hijack this log file need help with analysis(Resolved)

Welcome Guest ( Log In | Register )

Newbie Help Forum > Viruses, Trojans, Spyware, etc.. > PC Cleanup Archive (resolved and inactive topics)

2 Pages

1 2 >

hijack this log file need help with analysis(Resolved)

Options

pletscjm View Member Profile Find Member's Posts	Apr 19 2009, 05:06 PM Post #1
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:02:58 AM, on 4/19/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\WINDOWS\arservice.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\WINDOWS\eHome\ehRecvr.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\ArcSoft\MediaImpression\PhotoViewer.exe C:\Program Files\Common Files\ArcSoft\Media Browser\ArcMediaService.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files\Azureus\Azureus.exe C:\WINDOWS\system32\ping.exe C:\Program Files\Ashampoo\Ashampoo Media Player+\AMPplus.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S O4 - HKCU\..\Run: [wblogon] C:\WINDOWS\system32\algg.exe O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe -t O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - Global Startup: Adobe Reader 7.0.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Reality Fusion GameCam SE.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.trymedia.com (HKLM) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-48.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 8167 bytes

Rorschach112 View Member Profile Find Member's Posts	Apr 20 2009, 02:32 PM Post #2
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	hello Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding. Please download SmitfraudFix (by S!Ri) to your Desktop. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Once in Safe Mode, double-click on SmitfraudFix.exe Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt Warning : running option #2 on a non infected computer will remove your Desktop background. Download Rooter.exe to your desktop Then doubleclick it to start the tool A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 20 2009, 05:55 PM Post #3
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	QUOTE(Rorschach112 @ Apr 20 2009, 08:32 AM) hello Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding. Please download SmitfraudFix (by S!Ri) to your Desktop. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Once in Safe Mode, double-click on SmitfraudFix.exe Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt Warning : running option #2 on a non infected computer will remove your Desktop background. Download Rooter.exe to your desktop Then doubleclick it to start the tool A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here SmitFraudFix v2.411 Scan done at 11:32:41.14, Mon 04/20/2009 Run from C:\Documents and Settings\Compaq_Administrator\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\Program Files\Applications\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243 HKLM\SYSTEM\CCS\Services\Tcpip\..\{FDC0725C-BAB3-40C8-B6ED-BD1926E05834}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243 HKLM\SYSTEM\CS1\Services\Tcpip\..\{FDC0725C-BAB3-40C8-B6ED-BD1926E05834}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! "System"="" »»»»»»»»»»»»»»»»»»»»»»»» RK.2 »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Rorschach112 View Member Profile Find Member's Posts	Apr 20 2009, 06:52 PM Post #4
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	post the Rooter log use add reply when posting -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 22 2009, 04:50 AM Post #5
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	Microsoft Windows XP Professional (5.1.2600) Service Pack 3 C:\ [Fixed] - NTFS - (Total:230071 Mo/Free:561 Mo) D:\ [Fixed] - FAT32 - (Total:8376 Mo/Free:541 Mo) E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) F:\ [Removable] (Total:0 Mo/Free:0 Mo) G:\ [Removable] (Total:0 Mo/Free:0 Mo) H:\ [Removable] (Total:0 Mo/Free:0 Mo) I:\ [Removable] (Total:0 Mo/Free:0 Mo) Tue 04/21/2009\|23:47 ----------------------\\ Processes.. --Locked-- [System Process] ---------- System ---------- \SystemRoot\System32\smss.exe ---------- \??\C:\WINDOWS\system32\csrss.exe ---------- \??\C:\WINDOWS\system32\winlogon.exe ---------- C:\WINDOWS\system32\services.exe ---------- C:\WINDOWS\system32\lsass.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ---------- C:\WINDOWS\Explorer.EXE ---------- C:\Program Files\Alwil Software\Avast4\ashServ.exe ---------- C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE ---------- C:\WINDOWS\system32\RunDll32.exe ---------- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe ---------- C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe ---------- C:\windows\system\hpsysdrv.exe ---------- C:\Program Files\Java\jre6\bin\jusched.exe ---------- C:\Program Files\Messenger\msmsgs.exe ---------- C:\WINDOWS\system32\ctfmon.exe ---------- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ---------- C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe ---------- C:\WINDOWS\system32\spoolsv.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe ---------- C:\WINDOWS\arservice.exe ---------- C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe ---------- C:\WINDOWS\eHome\ehRecvr.exe ---------- C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe ---------- C:\WINDOWS\eHome\ehSched.exe ---------- C:\Program Files\Java\jre6\bin\jqs.exe ---------- C:\Program Files\Common Files\LightScribe\LSSrvc.exe ---------- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE ---------- C:\WINDOWS\system32\nvsvc32.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\ehome\mcrdsvc.exe ---------- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe ---------- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe ---------- C:\WINDOWS\System32\alg.exe ---------- C:\WINDOWS\system32\dllhost.exe ---------- C:\Program Files\Ashampoo\Ashampoo Media Player+\AMPplus.exe ---------- C:\Program Files\Azureus\Azureus.exe ---------- C:\Program Files\Common Files\Real\Update_OB\realsched.exe ---------- C:\WINDOWS\system32\ping.exe ---------- C:\WINDOWS\eHome\ehRec.exe ---------- C:\Program Files\Mozilla Firefox\firefox.exe ---------- C:\WINDOWS\system32\cmd.exe ---------- C:\Rooter$\RK.exe ----------------------\\ Search.. ----------------------\\ ROOTKIT !! ----------------------\\ Cracks & Keygens.. C:\DOCUME~1\COMPAQ~1\My Documents\school related\Ashampoo.MultiKeygen.exe 1 - "C:\Rooter$\Rooter_1.txt" - Tue 04/21/2009\|23:49 ----------------------\\ Scan completed at 23:49

