- | C] () -- C:\WINDOWS\System32\PlugPlayPCIDevice.exe
[2005/12/30 19:40:46 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\MFCFirstRemove.exe
[2005/08/22 19:23:46 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/08/09 18:59:11 | 000,011,122 | ---- | C] () -- C:\WINDOWS\HWSetupStr.ini
[2005/08/09 18:59:11 | 000,002,036 | ---- | C] () -- C:\WINDOWS\SVPW32Str.ini
[2005/08/09 18:36:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2005/08/09 18:00:57 | 000,000,012 | ---- | C] () -- C:\WINDOWS\dirsaver.ini
[2005/08/09 17:45:20 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/08/09 17:37:42 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2005/08/09 17:37:42 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2005/08/09 17:37:42 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2005/08/09 17:37:42 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2005/08/09 17:37:42 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2005/08/09 17:37:42 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2005/08/09 17:36:54 | 000,000,229 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/08/09 17:32:32 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2005/08/09 17:32:32 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2005/08/09 17:32:32 | 000,009,362 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2005/08/09 17:32:32 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2005/08/09 17:00:49 | 000,090,112 | ---- | C] () -- C:\WINDOWS\InstDrvr.exe
[2005/08/09 16:26:03 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/08/09 16:21:34 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/08/09 16:16:35 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/08/09 15:41:18 | 000,000,384 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/08/09 15:38:23 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/08/09 15:38:18 | 000,446,842 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/08/09 15:38:18 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2005/08/09 15:38:18 | 000,074,344 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/08/09 15:38:18 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2005/08/09 15:38:16 | 000,004,688 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2005/08/09 15:38:14 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/08/09 15:38:12 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/08/09 15:38:04 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2005/08/09 15:38:04 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2005/08/09 15:37:49 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2005/08/09 15:37:40 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2005/08/09 09:10:36 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/08/09 09:09:39 | 000,162,728 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/06/10 18:59:16 | 000,095,617 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2005/04/27 13:38:00 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\hpzidi01.dll
[2005/04/27 13:37:49 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2004/11/11 23:08:00 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\tsbwls.dll
[1998/10/10 23:07:38 | 000,088,576 | ---- | C] () -- C:\WINDOWS\System32\Iticheck.dll

========== LOP Check ==========

[2005/08/09 17:39:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\InterTrust
[2005/08/09 17:07:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\toshiba
[2011/11/24 14:36:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bluetooth
[2011/12/09 16:48:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/04/01 14:08:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Mirillis
[2011/08/05 19:07:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PureEdge
[2011/08/10 13:44:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Retrospect
[2006/01/07 23:58:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RoboForm
[2009/01/28 17:19:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/03/12 18:54:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom
[2011/12/11 20:09:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2009/09/13 11:18:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/23 17:54:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2006/08/14 21:30:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\acccore
[2011/12/13 01:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\adawaretb
[2011/05/27 22:09:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\HTC
[2005/08/09 17:39:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\InterTrust
[2006/07/03 23:53:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\InterVideo
[2009/03/17 11:52:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\PureEdge
[2009/04/12 16:13:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\Samsung
[2008/04/07 22:37:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\Snapfish
[2005/08/09 17:07:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\toshiba
[2006/08/13 00:08:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\TrueCrypt
[2009/03/06 18:17:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\Unity
[2008/11/13 09:03:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\Viewpoint
[2009/05/07 19:57:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\W Photo Studio
[2009/05/07 19:53:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\W Photo Studio Viewer
[2008/04/07 21:37:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\Wal-Mart
[2009/05/08 21:57:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\Wal-Mart Digital Photo Viewer
[2005/08/09 17:39:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\InterTrust
[2005/08/09 17:07:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\toshiba
[2006/11/22 23:03:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\acccore
[2011/08/21 17:40:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Dropbox
[2006/01/16 22:35:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\eBayRetriever
[2006/06/04 18:34:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\InterVideo
[2011/05/09 12:15:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Leadertech
[2011/05/09 12:23:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Memeo
[2011/04/01 14:08:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mirillis
[2006/01/01 03:24:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Powermarks
[2009/04/12 14:59:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\PureEdge
[2011/12/14 00:19:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SoftGrid Client
[2011/05/02 15:44:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Template
[2009/03/12 18:53:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\TomTom
[2006/06/15 22:14:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\toshiba
[2011/12/11 17:58:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\TP
[2011/08/05 09:12:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\VS Revo Group

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2011/12/12 18:25:12 | 000,001,356 | ---- | M] () -- C:\20111212.txt
[2006/01/01 03:12:55 | 000,001,039 | ---- | M] () -- C:\aolconnfix.txt
[2005/08/09 16:19:17 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/10/06 11:38:16 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/12/14 14:04:51 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 22:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/12/14 02:37:27 | 000,018,782 | ---- | M] () -- C:\ComboFix.txt
[2005/08/09 16:19:17 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/06/05 12:18:03 | 000,010,217 | ---- | M] () -- C:\DeleteAtReboot.bat
[2011/12/11 23:29:50 | 000,003,313 | ---- | M] () -- C:\Explorer 12-1-11..txt
[2011/12/04 16:25:23 | 000,126,137 | ---- | M] () -- C:\forensic-analysis-windows-registry.pdf
[2011/07/16 22:21:04 | 000,302,592 | ---- | M] () -- C:\gmer.exe
[2011/12/14 00:25:44 | 467,914,752 | -HS- | M] () -- C:\hiberfil.sys
[2005/08/09 16:19:17 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/12/11 22:25:44 | 000,000,628 | ---- | M] () -- C:\JavaRa 12-11-11 Part 2.log
[2011/12/11 22:24:07 | 000,043,923 | ---- | M] () -- C:\JavaRa 12-11-11.log
[2011/12/14 14:31:36 | 000,000,366 | ---- | M] () -- C:\JavaRa.log
[2011/12/12 13:34:49 | 000,001,139 | ---- | M] () -- C:\mbam-log-2011-12-12 (13-34-22).txt
[2011/12/11 11:04:34 | 002,429,576 | ---- | M] () -- C:\MGtools.exe
[2005/08/09 16:19:17 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2011/12/11 13:09:56 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/12/14 00:25:34 | 704,643,072 | -HS- | M] () -- C:\pagefile.sys
[2009/06/24 21:32:20 | 000,000,000 | ---- | M] () -- C:\plx_proxy.log
[2011/12/14 13:13:07 | 000,000,359 | ---- | M] () -- C:\rkill.log
[2011/12/12 20:50:06 | 105,814,912 | ---- | M] () -- C:\setup_11.0.0.1245.x01_2011_12_13_04_23.exe
[2009/01/03 16:30:17 | 000,000,268 | ---- | M] () -- C:\sqmdata00.sqm
[2009/01/06 19:00:45 | 000,000,268 | ---- | M] () -- C:\sqmdata01.sqm
[2009/01/08 00:53:51 | 000,000,268 | ---- | M] () -- C:\sqmdata02.sqm
[2009/01/08 19:11:15 | 000,000,268 | ---- | M] () -- C:\sqmdata03.sqm
[2009/01/08 20:25:40 | 000,000,268 | ---- | M] () -- C:\sqmdata04.sqm
[2009/01/10 10:14:50 | 000,000,268 | ---- | M] () -- C:\sqmdata05.sqm
[2009/01/12 07:06:15 | 000,000,268 | ---- | M] () -- C:\sqmdata06.sqm
[2009/01/12 20:09:02 | 000,000,268 | ---- | M] () -- C:\sqmdata07.sqm
[2009/01/13 13:01:12 | 000,000,268 | ---- | M] () -- C:\sqmdata08.sqm
[2009/01/13 19:06:44 | 000,000,268 | ---- | M] () -- C:\sqmdata09.sqm
[2009/01/13 20:22:06 | 000,000,268 | ---- | M] () -- C:\sqmdata10.sqm
[2009/01/16 20:50:19 | 000,000,268 | ---- | M] () -- C:\sqmdata11.sqm
[2009/01/21 12:19:08 | 000,000,268 | ---- | M] () -- C:\sqmdata12.sqm
[2009/01/21 23:38:59 | 000,000,268 | ---- | M] () -- C:\sqmdata13.sqm
[2009/01/22 10:34:58 | 000,000,268 | ---- | M] () -- C:\sqmdata14.sqm
[2009/01/22 14:42:31 | 000,000,268 | ---- | M] () -- C:\sqmdata15.sqm
[2009/01/26 14:50:23 | 000,000,268 | ---- | M] () -- C:\sqmdata16.sqm
[2009/01/28 10:43:54 | 000,000,268 | ---- | M] () -- C:\sqmdata17.sqm
[2009/01/01 22:22:57 | 000,000,268 | ---- | M] () -- C:\sqmdata18.sqm
[2009/01/02 14:09:28 | 000,000,268 | ---- | M] () -- C:\sqmdata19.sqm
[2009/01/03 16:30:17 | 000,000,244 | ---- | M] () -- C:\sqmnoopt00.sqm
[2009/01/06 19:00:45 | 000,000,244 | ---- | M] () -- C:\sqmnoopt01.sqm
[2009/01/08 00:53:51 | 000,000,244 | ---- | M] () -- C:\sqmnoopt02.sqm
[2009/01/08 19:11:15 | 000,000,244 | ---- | M] () -- C:\sqmnoopt03.sqm
[2009/01/08 20:25:40 | 000,000,244 | ---- | M] () -- C:\sqmnoopt04.sqm
[2009/01/10 10:14:50 | 000,000,244 | ---- | M] () -- C:\sqmnoopt05.sqm
[2009/01/12 07:06:15 | 000,000,244 | ---- | M] () -- C:\sqmnoopt06.sqm
[2009/01/12 20:09:02 | 000,000,244 | ---- | M] () -- C:\sqmnoopt07.sqm
[2009/01/13 13:01:12 | 000,000,244 | ---- | M] () -- C:\sqmnoopt08.sqm
[2009/01/13 19:06:44 | 000,000,244 | ---- | M] () -- C:\sqmnoopt09.sqm
[2009/01/13 20:22:06 | 000,000,244 | ---- | M] () -- C:\sqmnoopt10.sqm
[2009/01/16 20:50:19 | 000,000,244 | ---- | M] () -- C:\sqmnoopt11.sqm
[2009/01/21 12:19:07 | 000,000,244 | ---- | M] () -- C:\sqmnoopt12.sqm
[2009/01/21 23:38:59 | 000,000,244 | ---- | M] () -- C:\sqmnoopt13.sqm
[2009/01/22 10:34:58 | 000,000,244 | ---- | M] () -- C:\sqmnoopt14.sqm
[2009/01/22 14:42:31 | 000,000,244 | ---- | M] () -- C:\sqmnoopt15.sqm
[2009/01/26 14:50:22 | 000,000,244 | ---- | M] () -- C:\sqmnoopt16.sqm
[2009/01/28 10:43:54 | 000,000,244 | ---- | M] () -- C:\sqmnoopt17.sqm
[2009/01/01 22:22:57 | 000,000,244 | ---- | M] () -- C:\sqmnoopt18.sqm
[2009/01/02 14:09:28 | 000,000,244 | ---- | M] () -- C:\sqmnoopt19.sqm
[2006/01/07 06:21:55 | 000,000,104 | ---- | M] () -- C:\stats.mst
[2006/12/08 19:57:37 | 000,000,288 | ---- | M] () -- C:\T4Metrics.log
[2011/12/12 02:15:21 | 000,125,618 | ---- | M] () -- C:\TDSSKiller.2.6.22.0_12.12.2011_02.08.05_log.txt
[2011/12/13 15:46:18 | 000,000,319 | ---- | M] () -- C:\temp474.bat
[2011/12/04 15:59:43 | 000,155,232 | ---- | M] (Microsoft Corporation) -- C:\WntIpcfg_setup.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/08/09 16:18:40 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/05/10 20:48:48 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll
[2003/06/18 19:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2005/08/15 11:56:54 | 032,694,346 | ---- | M] (Goldshell Digital Media) -- C:\WINDOWS\Toshiba Q4 Retail Demo.scr
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/08/09 09:09:08 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005/08/09 09:09:08 | 000,634,880 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005/08/09 09:09:08 | 000,876,544 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/12/11 13:16:48 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/12/30 19:42:29 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2002/05/06 13:19:45 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/12/13 19:20:20 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/12/14 00:40:56 | 000,909,600 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Owner\Desktop\chromeinstall-6u29 (1).exe
[2011/12/14 01:06:26 | 000,909,600 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Owner\Desktop\chromeinstall-6u29.exe
[2011/12/14 01:57:11 | 004,339,049 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/12/14 14:05:50 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Defogger.exe
[2011/12/14 14:39:45 | 002,441,780 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\MGtools.exe
[2011/12/14 18:25:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/12/14 13:11:02 | 001,008,120 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\rkill.exe
[2011/12/14 14:37:58 | 013,521,328 | ---- | M] (SUPERAntiSpyware.com) -- C:\Documents and Settings\Owner\Desktop\SUPERAntiSpyware.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >
[2005/08/09 09:11:29 | 000,004,128 | ---- | M] () -- C:\WINDOWS\Driver Cache\INFCACHE.1

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
TrueCrypt Setup.exe

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/12/09 01:16:57 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Owner\Cookies\desktop.ini
[2011/12/14 18:21:01 | 000,081,920 | -HS- | M] () -- C:\Documents and Settings\Owner\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 00:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 00:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 00:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 00:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 00:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 00:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< >

< End of report >

malady · 2011/12/14

OTL Extras logfile created on: 12/14/2011 6:28:39 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.17 Mb Total Physical Memory | 219.62 Mb Available Physical Memory | 49.22% Memory free
1.03 Gb Paging File | 0.61 Gb Available in Paging File | 59.53% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 2.39 Gb Free Space | 6.41% Space Free | Partition Type: NTFS
Drive E: | 7.26 Gb Total Space | 2.19 Gb Free Space | 30.15% Space Free | Partition Type: FAT32
Drive F: | 3.65 Gb Total Space | 0.56 Gb Free Space | 15.39% Space Free | Partition Type: FAT32

Computer Name: T | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002
"1723:TCP" = 1723:TCP:*:Enabledxpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabledxpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabledxpsp2res.dll,-22017

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"1700:TCP" = 1700:TCP:*:Enabled:MioNet Remote Drive Access
"1641:TCP" = 1641:TCP:*:Enabled:MioNet Remote Drive Verification
"1723:TCP" = 1723:TCP:*:Enabledxpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabledxpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabledxpsp2res.dll,-22017

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine -- (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\IVP\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger -- (TOSHIBA Corporation)
"C:\Program Files\Toshiba\ConfigFree\CFXFER.exe" = C:\Program Files\Toshiba\ConfigFree\CFXFER.exe:*:Enabled:ConfigFree SUMMIT Engine -- (TOSHIBA CORPORATION)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (America Online, Inc.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil_.exe" = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil_.exe:*:Enabled:BlueSoleil -- (IVT Corporation.)
"C:\Program Files\Logitech\Vid HD\Vid.exe" = C:\Program Files\Logitech\Vid HD\Vid.exe:*:Enabled:Logitech Vid HD -- (Logitech Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{05832D65-6EDB-4D32-BA78-BCD0E2B91C02}" = Atheros Wireless LAN MiniPCI card Driver
"{099D12EC-0321-4CAC-A0CC-33D020156FCD}" = Toshiba Utility
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
"{5D96E2B1-D9AC-46E0-9073-425C5F63E338}" = Touch and Launch
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zooming Utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71D658CF-4E0D-4DA8-AA67-8C0B6F1C01FE}" = Atheros Client Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{90110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.1
"{A1CFBEF8-D9F6-4B2A-BDBE-7D8C0B0FE03A}" = Toshiba Hotkey Utility
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5654243-0EDC-4BE7-8353-16ECE4019CD1}" = OpenMG Secure Module 4.6.00
"{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}" = U3Launcher
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{F6C405D2-C50D-4D10-B89E-73A233A14D74}" = Toshiba Registration
"{F77890F3-774A-4CBE-A2E3-7BB0DC71D1FA}" = Toshiba Touchpad Utility
"{F7E1CA14-B39D-452A-960B-39423DDDD933}" = DriveImage XML (Private Edition)
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"44953928-E730-4e8c-A2B2-3A85BC96A3D0_is1" = FileSeek 2.1.3
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AI RoboForm" = AI RoboForm (All Users)
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Belarc Advisor" = Belarc Advisor 8.2
"Bulk Rename Utility_is1" = Bulk Rename Utility 2.7.1.2
"CCleaner" = CCleaner
"CNXT_AUDIO" = Conexant AC-Link Audio
"ERUNT_is1" = ERUNT 1.1j
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{099D12EC-0321-4CAC-A0CC-33D020156FCD}" = Toshiba Utility
"InstallShield_{D5654243-0EDC-4BE7-8353-16ECE4019CD1}" = OpenMG Secure Module 4.6.00
"InstallShield_{F77890F3-774A-4CBE-A2E3-7BB0DC71D1FA}" = Toshiba Touchpad Utility
"Logitech Vid" = Logitech Vid HD
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NirSoft ProduKey" = NirSoft ProduKey
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenMG HotFix4.6-06-09-04-01" = OpenMG Limited Patch 4.6-06-09-04-01
"PC Diagnostic Tool" = TOSHIBA PC Diagnostic Tool
"Picasa 3" = Picasa 3
"RealPlayer 12.0" = RealPlayer
"RealPlayer 15.0" = RealPlayer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Toshiba Q4 Retail Demo.scr" = Toshiba Q4 Retail Demo ScreenSaver
"Toshiba Tbiosdrv Driver" = Toshiba Tbiosdrv Driver
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Messenger" = Yahoo! Messenger
"Yankee Clipper III" = Yankee Clipper III
"YTdetect" = Yahoo! Detect

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/13/2011 5:47:55 AM | Computer Name = T | Source = VSS | ID = 12289
Description = Volume Shadow Copy Service error: Unexpected error CreateFileW(\\?\Volume{9b6c2a04-244a-11e1-934f-00038a000015},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 12/13/2011 5:53:31 AM | Computer Name = T | Source = VSS | ID = 12289
Description = Volume Shadow Copy Service error: Unexpected error CreateFileW(\\?\Volume{9b6c2a04-244a-11e1-934f-00038a000015},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 12/13/2011 5:57:03 AM | Computer Name = T | Source = VSS | ID = 12289
Description = Volume Shadow Copy Service error: Unexpected error CreateFileW(\\?\Volume{9b6c2a04-244a-11e1-934f-00038a000015},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 12/13/2011 6:03:25 AM | Computer Name = T | Source = VSS | ID = 12289
Description = Volume Shadow Copy Service error: Unexpected error CreateFileW(\\?\Volume{9b6c2a04-244a-11e1-934f-00038a000015},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 12/13/2011 6:06:32 AM | Computer Name = T | Source = VSS | ID = 12289
Description = Volume Shadow Copy Service error: Unexpected error CreateFileW(\\?\Volume{9b6c2a04-244a-11e1-934f-00038a000015},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 12/13/2011 6:10:40 AM | Computer Name = T | Source = VSS | ID = 12289
Description = Volume Shadow Copy Service error: Unexpected error CreateFileW(\\?\Volume{9b6c2a04-244a-11e1-934f-00038a000015},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 12/13/2011 11:43:58 AM | Computer Name = T | Source = CVHSVC | ID = 100
Description =

Error - 12/13/2011 2:04:19 PM | Computer Name = T | Source = CVHSVC | ID = 100
Description =

Error - 12/13/2011 4:29:13 PM | Computer Name = T | Source = CVHSVC | ID = 100
Description =

Error - 12/14/2011 12:02:03 AM | Computer Name = T | Source = Microsoft Office 14 | ID = 2001
Description =

[ System Events ]
Error - 12/14/2011 2:15:07 AM | Computer Name = T | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 12/14/2011 2:15:07 AM | Computer Name = T | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 12/14/2011 2:15:07 AM | Computer Name = T | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 12/14/2011 2:15:07 AM | Computer Name = T | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 12/14/2011 2:15:07 AM | Computer Name = T | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 12/14/2011 3:03:35 AM | Computer Name = T | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 12/14/2011 3:10:58 AM | Computer Name = T | Source = Service Control Manager | ID = 7034
Description = The Swupdtmr service terminated unexpectedly. It has done this 1
time(s).