Rorschach112 View Member Profile Find Member's Posts	Apr 22 2009, 10:48 AM Post #6
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	don't download keygens Please download OTMoveIt3 by OldTimer Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes explorer.exe :Services :Reg :Files C:\DOCUME~1\COMPAQ~1\My Documents\school related\Ashampoo.MultiKeygen.exe :Commands [purity] [emptytemp] [start explorer] [Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. Download OTListIt2 to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Under Custom Scan paste this in netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %systemroot%\System32\antiwpa.dll %systemroot%\SYSTEM32\wpa.dll %systemroot%\setup\scripts\biestart.exe %systemroot%\system32\drivers\royal.sys %SYSTEMDRIVE%\. %PROGRAMFILES%\. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 22 2009, 02:49 PM Post #7
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	I don't mean to sound uninformed but what is a keygen? What is this process going to clean? Thank you for your help btw

Rorschach112 View Member Profile Find Member's Posts	Apr 22 2009, 04:36 PM Post #8
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	keygen is an illegal program to crack a program -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 23 2009, 09:20 PM Post #9
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	Is there any way you can be more specific? Again I am sorry and I do appreciate your help, I just would like to know what exactly it is that you are having me do.

Rorschach112 View Member Profile Find Member's Posts	Apr 24 2009, 10:53 AM Post #10
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	Do you want me to clean the malware or not ? I would be here all day if I had to explain every step -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 24 2009, 02:07 PM Post #11
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\DOCUME~1\COMPAQ~1\My Documents\school related\Ashampoo.MultiKeygen.exe moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\hsperfdata_Compaq_Administrator\2776 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\e4j2.tmp_dir11256\exe4jlib.jar scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\etilqs_3BNeAMScndSUXKosJyZk scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-gdip-win32-3448.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-win32-3448.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF862.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\E4N6BGBP\ad_iframe[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\E4N6BGBP\browse[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\9K6WOU4V\ads[2].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\9K6WOU4V\ddc[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_1ec.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_630.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04242009_085738 Files moved on Reboot... File C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\hsperfdata_Compaq_Administrator\2776 not found! C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\e4j2.tmp_dir11256\exe4jlib.jar moved successfully. File C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\etilqs_3BNeAMScndSUXKosJyZk not found! DllUnregisterServer procedure not found in C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-gdip-win32-3448.dll C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-gdip-win32-3448.dll NOT unregistered. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-gdip-win32-3448.dll moved successfully. DllUnregisterServer procedure not found in C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-win32-3448.dll C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-win32-3448.dll NOT unregistered. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\swt-win32-3448.dll moved successfully. File C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DFF862.tmp not found! C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\E4N6BGBP\ad_iframe[1].htm moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\E4N6BGBP\browse[1].htm moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\9K6WOU4V\ads[2].htm moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\9K6WOU4V\ddc[1].htm moved successfully. File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. C:\WINDOWS\temp\Perflib_Perfdata_1ec.dat moved successfully. File C:\WINDOWS\temp\Perflib_Perfdata_630.dat not found! C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\urlclassifier3.sqlite moved successfully. C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\pvwfhtyz.default\XUL.mfl moved successfully.