Error - 12/14/2011 3:33:32 AM | Computer Name = T | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.28 for the Network Card with network
address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 12/14/2011 3:33:34 PM | Computer Name = T | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.29 for the Network Card with network
address 0011F5896303 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 12/14/2011 5:18:53 PM | Computer Name = T | Source = Service Control Manager | ID = 7000
Description = The SASDIFSV service failed to start due to the following error: %%183

< End of report >

broni · 2011/12/14

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
IE - HKU\.DEFAULT\..\URLSearchHook: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - No CLSID value found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {52706EF7-D7A2-49AD-A615-E903858CF284} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O8 - Extra context menu item: Display All Images with Full Quality -  "res://C:\Program Files\NetZero\qsacc\appres.dll/228" File not found
O8 - Extra context menu item: Display Image with Full Quality -  "res://C:\Program Files\NetZero\qsacc\appres.dll/227" File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html File not found
O15 - HKU\S-1-5-21-3119454931-2476218117-819753718-1003\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} http://www.sidestep.com/get/k00722/sb02d.cab (Reg Error: Key error.)
[2008/11/13 09:03:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Babycakes\Application Data\Viewpoint

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
==========================================================

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, click on List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

malady · 2011/12/15

Logs enclosed. TFC would not run...stopped at "Press any key" so I rand CC Cleaner in default mode.Thx.

------------------------
All processes killed
Error: Unable to interpret <Code: > in the current context!
========== OTL ==========
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{6c97a91e-4524-4019-86af-2aa2d567bf5c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c97a91e-4524-4019-86af-2aa2d567bf5c}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{6c97a91e-4524-4019-86af-2aa2d567bf5c} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c97a91e-4524-4019-86af-2aa2d567bf5c}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52706EF7-D7A2-49AD-A615-E903858CF284}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52706EF7-D7A2-49AD-A615-E903858CF284}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{BA52B914-B692-46c4-B683-905236F6F655} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA52B914-B692-46c4-B683-905236F6F655}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Display All Images with Full Quality\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Display Image with Full Quality\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3119454931-2476218117-819753718-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
Starting removal of ActiveX control {640B39C1-D713-464F-92C3-75BD972B95EE}
C:\WINDOWS\Downloaded Program Files\SbCIe02d.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{640B39C1-D713-464F-92C3-75BD972B95EE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{640B39C1-D713-464F-92C3-75BD972B95EE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{640B39C1-D713-464F-92C3-75BD972B95EE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{640B39C1-D713-464F-92C3-75BD972B95EE}\ not found.
C:\Documents and Settings\Babycakes\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\Babycakes\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\Babycakes\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\Babycakes\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\Babycakes\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\Babycakes\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\Babycakes\Application Data\Viewpoint folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Flash cache emptied: 56958 bytes

User: All Users

User: Babycakes
->Temp folder emptied: 2303 bytes
->Temporary Internet Files folder emptied: 112094 bytes
->Java cache emptied: 1439574 bytes
->Google Chrome cache emptied: 139454161 bytes
->Flash cache emptied: 823069 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 82306 bytes
->Flash cache emptied: 56468 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 348 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: Owner
->Temp folder emptied: 11275175 bytes
->Temporary Internet Files folder emptied: 13352895 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 44684626 bytes
->Flash cache emptied: 57497 bytes

%systemdrive% .tmp files removed: 56096 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33237 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 202.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Babycakes
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 12142011_210541

Files\Folders moved on Reboot...
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\JESW2JUD\p-01-0VIaSjnOLg[2].gif moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\G5HUVMD6\ads[7].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\G5HUVMD6\ba41f783-c96b-4b2d-8be8-46ee74bd1e3b__3rd_party_BBS.[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\G5HUVMD6\google_com[2].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\G5HUVMD6\like[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\F3XLYYTU\1x1[1].gif moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\56Q2AC8E\101242-active-virus[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\56Q2AC8E\Cox_SDUpfront_Control[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.

Registry entries deleted on Reboot...

----------------------------
Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 3 x86
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Avira AntiVir Personal - Free Antivirus
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 29
Adobe Flash Player ( 10.0.22.87) Flash Player Out of Date!
Adobe Reader X (10.1.0) Adobe Reader Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
``````````End of Log````````````

Found and removed: SOFTWARE\JavaRa

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}

Found and removed: SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}

Found and removed: Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Dec 14 21:51:16 2011

Found and removed: Applications\java.exe

Found and removed: Applications\javaw.exe

Found and removed: JavaPlugin.FamilyVersionSupport

Found and removed: CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBB}

Found and removed: CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBC}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}

Found and removed: SOFTWARE\Classes\JavaPlugin

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.1

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.1.1

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.1.2

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.1.3

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.2

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.2.1

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.3

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.3.1

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.4

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.4.1

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.4.2

Found and removed: SOFTWARE\MozillaPlugins\@java.com/JavaPlugin\MimeTypes\application/x-java-applet;version=1.5

------------------------------------

Finished reporting.

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Dec 14 21:51:44 2011

Found and removed: CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}

------------------------------------

Finished reporting.
-------------------
C:\Program Downloads\Bulk Rename Utility 8-19-11\cnet_BRU_Setup_WinNTx86_exe.exe a variant of Win32/InstallCore.D application

broni · 2011/12/15

Update Adobe Flash Player
Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/...-flash-for-firefox-and-ie-without-any-extras/

==============================================================

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions (if present).
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

==========================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

malady · 2011/12/15

Hi Broni,

Before I do the other what about this ESET infection? I didn't get rid of it only reported.

C:\Program Downloads\Bulk Rename Utility 8-19-11\cnet_BRU_Setup_WinNTx86_exe.exe a variant of Win32/InstallCore.D application

Also, I have no keyboard on laptop because Kapersky TDss killer showed suspicious files and I deleted them. Somehow I have .dta files for those deletions in "quarantine ". Toshiba doesn't have the keyboard driver (among others) available for download and no recovery disk so how can I restore those files? I emailed Kapersky but no response.

Lastly, when I tried to run TFC in safe mode under "administrator" it wouldn't run either. When I tried to open files under this user account, access was denied. I took ownership of those files but still says it can't change permissions. This is after this virus infection so can you please advise why I can't access these user files while in administrator safe mode? My user account is an administrator account which I know is not wise to run on line. Thanks for your prompt responses!

broni · 2011/12/15

Before I do the other what about this ESET infection? I didn't get rid of it only reported.
Click to expand...

You changed Eset settings. Delete it manually.

Can you post TDSSKiller log?

Why did you run TFC in safe mode?

I don't think you can change permissions in safe mode.

malady · 2011/12/15

Responses

"broni said: ↑

You changed Eset settings. Delete it manually..
Click to expand...

Okay, done. Funny it was the CNET installer of that program.

"broni said: ↑

Can you post TDSSKiller log?..
Click to expand...

It wouldn't fit. Will post separately.

"broni said: ↑

Why did you run TFC in safe mode?..
Click to expand...

Tried twice but it locked up at "enter any key" so tried safe mode but same result. Ran CC cleaner in defaut because I never did get it to run.

"broni said: ↑

I don't think you can change permissions in safe mode..
Click to expand...

Only way I see my admin account to log in is when I boot to safe mode. Don't know how to change that.

malady · 2011/12/15

Kapersky TDS log- Part 1

02:08:05.0171 3164 TDSS rootkit removing tool 2.6.22.0 Dec 7 2011 13:21:06
02:08:05.0875 3164 ============================================================
02:08:05.0875 3164 Current date / time: 2011/12/12 02:08:05.0875
02:08:05.0875 3164 SystemInfo:
02:08:05.0875 3164
02:08:05.0875 3164 OS Version: 5.1.2600 ServicePack: 3.0
02:08:05.0875 3164 Product type: Workstation
02:08:05.0875 3164 ComputerName: T
02:08:05.0890 3164 UserName: Owner
02:08:05.0890 3164 Windows directory: C:\WINDOWS
02:08:05.0890 3164 System windows directory: C:\WINDOWS
02:08:05.0890 3164 Processor architecture: Intel x86
02:08:05.0890 3164 Number of processors: 1
02:08:05.0890 3164 Page size: 0x1000
02:08:05.0890 3164 Boot type: Normal boot
02:08:05.0890 3164 ============================================================
02:08:08.0796 3164 Initialize success
02:08:26.0125 3624 ============================================================
02:08:26.0125 3624 Scan started
02:08:26.0125 3624 Mode: Manual; SigCheck; TDLFS;
02:08:26.0125 3624 ============================================================
02:08:28.0000 3624 Abiosdsk - ok
02:08:28.0062 3624 abp480n5 - ok
02:08:28.0140 3624 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
02:08:32.0156 3624 ACPI - ok
02:08:32.0562 3624 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
02:08:33.0187 3624 ACPIEC - ok
02:08:33.0656 3624 adpu160m - ok
02:08:33.0734 3624 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
02:08:34.0343 3624 aec - ok
02:08:34.0718 3624 AegisP (2c5c22990156a1063e19ad162191dc1d) C:\WINDOWS\system32\DRIVERS\AegisP.sys
02:08:34.0812 3624 AegisP ( UnsignedFile.Multi.Generic ) - warning
02:08:34.0812 3624 AegisP - detected UnsignedFile.Multi.Generic (1)
02:08:34.0937 3624 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
02:08:35.0062 3624 AFD - ok
02:08:35.0406 3624 Aha154x - ok
02:08:35.0453 3624 aic78u2 - ok
02:08:35.0515 3624 aic78xx - ok
02:08:35.0609 3624 AliIde - ok
02:08:35.0656 3624 amsint - ok
02:08:35.0812 3624 AR5211 (d07ccc37476034ebf5de4608a8af4386) C:\WINDOWS\system32\DRIVERS\SHP5211.sys
02:08:35.0953 3624 AR5211 - ok
02:08:36.0000 3624 asc - ok
02:08:36.0062 3624 asc3350p - ok
02:08:36.0125 3624 asc3550 - ok
02:08:36.0281 3624 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
02:08:36.0734 3624 AsyncMac - ok
02:08:37.0156 3624 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
02:08:37.0593 3624 atapi - ok
02:08:37.0687 3624 Atdisk - ok
02:08:37.0843 3624 ati2mtag (d5537cc8cc9a86668e3903bd53caa83c) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
02:08:38.0187 3624 ati2mtag - ok
02:08:38.0562 3624 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
02:08:39.0031 3624 Atmarpc - ok
02:08:39.0125 3624 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
02:08:39.0671 3624 audstub - ok
02:08:39.0796 3624 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
02:08:39.0906 3624 avgio - ok
02:08:40.0296 3624 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
02:08:40.0578 3624 avgntflt - ok
02:08:40.0703 3624 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
02:08:40.0796 3624 avipbb - ok
02:08:41.0218 3624 BANTExt (5d7be7b19e827125e016325334e58ff1) C:\WINDOWS\System32\Drivers\BANTExt.sys
02:08:41.0359 3624 BANTExt ( UnsignedFile.Multi.Generic ) - warning
02:08:41.0359 3624 BANTExt - detected UnsignedFile.Multi.Generic (1)
02:08:41.0734 3624 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
02:08:42.0281 3624 Beep - ok
02:08:42.0375 3624 BlueletAudio - ok
02:08:42.0421 3624 BlueletSCOAudio - ok
02:08:42.0515 3624 BoiHwsetup (141befbd4f2a84a66e2f54b9e32e40d1) C:\WINDOWS\system32\drivers\BoiHwSetup.sys
02:08:42.0671 3624 BoiHwsetup - ok
02:08:42.0984 3624 BT - ok
02:08:43.0046 3624 Btcsrusb - ok
02:08:43.0109 3624 BTHidEnum - ok
02:08:43.0156 3624 BTHidMgr - ok
02:08:43.0234 3624 CAMCAUD (cce1f3c7c8e7383b90372229454999cf) C:\WINDOWS\system32\drivers\camc6aud.sys
02:08:43.0359 3624 CAMCAUD - ok
02:08:43.0468 3624 CAMCHALA (9a3bbde74dab737efa82de7ef4b40bea) C:\WINDOWS\system32\drivers\camc6hal.sys
02:08:43.0640 3624 CAMCHALA - ok
02:08:43.0734 3624 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
02:08:44.0296 3624 cbidf2k - ok
02:08:44.0671 3624 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
02:08:45.0140 3624 CCDECODE - ok
02:08:45.0312 3624 cd20xrnt - ok
02:08:45.0546 3624 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
02:08:46.0125 3624 Cdaudio - ok
02:08:46.0500 3624 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
02:08:47.0062 3624 Cdfs - ok
02:08:47.0203 3624 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
02:08:47.0671 3624 Cdrom - ok
02:08:48.0000 3624 Changer - ok
02:08:48.0156 3624 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
02:08:48.0640 3624 CmBatt - ok
02:08:48.0718 3624 CmdIde - ok
02:08:48.0796 3624 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
02:08:49.0265 3624 Compbatt - ok
02:08:49.0656 3624 Cpqarray - ok
02:08:49.0718 3624 dac2w2k - ok
02:08:49.0781 3624 dac960nt - ok
02:08:49.0890 3624 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
02:08:50.0390 3624 Disk - ok
02:08:50.0609 3624 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
02:08:51.0171 3624 dmboot - ok
02:08:51.0687 3624 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
02:08:52.0203 3624 dmio - ok
02:08:52.0500 3624 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
02:08:53.0062 3624 dmload - ok
02:08:53.0421 3624 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
02:08:53.0921 3624 DMusic - ok
02:08:54.0140 3624 dpti2o - ok
02:08:54.0218 3624 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
02:08:54.0656 3624 drmkaud - ok
02:08:55.0203 3624 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
02:08:55.0750 3624 Fastfat - ok
02:08:55.0843 3624 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
02:08:56.0328 3624 Fdc - ok
02:08:56.0718 3624 FilterService (b73ec688c29f81f9da0fcf63682b3ecb) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys
02:08:56.0796 3624 FilterService - ok
02:08:56.0906 3624 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
02:08:57.0406 3624 Fips - ok
02:08:57.0765 3624 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
02:08:58.0250 3624 Flpydisk - ok
02:08:58.0343 3624 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
02:08:58.0875 3624 FltMgr - ok
02:08:59.0250 3624 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
02:08:59.0812 3624 Fs_Rec - ok