pletscjm View Member Profile Find Member's Posts	Apr 24 2009, 02:15 PM Post #13
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	OTListIt logfile created on: 4/24/2009 9:10:18 AM - Run 1 OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\Compaq_Administrator\Desktop Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 1.69 Gb Total Physical Memory \| 1.29 Gb Available Physical Memory \| 76.60% Memory free 3.32 Gb Paging File \| 2.93 Gb Available in Paging File \| 88.24% Paging File free Paging file location(s): C:\pagefile.sys 1821 2880; %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 224.68 Gb Total Space \| 76.89 Gb Free Space \| 34.22% Space Free \| Partition Type: NTFS Drive D: \| 8.18 Gb Total Space \| 0.53 Gb Free Space \| 6.46% Space Free \| Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: YOUR-4DACD0EA75 Current User Name: Compaq_Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) PRC - C:\WINDOWS\arservice.exe (Microsoft) PRC - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe () PRC - C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation) PRC - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe () PRC - C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation) PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation) PRC - C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation) PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) PRC - C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE (Logitech Inc.) PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) PRC - C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe () PRC - C:\Documents and Settings\Compaq_Administrator\Desktop\OTListIt2.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (ACDaemon [Auto \| Running]) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) SRV - (ARSVC [Auto \| Running]) -- C:\WINDOWS\arservice.exe (Microsoft) SRV - (aspnet_state [On_Demand \| Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (aswUpdSv [Auto \| Running]) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) SRV - (avast! Antivirus [Auto \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) SRV - (avast! Mail Scanner [On_Demand \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) SRV - (avast! Web Scanner [On_Demand \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) SRV - (Belkin Wireless USB Network Adapter Service [Auto \| Running]) -- C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe () SRV - (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ehRecvr [Auto \| Running]) -- C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation) SRV - (ehSched [Auto \| Running]) -- C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation) SRV - (getPlus® Helper [On_Demand \| Stopped]) -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (NOS Microsystems Ltd.) SRV - (helpsvc [Auto \| Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IDriverT [On_Demand \| Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (JavaQuickStarterService [Auto \| Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) SRV - (LightScribeService [Auto \| Running]) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) SRV - (McrdSvc [Auto \| Running]) -- C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation) SRV - (MDM [Auto \| Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) SRV - (MHN [On_Demand \| Stopped]) -- C:\WINDOWS\System32\mhn.dll (Microsoft Corporation) SRV - (NVSvc [Auto \| Running]) -- C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation) SRV - (ose [On_Demand \| Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (WMPNetworkSvc [On_Demand \| Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (Aavmker4 [System \| Running]) -- C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software) DRV - (AegisP [Auto \| Running]) -- C:\WINDOWS\system32\DRIVERS\AegisP.sys (Meetinghouse Data Communications) DRV - (Afc [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\Afc.sys (Arcsoft, Inc.) DRV - (AgereSoftModem [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\AGRSM.sys (Agere Systems) DRV - (AmdK8 [System \| Running]) -- C:\WINDOWS\system32\DRIVERS\AmdK8.sys (Advanced Micro Devices) DRV - (aswFsBlk [Auto \| Running]) -- C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys (ALWIL Software) DRV - (aswMon2 [Auto \| Running]) -- C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software) DRV - (aswRdr [On_Demand \| Running]) -- C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software) DRV - (aswSP [System \| Running]) -- C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software) DRV - (aswTdi [System \| Running]) -- C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software) DRV - (BCM42RLY [On_Demand \| Stopped]) -- C:\WINDOWS\System32\BCM42RLY.SYS (Broadcom Corporation) DRV - (cmuda3 [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\cmuda3.sys (C-Media Inc) DRV - (CoachUsb [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\CoachUsb.sys (FotoNation Ltd.) DRV - (hcwPP2 [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\hcwPP2.sys (Hauppauge Computer Works, Inc.) DRV - (HDAudBus [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (iaStor [Boot \| Running]) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (IntcAzAudAddService [On_Demand \| Stopped]) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (IrBus [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\IrBus.sys (Microsoft Corporation) DRV - (ndiscm [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\NetMotCM.sys (Motorola Inc.) DRV - (nv [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (NVENETFD [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys (NVIDIA Corporation) DRV - (nvnetbus [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\nvnetbus.sys (NVIDIA Corporation) DRV - (Ps2 [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\PS2.sys (Hewlett-Packard Company) DRV - (Ptilink [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot \| Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (QCDonner [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\OVCD.sys (Microsoft Corporation) DRV - (RimVSerPort [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\RimSerial.sys (Research in Motion Ltd) DRV - (ROOTMODEM [On_Demand \| Stopped]) -- C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation) DRV - (RT73 [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\rt73.sys (Ralink Technology, Corp.) DRV - (rtl8139 [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation) DRV - (SASDIFSV [System \| Running]) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASENUM [On_Demand \| Running]) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASKUTIL [System \| Running]) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (Secdrv [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (SRS_SSCFilter [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\srs_sscfilter_i386.sys () DRV - (TPkd [Boot \| Running]) -- C:\WINDOWS\System32\drivers\TPkd.sys (PACE Anti-Piracy, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://news.yahoo.com; IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com; IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\CNNSI, = search.sportsillustrated.cnn.com/pages/search.jsp?query=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Dictionary, = dictionary.reference.com/search?q=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Google, = google.com/search?q=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleGroups, = groups-beta.google.com/groups?q=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleImages, = images.google.com/images?hl=en&lr=&q=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\GoogleNews, = news.google.com/news?tab=gn&hl=en&ie=UTF-8&q=%s&btnG=Search+News IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\KB, = support.microsoft.com/search/default.aspx?query=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\KBDLL, = support.microsoft.com/dllhelp/default.aspx?dlltype=file&l=55&alpha=%s&S=1 IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Movies, = fandango.com/my_box_office.asp?searchby=2&txtCityZip=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\MSN, = search.msn.com/results.asp?q=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Thesaurus, = thesaurus.reference.com/search?q=%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Weather, = weather.com/weather/local/%s IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\Yahoo, = search.yahoo.com/search?p=%s IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "www.google.com" FF - prefs.js..extensions.enabledItems: autopager@mozilla.org:0.5.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.2 FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2d}:1.2.3 FF - prefs.js..extensions.enabledItems: RCE@jerryqian.com:0.8.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.9 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD [2008/09/16 18:33:35 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/19 14:07:41 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.9\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/23 08:05:15 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.9\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/23 08:05:15 \| 00,000,000 \| ---D \| M] [2009/03/22 17:29:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mozilla\Extensions [2009/03/22 17:29:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/04/24 09:04:09 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mozilla\Firefox\Profiles\pvwfhtyz.default\extensions [2009/03/31 17:03:30 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mozilla\Firefox\Profiles\pvwfhtyz.