02:09:00.0000 3624 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
02:09:00.0531 3624 Ftdisk - ok
02:09:00.0953 3624 GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
02:09:01.0046 3624 GEARAspiWDM - ok
02:09:01.0125 3624 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
02:09:01.0593 3624 Gpc - ok
02:09:02.0000 3624 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
02:09:02.0453 3624 HidUsb - ok
02:09:02.0562 3624 hpn - ok
02:09:02.0640 3624 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
02:09:02.0750 3624 HPZid412 ( UnsignedFile.Multi.Generic ) - warning
02:09:02.0750 3624 HPZid412 - detected UnsignedFile.Multi.Generic (1)
02:09:03.0109 3624 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
02:09:03.0171 3624 HPZipr12 ( UnsignedFile.Multi.Generic ) - warning
02:09:03.0171 3624 HPZipr12 - detected UnsignedFile.Multi.Generic (1)
02:09:03.0312 3624 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
02:09:03.0421 3624 HPZius12 ( UnsignedFile.Multi.Generic ) - warning
02:09:03.0421 3624 HPZius12 - detected UnsignedFile.Multi.Generic (1)
02:09:03.0750 3624 HTCAND32 - ok
02:09:03.0875 3624 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
02:09:03.0968 3624 HTTP - ok
02:09:04.0062 3624 i2omgmt - ok
02:09:04.0125 3624 i2omp - ok
02:09:04.0218 3624 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
02:09:04.0703 3624 i8042prt - ok
02:09:05.0109 3624 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
02:09:05.0578 3624 Imapi - ok
02:09:05.0671 3624 ini910u - ok
02:09:05.0734 3624 IntelIde - ok
02:09:05.0843 3624 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
02:09:06.0234 3624 intelppm - ok
02:09:06.0328 3624 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
02:09:06.0843 3624 Ip6Fw - ok
02:09:07.0234 3624 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
02:09:07.0796 3624 IpFilterDriver - ok
02:09:07.0968 3624 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
02:09:08.0437 3624 IpInIp - ok
02:09:08.0796 3624 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
02:09:09.0234 3624 IpNat - ok
02:09:09.0296 3624 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
02:09:09.0765 3624 IPSec - ok
02:09:09.0875 3624 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
02:09:10.0328 3624 IRENUM - ok
02:09:10.0687 3624 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
02:09:11.0156 3624 isapnp - ok
02:09:11.0281 3624 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
02:09:11.0781 3624 Kbdclass - ok
02:09:12.0156 3624 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
02:09:12.0593 3624 kbdhid - ok
02:09:12.0718 3624 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
02:09:13.0171 3624 kmixer - ok
02:09:13.0312 3624 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
02:09:13.0421 3624 KSecDD - ok
02:09:13.0828 3624 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
02:09:13.0921 3624 Lbd - ok
02:09:14.0000 3624 lbrtfdc - ok
02:09:14.0156 3624 LVPr2Mon (1a7db7a00a4b0d8da24cd691a4547291) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
02:09:14.0234 3624 LVPr2Mon - ok
02:09:14.0375 3624 LVRS (37072ec9299e825f4335cc554b6fac6a) C:\WINDOWS\system32\DRIVERS\lvrs.sys
02:09:14.0500 3624 LVRS - ok
02:09:15.0515 3624 LVUVC (a240e42a7402e927a71b6e8aa4629b13) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
02:09:16.0312 3624 LVUVC - ok
02:09:16.0703 3624 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
02:09:17.0265 3624 mnmdd - ok
02:09:17.0359 3624 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
02:09:17.0828 3624 Modem - ok
02:09:18.0187 3624 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
02:09:18.0687 3624 Mouclass - ok
02:09:18.0781 3624 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
02:09:19.0328 3624 mouhid - ok
02:09:19.0703 3624 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
02:09:20.0171 3624 MountMgr - ok
02:09:20.0265 3624 mraid35x - ok
02:09:20.0343 3624 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
02:09:20.0828 3624 MRxDAV - ok
02:09:21.0250 3624 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
02:09:21.0390 3624 MRxSmb - ok
02:09:21.0531 3624 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
02:09:22.0000 3624 Msfs - ok
02:09:22.0406 3624 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
02:09:22.0843 3624 MSKSSRV - ok
02:09:22.0921 3624 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
02:09:23.0375 3624 MSPCLOCK - ok
02:09:23.0468 3624 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
02:09:23.0937 3624 MSPQM - ok
02:09:24.0359 3624 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
02:09:24.0765 3624 mssmbios - ok
02:09:24.0843 3624 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
02:09:25.0312 3624 MSTEE - ok
02:09:25.0406 3624 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
02:09:25.0500 3624 Mup - ok
02:09:25.0859 3624 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
02:09:26.0359 3624 NABTSFEC - ok
02:09:26.0468 3624 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
02:09:26.0953 3624 NDIS - ok
02:09:27.0312 3624 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
02:09:27.0750 3624 NdisIP - ok
02:09:27.0843 3624 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
02:09:27.0921 3624 NdisTapi - ok
02:09:28.0015 3624 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
02:09:28.0515 3624 Ndisuio - ok
02:09:28.0890 3624 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
02:09:29.0343 3624 NdisWan - ok
02:09:29.0421 3624 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
02:09:29.0500 3624 NDProxy - ok
02:09:29.0578 3624 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
02:09:30.0046 3624 NetBIOS - ok
02:09:30.0437 3624 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
02:09:30.0937 3624 NetBT - ok
02:09:31.0078 3624 Netdevio (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
02:09:31.0140 3624 Netdevio ( UnsignedFile.Multi.Generic ) - warning
02:09:31.0140 3624 Netdevio - detected UnsignedFile.Multi.Generic (1)
02:09:31.0468 3624 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
02:09:31.0921 3624 Npfs - ok
02:09:32.0140 3624 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
02:09:32.0687 3624 Ntfs - ok
02:09:33.0078 3624 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
02:09:33.0640 3624 Null - ok
02:09:33.0718 3624 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
02:09:34.0250 3624 NwlnkFlt - ok
02:09:34.0593 3624 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
02:09:35.0171 3624 NwlnkFwd - ok
02:09:35.0812 3624 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
02:09:36.0265 3624 Parport - ok
02:09:36.0343 3624 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
02:09:36.0812 3624 PartMgr - ok
02:09:37.0218 3624 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
02:09:37.0765 3624 ParVdm - ok
02:09:37.0875 3624 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
02:09:38.0343 3624 PCI - ok
02:09:38.0671 3624 PCIDump - ok
02:09:38.0781 3624 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
02:09:39.0312 3624 PCIIde - ok
02:09:39.0437 3624 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
02:09:39.0906 3624 Pcmcia - ok
02:09:40.0265 3624 PDCOMP - ok
02:09:40.0375 3624 PDFRAME - ok
02:09:40.0421 3624 PDRELI - ok
02:09:40.0484 3624 PDRFRAME - ok
02:09:40.0531 3624 perc2 - ok
02:09:40.0578 3624 perc2hib - ok
02:09:40.0718 3624 pfc (6c1618a07b49e3873582b6449e744088) C:\WINDOWS\system32\drivers\pfc.sys
02:09:40.0812 3624 pfc ( UnsignedFile.Multi.Generic ) - warning
02:09:40.0812 3624 pfc - detected UnsignedFile.Multi.Generic (1)
02:09:40.0968 3624 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
02:09:41.0500 3624 PptpMiniport - ok
02:09:41.0843 3624 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
02:09:42.0343 3624 PSched - ok
02:09:42.0468 3624 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
02:09:43.0031 3624 Ptilink - ok
02:09:43.0421 3624 PxHelp20 (25f7c4453f189f79eb3846d3e23805a0) C:\WINDOWS\system32\Drivers\PxHelp20.sys
02:09:43.0500 3624 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
02:09:43.0500 3624 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
02:09:43.0640 3624 qkbfiltr (c50faa6fda843fa2172aa2b9c3cd1dab) C:\WINDOWS\system32\drivers\qkbfiltr.sys
02:09:43.0718 3624 qkbfiltr ( UnsignedFile.Multi.Generic ) - warning
02:09:43.0718 3624 qkbfiltr - detected UnsignedFile.Multi.Generic (1)
02:09:44.0000 3624 ql1080 - ok
02:09:44.0062 3624 Ql10wnt - ok
02:09:44.0109 3624 ql12160 - ok
02:09:44.0156 3624 ql1240 - ok
02:09:44.0234 3624 ql1280 - ok
02:09:44.0281 3624 qmofiltr (8652b9e134c3478be948bf089df8ed5e) C:\WINDOWS\system32\drivers\qmofiltr.sys
02:09:44.0359 3624 qmofiltr ( UnsignedFile.Multi.Generic ) - warning
02:09:44.0359 3624 qmofiltr - detected UnsignedFile.Multi.Generic (1)
02:09:44.0453 3624 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
02:09:44.0953 3624 RasAcd - ok
02:09:45.0109 3624 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
02:09:45.0562 3624 Rasl2tp - ok
02:09:45.0906 3624 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
02:09:46.0390 3624 RasPppoe - ok
02:09:46.0531 3624 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
02:09:47.0046 3624 Raspti - ok
02:09:47.0406 3624 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
02:09:47.0906 3624 Rdbss - ok
02:09:48.0015 3624 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
02:09:48.0484 3624 RDPCDD - ok
02:09:48.0640 3624 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
02:09:48.0718 3624 RDPWD - ok
02:09:49.0046 3624 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
02:09:49.0546 3624 redbook - ok
02:09:49.0703 3624 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
02:09:50.0234 3624 ROOTMODEM - ok
02:09:50.0640 3624 RTL8023xp (4a0ae7891fcf74acc848b109294cb80f) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
02:09:50.0843 3624 RTL8023xp - ok
02:09:50.0984 3624 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
02:09:51.0421 3624 rtl8139 - ok
02:09:51.0843 3624 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
02:09:52.0296 3624 Secdrv - ok
02:09:52.0453 3624 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
02:09:52.0937 3624 Serenum - ok
02:09:53.0281 3624 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
02:09:53.0765 3624 Serial - ok
02:09:54.0000 3624 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
02:09:54.0453 3624 Sfloppy - ok
02:09:54.0843 3624 Sftfs (92d1002b9ace530f37f256d3d58e5867) C:\WINDOWS\system32\DRIVERS\Sftfsxp.sys
02:09:54.0937 3624 Sftfs - ok
02:09:55.0046 3624 Sftplay (5eb49d97a281c3e71b23c66b13a24a6d) C:\WINDOWS\system32\DRIVERS\Sftplayxp.sys
02:09:55.0093 3624 Sftplay - ok
02:09:55.0562 3624 Sftredir (e8192208cc8cf24b3a81774c8078259c) C:\WINDOWS\system32\DRIVERS\Sftredirxp.sys
02:09:55.0609 3624 Sftredir - ok
02:09:56.0437 3624 Sftvol (f21569a5e0f9e9cf6e32819e08abfa2d) C:\WINDOWS\system32\DRIVERS\Sftvolxp.sys
02:09:56.0468 3624 Sftvol - ok
02:09:56.0734 3624 Simbad - ok
02:09:56.0828 3624 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
02:09:57.0296 3624 SLIP - ok
02:09:57.0453 3624 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
02:09:58.0000 3624 SONYPVU1 - ok
02:09:58.0171 3624 Sparrow - ok
02:09:58.0265 3624 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
02:09:58.0750 3624 splitter - ok
02:09:59.0046 3624 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
02:09:59.0515 3624 sr - ok
02:09:59.0703 3624 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
02:09:59.0875 3624 Srv - ok
02:10:00.0046 3624 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
02:10:00.0140 3624 ssmdrv - ok
02:10:00.0359 3624 StarOpen (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys
02:10:00.0437 3624 StarOpen ( UnsignedFile.Multi.Generic ) - warning
02:10:00.0437 3624 StarOpen - detected UnsignedFile.Multi.Generic (1)
02:10:00.0640 3624 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
02:10:01.0109 3624 streamip - ok
02:10:01.0359 3624 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
02:10:01.0843 3624 swenum - ok
02:10:02.0156 3624 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
02:10:02.0625 3624 swmidi - ok
02:10:02.0812 3624 symc810 - ok
02:10:02.0875 3624 symc8xx - ok
02:10:02.0937 3624 sym_hi - ok
02:10:03.0000 3624 sym_u3 - ok
02:10:03.0109 3624 SynTP (eb363ddfbe8b6d51003ccab29d93d744) C:\WINDOWS\system32\DRIVERS\SynTP.sys
02:10:03.0218 3624 SynTP - ok
02:10:03.0546 3624 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
02:10:04.0046 3624 sysaudio - ok
02:10:04.0265 3624 TBiosDrv (eeca2b57545e7b7be949b5e70e31444f) C:\WINDOWS\system32\drivers\TBiosDrv.sys
02:10:04.0343 3624 TBiosDrv ( UnsignedFile.Multi.Generic ) - warning
02:10:04.0343 3624 TBiosDrv - detected UnsignedFile.Multi.Generic (1)
02:10:04.0437 3624 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
02:10:04.0562 3624 Tcpip - ok
02:10:04.0843 3624 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
02:10:05.0312 3624 TDPIPE - ok
02:10:05.0468 3624 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
02:10:05.0906 3624 TDTCP - ok
02:10:05.0984 3624 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
02:10:06.0453 3624 TermDD - ok
02:10:06.0781 3624 TosIde - ok
02:10:06.0906 3624 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
02:10:07.0375 3624 Udfs - ok
02:10:07.0484 3624 ultra - ok
02:10:07.0625 3624 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
02:10:08.0156 3624 Update - ok
02:10:08.0265 3624 USBAAPL - ok
02:10:08.0390 3624 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
02:10:08.0859 3624 usbaudio - ok
02:10:09.0125 3624 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
02:10:09.0578 3624 usbccgp - ok
02:10:09.0734 3624 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
02:10:10.0187 3624 usbehci - ok
02:10:10.0515 3624 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
02:10:10.0984 3624 usbhub - ok
02:10:11.0171 3624 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
02:10:11.0593 3624 usbohci - ok
02:10:11.0687 3624 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
02:10:12.0140 3624 usbprint - ok
02:10:12.0453 3624 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
02:10:12.0875 3624 usbscan - ok
02:10:13.0031 3624 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
02:10:13.0500 3624 USBSTOR - ok
02:10:13.0562 3624 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
02:10:14.0031 3624 usbvideo - ok
02:10:14.0421 3624 USB_RNDIS (bee793d4a059caea55d6ac20e19b3a8f) C:\WINDOWS\system32\DRIVERS\usb8023.sys
02:10:14.0859 3624 USB_RNDIS - ok
02:10:14.0953 3624 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
02:10:15.0375 3624 usb_rndisx - ok
02:10:15.0718 3624 VComm - ok
02:10:15.0781 3624 VcommMgr - ok
02:10:15.0890 3624 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
02:10:16.0343 3624 VgaSave - ok
02:10:16.0390 3624 ViaIde - ok
02:10:16.0484 3624 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
02:10:16.0937 3624 VolSnap - ok
02:10:17.0359 3624 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
02:10:17.0796 3624 Wanarp - ok
02:10:17.0890 3624 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
02:10:18.0062 3624 wanatw - ok
02:10:18.0984 3624 Wdf01000 (4769596d7cc0f5fa447d2babc239672a) C:\WINDOWS\system32\Drivers\wdf01000.sys
02:10:19.0156 3624 Wdf01000 - ok
02:10:19.0296 3624 WDICA - ok
02:10:19.0375 3624 Wdm1 (2f4b3c0e58d4a7bd8e38d1cd9ca47691) C:\WINDOWS\system32\Drivers\usbbc.sys
02:10:19.0546 3624 Wdm1 - ok
02:10:19.0875 3624 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
02:10:20.0343 3624 wdmaud - ok
02:10:20.0671 3624 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
02:10:21.0171 3624 WSTCODEC - ok
02:10:21.0562 3624 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
02:10:21.0734 3624 WudfPf - ok
02:10:21.0890 3624 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
02:10:22.0015 3624 WudfRd - ok
02:10:22.0156 3624 MBR (0x1B8) (671b81004fdd1588fa9ed1331c9ceca9) \Device\Harddisk0\DR0
02:10:23.0015 3624 \Device\Harddisk0\DR0 - ok
02:10:23.0046 3624 Boot (0x1200) (def3bb30c44467891dc8b70fd9ee4f8e) \Device\Harddisk0\DR0\Partition0
02:10:23.0125 3624 \Device\Harddisk0\DR0\Partition0 - ok
02:10:23.0125 3624 ============================================================
02:10:23.0140 3624 Scan finished
02:10:23.0140 3624 ============================================================
02:10:23.0500 3740 Detected object count: 12
02:10:23.0500 3740 Actual detected object count: 12
02:10:59.0812 3740 C:\WINDOWS\system32\DRIVERS\AegisP.sys - copied to quarantine
02:10:59.0890 3740 AegisP ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:10:59.0984 3740 C:\WINDOWS\System32\Drivers\BANTExt.sys - copied to quarantine
02:11:00.0031 3740 BANTExt ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:00.0515 3740 C:\WINDOWS\system32\DRIVERS\HPZid412.sys - copied to quarantine
02:11:00.0593 3740 HPZid412 ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:00.0687 3740 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys - copied to quarantine
02:11:00.0718 3740 HPZipr12 ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:00.0796 3740 C:\WINDOWS\system32\DRIVERS\HPZius12.sys - copied to quarantine
02:11:00.0859 3740 HPZius12 ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:01.0296 3740 C:\WINDOWS\system32\DRIVERS\netdevio.sys - copied to quarantine
02:11:01.0375 3740 Netdevio ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:01.0484 3740 C:\WINDOWS\system32\drivers\pfc.sys - copied to quarantine
02:11:01.0515 3740 pfc ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:02.0031 3740 C:\WINDOWS\system32\Drivers\PxHelp20.sys - copied to quarantine
02:11:02.0109 3740 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:02.0203 3740 C:\WINDOWS\system32\drivers\qkbfiltr.sys - copied to quarantine
02:11:02.0265 3740 qkbfiltr ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:02.0656 3740 C:\WINDOWS\system32\drivers\qmofiltr.sys - copied to quarantine
02:11:02.0718 3740 qmofiltr ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:02.0843 3740 C:\WINDOWS\system32\drivers\StarOpen.sys - copied to quarantine
02:11:02.0875 3740 StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:11:03.0000 3740 C:\WINDOWS\system32\drivers\TBiosDrv.sys - copied to quarantine
02:11:03.0031 3740 TBiosDrv ( UnsignedFile.Multi.Generic ) - User select action: Quarantine
02:12:20.0515 1712 ============================================================
02:12:20.0515 1712 Scan started
02:12:20.0515 1712 Mode: Manual; SigCheck; TDLFS;
02:12:20.0515 1712 ============================================================
02:12:21.0296 1712 Abiosdsk - ok
02:12:21.0375 1712 abp480n5 - ok
02:12:21.0500 1712 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
02:12:22.0828 1712 ACPI - ok
02:12:23.0234 1712 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
02:12:23.0718 1712 ACPIEC - ok
02:12:24.0046 1712 adpu160m - ok
02:12:24.0156 1712 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
02:12:24.0562 1712 aec - ok
02:12:24.0656 1712 AegisP (2c5c22990156a1063e19ad162191dc1d) C:\WINDOWS\system32\DRIVERS\AegisP.sys
02:12:24.0671 1712 AegisP ( UnsignedFile.Multi.Generic ) - warning
02:12:24.0671 1712 AegisP - detected UnsignedFile.Multi.Generic (1)
02:12:24.0781 1712 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
02:12:24.0859 1712 AFD - ok
02:12:24.0921 1712 Aha154x - ok
02:12:24.0968 1712 aic78u2 - ok
02:12:25.0031 1712 aic78xx - ok
02:12:25.0125 1712 AliIde - ok
02:12:25.0171 1712 amsint - ok
02:12:25.0359 1712 AR5211 (d07ccc37476034ebf5de4608a8af4386) C:\WINDOWS\system32\DRIVERS\SHP5211.sys
02:12:25.0468 1712 AR5211 - ok
02:12:25.0531 1712 asc - ok
02:12:25.0578 1712 asc3350p - ok
02:12:25.0640 1712 asc3550 - ok
02:12:25.0781 1712 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
02:12:26.0187 1712 AsyncMac - ok
02:12:26.0296 1712 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
02:12:26.0687 1712 atapi - ok
02:12:27.0031 1712 Atdisk - ok
02:12:27.0218 1712 ati2mtag (d5537cc8cc9a86668e3903bd53caa83c) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
02:12:27.0390 1712 ati2mtag - ok
02:12:27.0500 1712 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
02:12:27.0906 1712 Atmarpc - ok
02:12:28.0000 1712 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
02:12:28.0515 1712 audstub - ok
02:12:28.0640 1712 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
02:12:28.0671 1712 avgio - ok
02:12:28.0953 1712 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
02:12:29.0000 1712 avgntflt - ok
02:12:29.0156 1712 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
02:12:29.0203 1712 avipbb - ok
02:12:29.0312 1712 BANTExt (5d7be7b19e827125e016325334e58ff1) C:\WINDOWS\System32\Drivers\BANTExt.sys
02:12:29.0328 1712 BANTExt ( UnsignedFile.Multi.Generic ) - warning
02:12:29.0328 1712 BANTExt - detected UnsignedFile.Multi.Generic (1)
02:12:29.0437 1712 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
02:12:29.0890 1712 Beep - ok
02:12:29.0968 1712 BlueletAudio - ok
02:12:30.0031 1712 BlueletSCOAudio - ok
02:12:30.0125 1712 BoiHwsetup (141befbd4f2a84a66e2f54b9e32e40d1) C:\WINDOWS\system32\drivers\BoiHwSetup.sys
02:12:30.0187 1712 BoiHwsetup - ok
02:12:30.0281 1712 BT - ok
02:12:30.0328 1712 Btcsrusb - ok
02:12:30.0406 1712 BTHidEnum - ok
02:12:30.0468 1712 BTHidMgr - ok
02:12:30.0578 1712 CAMCAUD (cce1f3c7c8e7383b90372229454999cf) C:\WINDOWS\system32\drivers\camc6aud.sys
02:12:30.0687 1712 CAMCAUD - ok
02:12:30.0984 1712 CAMCHALA (9a3bbde74dab737efa82de7ef4b40bea) C:\WINDOWS\system32\drivers\camc6hal.sys
02:12:31.0046 1712 CAMCHALA - ok
02:12:31.0125 1712 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
02:12:31.0578 1712 cbidf2k - ok
02:12:31.0718 1712 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
02:12:32.0125 1712 CCDECODE - ok
02:12:32.0203 1712 cd20xrnt - ok
02:12:32.0328 1712 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
02:12:32.0750 1712 Cdaudio - ok
02:12:32.0843 1712 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
02:12:33.0234 1712 Cdfs - ok
02:12:33.0312 1712 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
02:12:33.0703 1712 Cdrom - ok
02:12:34.0078 1712 Changer - ok
02:12:34.0218 1712 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
02:12:34.0703 1712 CmBatt - ok
02:12:35.0031 1712 CmdIde - ok
02:12:35.0140 1712 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
02:12:35.0546 1712 Compbatt - ok
02:12:35.0625 1712 Cpqarray - ok
02:12:35.0718 1712 dac2w2k - ok
02:12:35.0765 1712 dac960nt - ok
02:12:35.0875 1712 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
02:12:36.0265 1712 Disk - ok
02:12:36.0406 1712 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
02:12:36.0875 1712 dmboot - ok
02:12:36.0953 1712 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
02:12:37.0359 1712 dmio - ok
02:12:37.0421 1712 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
02:12:37.0875 1712 dmload - ok
02:12:38.0031 1712 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
02:12:38.0406 1712 DMusic - ok
02:12:38.0500 1712 dpti2o - ok
02:12:38.0578 1712 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
02:12:38.0968 1712 drmkaud - ok
02:12:39.0187 1712 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
02:12:39.0593 1712 Fastfat - ok
02:12:39.0687 1712 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
02:12:40.0078 1712 Fdc - ok
02:12:40.0500 1712 FilterService (b73ec688c29f81f9da0fcf63682b3ecb) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys
02:12:40.0546 1712 FilterService - ok
02:12:40.0640 1712 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
02:12:41.0000 1712 Fips - ok
02:12:41.0093 1712 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
02:12:41.0468 1712 Flpydisk - ok
02:12:41.0562 1712 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
02:12:41.0953 1712 FltMgr - ok
02:12:42.0062 1712 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
02:12:42.0500 1712 Fs_Rec - ok
02:12:42.0609 1712 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
02:12:43.0031 1712 Ftdisk - ok
02:12:43.0125 1712 GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
02:12:43.0156 1712 GEARAspiWDM - ok
02:12:43.0546 1712 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
02:12:43.0937 1712 Gpc - ok
02:12:44.0375 1712 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
02:12:44.0750 1712 HidUsb - ok
02:12:44.0812 1712 hpn - ok
02:12:44.0906 1712 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
02:12:44.0921 1712 HPZid412 ( UnsignedFile.Multi.Generic ) - warning
02:12:44.0921 1712 HPZid412 - detected UnsignedFile.Multi.Generic (1)
02:12:44.0968 1712 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
02:12:45.0000 1712 HPZipr12 ( UnsignedFile.Multi.Generic ) - warning
02:12:45.0000 1712 HPZipr12 - detected UnsignedFile.Multi.Generic (1)
02:12:45.0078 1712 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
02:12:45.0093 1712 HPZius12 ( UnsignedFile.Multi.Generic ) - warning
02:12:45.0093 1712 HPZius12 - detected UnsignedFile.Multi.Generic (1)
02:12:45.0156 1712 HTCAND32 - ok
02:12:45.0296 1712 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
02:12:45.0375 1712 HTTP - ok
02:12:45.0734 1712 i2omgmt - ok
02:12:45.0796 1712 i2omp - ok
02:12:45.0906 1712 i8042prt (

malady · 2011/12/15

4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
02:12:46.0296 1712 i8042prt - ok
02:12:46.0406 1712 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
02:12:46.0781 1712 Imapi - ok
02:12:46.0875 1712 ini910u - ok
02:12:46.0968 1712 IntelIde - ok
02:12:47.0062 1712 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
02:12:47.0453 1712 intelppm - ok
02:12:47.0531 1712 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
02:12:47.0921 1712 Ip6Fw - ok
02:12:48.0031 1712 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
02:12:48.0468 1712 IpFilterDriver - ok
02:12:48.0531 1712 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
02:12:48.0937 1712 IpInIp - ok
02:12:49.0031 1712 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
02:12:49.0437 1712 IpNat - ok
02:12:49.0796 1712 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
02:12:50.0203 1712 IPSec - ok
02:12:50.0312 1712 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
02:12:50.0703 1712 IRENUM - ok
02:12:50.0796 1712 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
02:12:51.0187 1712 isapnp - ok
02:12:51.0296 1712 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
02:12:51.0687 1712 Kbdclass - ok
02:12:51.0765 1712 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
02:12:52.0156 1712 kbdhid - ok
02:12:52.0250 1712 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
02:12:52.0781 1712 kmixer - ok
02:12:53.0171 1712 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
02:12:53.0281 1712 KSecDD - ok
02:12:53.0421 1712 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
02:12:53.0468 1712 Lbd - ok
02:12:53.0500 1712 lbrtfdc - ok
02:12:53.0640 1712 LVPr2Mon (1a7db7a00a4b0d8da24cd691a4547291) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
02:12:53.0671 1712 LVPr2Mon - ok
02:12:53.0796 1712 LVRS (37072ec9299e825f4335cc554b6fac6a) C:\WINDOWS\system32\DRIVERS\lvrs.sys
02:12:53.0843 1712 LVRS - ok
02:12:54.0593 1712 LVUVC (a240e42a7402e927a71b6e8aa4629b13) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
02:12:55.0406 1712 LVUVC - ok
02:12:55.0796 1712 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
02:12:56.0265 1712 mnmdd - ok
02:12:56.0359 1712 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
02:12:56.0734 1712 Modem - ok
02:12:56.0796 1712 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
02:12:57.0203 1712 Mouclass - ok
02:12:57.0312 1712 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
02:12:57.0750 1712 mouhid - ok
02:12:58.0125 1712 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
02:12:58.0640 1712 MountMgr - ok
02:12:58.0718 1712 mraid35x - ok
02:12:58.0906 1712 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
02:12:59.0375 1712 MRxDAV - ok
02:12:59.0515 1712 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
02:12:59.0609 1712 MRxSmb - ok
02:12:59.0703 1712 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
02:13:00.0078 1712 Msfs - ok
02:13:00.0203 1712 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
02:13:00.0578 1712 MSKSSRV - ok
02:13:00.0765 1712 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
02:13:01.0156 1712 MSPCLOCK - ok
02:13:01.0250 1712 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
02:13:01.0625 1712 MSPQM - ok
02:13:01.0703 1712 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
02:13:02.0093 1712 mssmbios - ok
02:13:02.0484 1712 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
02:13:02.0859 1712 MSTEE - ok
02:13:02.0953 1712 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
02:13:03.0031 1712 Mup - ok
02:13:03.0093 1712 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
02:13:03.0484 1712 NABTSFEC - ok
02:13:03.0593 1712 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
02:13:03.0984 1712 NDIS - ok
02:13:04.0031 1712 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
02:13:04.0421 1712 NdisIP - ok
02:13:04.0500 1712 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
02:13:04.0562 1712 NdisTapi - ok
02:13:04.0937 1712 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
02:13:05.0328 1712 Ndisuio - ok
02:13:05.0406 1712 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
02:13:05.0796 1712 NdisWan - ok
02:13:05.0875 1712 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
02:13:05.0937 1712 NDProxy - ok
02:13:06.0015 1712 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
02:13:06.0406 1712 NetBIOS - ok
02:13:06.0484 1712 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
02:13:06.0890 1712 NetBT - ok
02:13:07.0015 1712 Netdevio (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
02:13:07.0031 1712 Netdevio ( UnsignedFile.Multi.Generic ) - warning
02:13:07.0031 1712 Netdevio - detected UnsignedFile.Multi.Generic (1)
02:13:07.0500 1712 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
02:13:07.0890 1712 Npfs - ok
02:13:08.0015 1712 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
02:13:08.0453 1712 Ntfs - ok
02:13:08.0562 1712 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
02:13:09.0000 1712 Null - ok
02:13:09.0078 1712 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
02:13:09.0515 1712 NwlnkFlt - ok
02:13:09.0578 1712 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
02:13:10.0000 1712 NwlnkFwd - ok
02:13:10.0187 1712 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
02:13:10.0578 1712 Parport - ok
02:13:10.0656 1712 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
02:13:11.0046 1712 PartMgr - ok
02:13:11.0156 1712 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
02:13:11.0578 1712 ParVdm - ok
02:13:11.0968 1712 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
02:13:12.0359 1712 PCI - ok
02:13:12.0406 1712 PCIDump - ok
02:13:12.0531 1712 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
02:13:12.0953 1712 PCIIde - ok
02:13:13.0046 1712 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
02:13:13.0437 1712 Pcmcia - ok
02:13:13.0500 1712 PDCOMP - ok
02:13:13.0546 1712 PDFRAME - ok
02:13:13.0609 1712 PDRELI - ok
02:13:13.0656 1712 PDRFRAME - ok
02:13:13.0718 1712 perc2 - ok
02:13:13.0781 1712 perc2hib - ok
02:13:13.0921 1712 pfc (6c1618a07b49e3873582b6449e744088) C:\WINDOWS\system32\drivers\pfc.sys
02:13:13.0937 1712 pfc ( UnsignedFile.Multi.Generic ) - warning
02:13:13.0937 1712 pfc - detected UnsignedFile.Multi.Generic (1)
02:13:14.0046 1712 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
02:13:14.0437 1712 PptpMiniport - ok
02:13:14.0531 1712 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
02:13:14.0921 1712 PSched - ok
02:13:15.0062 1712 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
02:13:15.0484 1712 Ptilink - ok
02:13:15.0890 1712 PxHelp20 (25f7c4453f189f79eb3846d3e23805a0) C:\WINDOWS\system32\Drivers\PxHelp20.sys
02:13:15.0906 1712 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
02:13:15.0906 1712 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
02:13:16.0015 1712 qkbfiltr (c50faa6fda843fa2172aa2b9c3cd1dab) C:\WINDOWS\system32\drivers\qkbfiltr.sys
02:13:16.0015 1712 qkbfiltr ( UnsignedFile.Multi.Generic ) - warning
02:13:16.0015 1712 qkbfiltr - detected UnsignedFile.Multi.Generic (1)
02:13:16.0078 1712 ql1080 - ok
02:13:16.0140 1712 Ql10wnt - ok
02:13:16.0187 1712 ql12160 - ok
02:13:16.0234 1712 ql1240 - ok
02:13:16.0296 1712 ql1280 - ok
02:13:16.0359 1712 qmofiltr (8652b9e134c3478be948bf089df8ed5e) C:\WINDOWS\system32\drivers\qmofiltr.sys
02:13:16.0359 1712 qmofiltr ( UnsignedFile.Multi.Generic ) - warning
02:13:16.0359 1712 qmofiltr - detected UnsignedFile.Multi.Generic (1)
02:13:16.0421 1712 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
02:13:16.0875 1712 RasAcd - ok
02:13:17.0046 1712 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
02:13:17.0437 1712 Rasl2tp - ok
02:13:17.0515 1712 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
02:13:17.0921 1712 RasPppoe - ok
02:13:18.0015 1712 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
02:13:18.0437 1712 Raspti - ok
02:13:18.0531 1712 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
02:13:18.0937 1712 Rdbss - ok
02:13:19.0234 1712 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
02:13:19.0656 1712 RDPCDD - ok
02:13:20.0109 1712 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
02:13:20.0187 1712 RDPWD - ok
02:13:20.0296 1712 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
02:13:20.0687 1712 redbook - ok
02:13:20.0812 1712 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
02:13:21.0250 1712 ROOTMODEM - ok
02:13:21.0390 1712 RTL8023xp (4a0ae7891fcf74acc848b109294cb80f) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
02:13:21.0500 1712 RTL8023xp - ok
02:13:21.0562 1712 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
02:13:21.0906 1712 rtl8139 - ok
02:13:22.0343 1712 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
02:13:22.0734 1712 Secdrv - ok
02:13:22.0843 1712 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
02:13:23.0234 1712 Serenum - ok
02:13:23.0312 1712 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
02:13:23.0703 1712 Serial - ok
02:13:23.0843 1712 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
02:13:24.0328 1712 Sfloppy - ok
02:13:24.0453 1712 Sftfs (92d1002b9ace530f37f256d3d58e5867) C:\WINDOWS\system32\DRIVERS\Sftfsxp.sys
02:13:24.0546 1712 Sftfs - ok
02:13:24.0656 1712 Sftplay (5eb49d97a281c3e71b23c66b13a24a6d) C:\WINDOWS\system32\DRIVERS\Sftplayxp.sys
02:13:24.0703 1712 Sftplay - ok
02:13:24.0796 1712 Sftredir (e8192208cc8cf24b3a81774c8078259c) C:\WINDOWS\system32\DRIVERS\Sftredirxp.sys
02:13:24.0828 1712 Sftredir - ok
02:13:25.0156 1712 Sftvol (f21569a5e0f9e9cf6e32819e08abfa2d) C:\WINDOWS\system32\DRIVERS\Sftvolxp.sys
02:13:25.0187 1712 Sftvol - ok
02:13:25.0281 1712 Simbad - ok
02:13:25.0375 1712 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
02:13:25.0734 1712 SLIP - ok
02:13:25.0812 1712 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
02:13:26.0234 1712 SONYPVU1 - ok
02:13:26.0328 1712 Sparrow - ok
02:13:26.0421 1712 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
02:13:26.0796 1712 splitter - ok
02:13:26.0890 1712 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
02:13:27.0265 1712 sr - ok
02:13:27.0421 1712 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
02:13:27.0500 1712 Srv - ok
02:13:27.0875 1712 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
02:13:27.0890 1712 ssmdrv - ok
02:13:28.0046 1712 StarOpen (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys
02:13:28.0062 1712 StarOpen ( UnsignedFile.Multi.Generic ) - warning
02:13:28.0062 1712 StarOpen - detected UnsignedFile.Multi.Generic (1)
02:13:28.0187 1712 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
02:13:28.0578 1712 streamip - ok
02:13:28.0703 1712 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
02:13:29.0093 1712 swenum - ok
02:13:29.0203 1712 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
02:13:29.0609 1712 swmidi - ok
02:13:29.0984 1712 symc810 - ok
02:13:30.0046 1712 symc8xx - ok
02:13:30.0078 1712 sym_hi - ok
02:13:30.0156 1712 sym_u3 - ok
02:13:30.0250 1712 SynTP (eb363ddfbe8b6d51003ccab29d93d744) C:\WINDOWS\system32\DRIVERS\SynTP.sys
02:13:30.0328 1712 SynTP - ok
02:13:30.0421 1712 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
02:13:30.0796 1712 sysaudio - ok
02:13:30.0921 1712 TBiosDrv (eeca2b57545e7b7be949b5e70e31444f) C:\WINDOWS\system32\drivers\TBiosDrv.sys
02:13:30.0921 1712 TBiosDrv ( UnsignedFile.Multi.Generic ) - warning
02:13:30.0921 1712 TBiosDrv - detected UnsignedFile.Multi.Generic (1)
02:13:31.0031 1712 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
02:13:31.0109 1712 Tcpip - ok
02:13:31.0187 1712 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
02:13:31.0562 1712 TDPIPE - ok
02:13:31.0625 1712 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
02:13:32.0031 1712 TDTCP - ok
02:13:32.0437 1712 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
02:13:32.0812 1712 TermDD - ok
02:13:33.0203 1712 TosIde - ok
02:13:33.0312 1712 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
02:13:33.0718 1712 Udfs - ok
02:13:33.0765 1712 ultra - ok
02:13:33.0875 1712 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
02:13:34.0296 1712 Update - ok
02:13:34.0375 1712 USBAAPL - ok
02:13:34.0453 1712 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
02:13:34.0859 1712 usbaudio - ok
02:13:34.0953 1712 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
02:13:35.0343 1712 usbccgp - ok
02:13:35.0421 1712 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
02:13:35.0796 1712 usbehci - ok
02:13:35.0890 1712 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
02:13:36.0296 1712 usbhub - ok
02:13:36.0703 1712 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
02:13:37.0109 1712 usbohci - ok
02:13:37.0203 1712 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
02:13:37.0593 1712 usbprint - ok
02:13:37.0671 1712 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
02:13:38.0062 1712 usbscan - ok
02:13:38.0187 1712 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
02:13:38.0578 1712 USBSTOR - ok
02:13:38.0671 1712 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
02:13:39.0062 1712 usbvideo - ok
02:13:39.0171 1712 USB_RNDIS (bee793d4a059caea55d6ac20e19b3a8f) C:\WINDOWS\system32\DRIVERS\usb8023.sys
02:13:39.0546 1712 USB_RNDIS - ok
02:13:39.0906 1712 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
02:13:40.0296 1712 usb_rndisx - ok
02:13:40.0343 1712 VComm - ok
02:13:40.0421 1712 VcommMgr - ok
02:13:40.0500 1712 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
02:13:40.0875 1712 VgaSave - ok
02:13:40.0921 1712 ViaIde - ok
02:13:41.0015 1712 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
02:13:41.0406 1712 VolSnap - ok
02:13:41.0500 1712 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
02:13:41.0875 1712 Wanarp - ok
02:13:41.0984 1712 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
02:13:42.0046 1712 wanatw - ok
02:13:42.0171 1712 Wdf01000 (4769596d7cc0f5fa447d2babc239672a) C:\WINDOWS\system32\Drivers\wdf01000.sys
02:13:42.0250 1712 Wdf01000 - ok
02:13:42.0312 1712 WDICA - ok
02:13:42.0406 1712 Wdm1 (2f4b3c0e58d4a7bd8e38d1cd9ca47691) C:\WINDOWS\system32\Drivers\usbbc.sys
02:13:42.0453 1712 Wdm1 - ok
02:13:42.0828 1712 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
02:13:43.0218 1712 wdmaud - ok
02:13:43.0484 1712 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
02:13:43.0859 1712 WSTCODEC - ok
02:13:43.0968 1712 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
02:13:44.0046 1712 WudfPf - ok
02:13:44.0125 1712 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
02:13:44.0171 1712 WudfRd - ok
02:13:44.0296 1712 MBR (0x1B8) (671b81004fdd1588fa9ed1331c9ceca9) \Device\Harddisk0\DR0
02:13:44.0609 1712 \Device\Harddisk0\DR0 - ok
02:13:44.0640 1712 Boot (0x1200) (def3bb30c44467891dc8b70fd9ee4f8e) \Device\Harddisk0\DR0\Partition0
02:13:44.0640 1712 \Device\Harddisk0\DR0\Partition0 - ok
02:13:44.0656 1712 ============================================================
02:13:44.0656 1712 Scan finished
02:13:44.0656 1712
============================================================
02:13:44.0718 0336 Detected object count: 12
02:13:44.0718 0336 Actual detected object count: 12
02:15:10.0015 0336 HKLM\SYSTEM\ControlSet001\services\AegisP - will be deleted on reboot
02:15:10.0078 0336 HKLM\SYSTEM\ControlSet002\services\AegisP - will be deleted on reboot
02:15:10.0140 0336 C:\WINDOWS\system32\DRIVERS\AegisP.sys - will be deleted on reboot
02:15:10.0140 0336 AegisP ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0140 0336 HKLM\SYSTEM\ControlSet001\services\BANTExt - will be deleted on reboot
02:15:10.0140 0336 HKLM\SYSTEM\ControlSet002\services\BANTExt - will be deleted on reboot
02:15:10.0156 0336 C:\WINDOWS\System32\Drivers\BANTExt.sys - will be deleted on reboot
02:15:10.0156 0336 BANTExt ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0171 0336 HKLM\SYSTEM\ControlSet001\services\HPZid412 - will be deleted on reboot
02:15:10.0187 0336 HKLM\SYSTEM\ControlSet002\services\HPZid412 - will be deleted on reboot
02:15:10.0203 0336 C:\WINDOWS\system32\DRIVERS\HPZid412.sys - will be deleted on reboot
02:15:10.0203 0336 HPZid412 ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0218 0336 HKLM\SYSTEM\ControlSet001\services\HPZipr12 - will be deleted on reboot
02:15:10.0218 0336 HKLM\SYSTEM\ControlSet002\services\HPZipr12 - will be deleted on reboot
02:15:10.0234 0336 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys - will be deleted on reboot
02:15:10.0234 0336 HPZipr12 ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0250 0336 HKLM\SYSTEM\ControlSet001\services\HPZius12 - will be deleted on reboot
02:15:10.0250 0336 HKLM\SYSTEM\ControlSet002\services\HPZius12 - will be deleted on reboot
02:15:10.0265 0336 C:\WINDOWS\system32\DRIVERS\HPZius12.sys - will be deleted on reboot
02:15:10.0265 0336 HPZius12 ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0281 0336 HKLM\SYSTEM\ControlSet001\services\Netdevio - will be deleted on reboot
02:15:10.0296 0336 HKLM\SYSTEM\ControlSet002\services\Netdevio - will be deleted on reboot
02:15:10.0328 0336 C:\WINDOWS\system32\DRIVERS\netdevio.sys - will be deleted on reboot
02:15:10.0328 0336 Netdevio ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0343 0336 HKLM\SYSTEM\ControlSet001\services\pfc - will be deleted on reboot
02:15:10.0343 0336 HKLM\SYSTEM\ControlSet002\services\pfc - will be deleted on reboot
02:15:10.0359 0336 C:\WINDOWS\system32\drivers\pfc.sys - will be deleted on reboot
02:15:10.0359 0336 pfc ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0375 0336 HKLM\SYSTEM\ControlSet001\services\PxHelp20 - will be deleted on reboot
02:15:10.0375 0336 HKLM\SYSTEM\ControlSet002\services\PxHelp20 - will be deleted on reboot
02:15:10.0390 0336 C:\WINDOWS\system32\Drivers\PxHelp20.sys - will be deleted on reboot
02:15:10.0390 0336 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0390 0336 HKLM\SYSTEM\ControlSet001\services\qkbfiltr - will be deleted on reboot
02:15:10.0406 0336 HKLM\SYSTEM\ControlSet002\services\qkbfiltr - will be deleted on reboot
02:15:10.0406 0336 C:\WINDOWS\system32\drivers\qkbfiltr.sys - will be deleted on reboot
02:15:10.0406 0336 qkbfiltr ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0421 0336 HKLM\SYSTEM\ControlSet001\services\qmofiltr - will be deleted on reboot
02:15:10.0421 0336 HKLM\SYSTEM\ControlSet002\services\qmofiltr - will be deleted on reboot
02:15:10.0437 0336 C:\WINDOWS\system32\drivers\qmofiltr.sys - will be deleted on reboot
02:15:10.0437 0336 qmofiltr ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0453 0336 HKLM\SYSTEM\ControlSet001\services\StarOpen - will be deleted on reboot
02:15:10.0453 0336 HKLM\SYSTEM\ControlSet002\services\StarOpen - will be deleted on reboot
02:15:10.0468 0336 C:\WINDOWS\system32\drivers\StarOpen.sys - will be deleted on reboot
02:15:10.0468 0336 StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:10.0484 0336 HKLM\SYSTEM\ControlSet001\services\TBiosDrv - will be deleted on reboot
02:15:10.0484 0336 HKLM\SYSTEM\ControlSet002\services\TBiosDrv - will be deleted on reboot
02:15:10.0500 0336 C:\WINDOWS\system32\drivers\TBiosDrv.sys - will be deleted on reboot
02:15:10.0500 0336 TBiosDrv ( UnsignedFile.Multi.Generic ) - User select action: Delete
02:15:21.0125 3144 Deinitialize success

broni · 2011/12/15

Why did you quarantine all those files?
They all look legit.

broni · 2011/12/15

We posted at the same time.

Log in or Sign up

Solved Virus

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Virus

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Useful Searches