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2d} [2009/04/24 09:04:04 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mozilla\Firefox\Profiles\pvwfhtyz.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2009/04/24 09:04:03 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mozilla\Firefox\Profiles\pvwfhtyz.default\extensions\autopager@mozilla.org [2009/03/22 17:42:27 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mozilla\Firefox\Profiles\pvwfhtyz.default\extensions\RCE@jerryqian.com [2008/09/20 00:52:06 \| 00,000,273 \| ---- \| M] () -- C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\FireFox\Profiles\pvwfhtyz.default\searchplugins\search.xml [2009/04/24 09:04:09 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions [2009/04/23 08:05:07 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/04/13 16:49:43 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009/04/23 08:05:07 \| 00,023,032 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/04/23 08:05:07 \| 00,134,648 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2009/02/19 14:33:08 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2009/02/19 14:33:08 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/02/19 14:33:08 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/02/19 14:33:08 \| 00,002,343 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2009/02/19 14:33:08 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/02/19 14:33:08 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/02/19 14:33:08 \| 00,000,792 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (909 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - Reg Error: Key error. File not found O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll File not found O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Key error. File not found O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (FlashFXP Helper for Internet Explorer) - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Program Files\FlashFXP\IEFlash.dll (IniCom Networks, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - Reg Error: Key error. File not found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found O4 - HKLM..\Run: [Alcmtr] ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd File not found O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company) O4 - HKLM..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE (Logitech Inc.) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] nwiz.exe /install () O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.) O4 - HKCU..\Run: [DriverUpdaterPro] C:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe -t File not found O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation) O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKCU..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader 7.0.lnk = C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70900000002}\SC_Reader_PM.ico File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Reality Fusion GameCam SE.lnk = C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Sites: trymedia.com ([]http in Trusted sites) O15 - HKLM\..Trusted Sites: trymedia.com ([]https in Trusted sites) O15 - HKLM\..Trusted Domains: 46 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-48.cab (EPUImageControl Class) O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo...otoUploader.cab (Facebook Photo Uploader Control) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx (Get_ActiveX Control) O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cab (get_atlcom Class) O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.) O18 - Protocol\Handler\httpx00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\httpsx00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ippx00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaippx00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ] O32 - Autorun File - D:\AUTOEXEC.BAT () - [ FAT32 ] O32 - Autorun File - D:\Autorun.inf () - [ FAT32 ] O33 - MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\Shell - "" = AutoRun O33 - MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found NetSvcs: 6to4 - NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll (Microsoft Corporation) NetSvcs: AudioSrv - C:\WINDOWS\System32\audiosrv.dll (Microsoft Corporation) NetSvcs: Browser - C:\WINDOWS\System32\browser.dll (Microsoft Corporation) NetSvcs: CryptSvc - C:\WINDOWS\System32\cryptsvc.dll (Microsoft Corporation) NetSvcs: DMServer - C:\WINDOWS\System32\dmserver.dll (Microsoft Corp.) NetSvcs: DHCP - C:\WINDOWS\System32\dhcpcsvc.dll (Microsoft Corporation) NetSvcs: ERSvc - C:\WINDOWS\System32\ersvc.dll (Microsoft Corporation) NetSvcs: EventSystem - C:\WINDOWS\system32\es.dll (Microsoft Corporation) NetSvcs: FastUserSwitchingCompatibility - C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation) NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll (Microsoft Corporation) NetSvcs: Ias - NetSvcs: Iprip - NetSvcs: Irmon - NetSvcs: LanmanServer - C:\WINDOWS\System32\srvsvc.dll (Microsoft Corporation) NetSvcs: LanmanWorkstation - C:\WINDOWS\System32\wkssvc.dll (Microsoft Corporation) NetSvcs: Messenger - C:\WINDOWS\System32\msgsvc.dll (Microsoft Corporation) NetSvcs: Netman - C:\WINDOWS\System32\netman.dll (Microsoft Corporation) NetSvcs: Nla - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation) NetSvcs: Ntmssvc - C:\WINDOWS\system32\ntmssvc.dll (Microsoft Corporation) NetSvcs: NWCWorkstation - NetSvcs: Nwsapagent - NetSvcs: Rasauto - C:\WINDOWS\System32\rasauto.dll (Microsoft Corporation) NetSvcs: Rasman - C:\WINDOWS\System32\rasmans.dll (Microsoft Corporation) NetSvcs: Remoteaccess - C:\WINDOWS\System32\mprdim.dll (Microsoft Corporation) NetSvcs: Schedule - C:\WINDOWS\system32\schedsvc.dll (Microsoft Corporation) NetSvcs: Seclogon - C:\WINDOWS\System32\seclogon.dll (Microsoft Corporation) NetSvcs: SENS - C:\WINDOWS\system32\sens.dll (Microsoft Corporation) NetSvcs: Sharedaccess - C:\WINDOWS\System32\ipnathlp.dll (Microsoft Corporation) NetSvcs: SRService - C:\WINDOWS\system32\srsvc.dll (Microsoft Corporation) NetSvcs: Tapisrv - C:\WINDOWS\System32\tapisrv.dll (Microsoft Corporation) NetSvcs: Themes - C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation) NetSvcs: TrkWks - C:\WINDOWS\system32\trkwks.dll (Microsoft Corporation) NetSvcs: W32Time - C:\WINDOWS\system32\w32time.dll (Microsoft Corporation) NetSvcs: WZCSVC - C:\WINDOWS\System32\wzcsvc.dll (Microsoft Corporation) NetSvcs: Wmi - C:\WINDOWS\System32\advapi32.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - NetSvcs: winmgmt - C:\WINDOWS\system32\wbem\WMIsvc.dll (Microsoft Corporation) NetSvcs: wscsvc - C:\WINDOWS\system32\wscsvc.dll (Microsoft Corporation) NetSvcs: xmlprov - C:\WINDOWS\System32\xmlprov.dll (Microsoft Corporation) NetSvcs: MHN - C:\WINDOWS\System32\mhn.dll (Microsoft Corporation) NetSvcs: BITS - C:\WINDOWS\system32\qmgr.dll (Microsoft Corporation) NetSvcs: wuauserv - C:\WINDOWS\system32\wuauserv.dll (Microsoft Corporation) NetSvcs: ShellHWDetection - C:\WINDOWS\System32\shsvcs.dll (Microsoft Corporation) NetSvcs: helpsvc - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) NetSvcs: WmdmPmSN - C:\WINDOWS\system32\MsPMSNSv.dll (Microsoft Corporation) NetSvcs: napagent - C:\WINDOWS\System32\qagentrt.dll (Microsoft Corporation) NetSvcs: hkmsvc - C:\WINDOWS\System32\kmsvc.dll (Microsoft Corporation) MsConfig - StartUpReg: AlwaysReady Power Message APP* - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\ARPWRMSG.EXE (Microsoft) MsConfig - StartUpReg: ctfmon.exe - hkey=HKCU - key=Software\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\system32\ctfmon.exe (Microsoft Corporation) MsConfig - StartUpReg: DISCover - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - File not found MsConfig - StartUpReg: DiscUpdateManager - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %ProgramFiles%\DISC\DiscUpdMgr.exe File not found MsConfig - StartUpReg: ehTray - hkey=HKLM - key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\ehome\ehtray.exe (Microsoft Corporation) MsConfig - StartUpReg: HP Software Update - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %ProgramFiles%\HP\HP Software Update\HPwuSchd2.exe File not found MsConfig - StartUpReg: HPBootOp - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %ProgramFiles%\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe File not found MsConfig - StartUpReg: MSMSGS - hkey=HKCU - key=Software\Microsoft\Windows\CurrentVersion\Run - %ProgramFiles%\Messenger\msmsgs.exe (Microsoft Corporation) MsConfig - StartUpReg: NvCplDaemon - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\system32\NvCpl.DLL (NVIDIA Corporation) MsConfig - StartUpReg: NvMediaCenter - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\system32\NvMcTray.DLL (NVIDIA Corporation) MsConfig - StartUpReg: nwiz - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\system32\nwiz.exe () MsConfig - StartUpReg: PCDrProfiler - hkey=HKLM - key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run - File not found MsConfig - StartUpReg: Recguard - hkey=HKLM - key=Software\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\SMINST\RECGUARD.EXE () MsConfig - StartUpReg: Reminder - hkey=HKLM - key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run - %SystemRoot%\Creator\Remind_XP.exe (SoftThinks) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll (Microsoft Corporation) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: CryptSvc - %SystemRoot%\System32\cryptsvc.dll (Microsoft Corporation) SafeBootMin: DcomLaunch - %SystemRoot%\system32\rpcss.dll (Microsoft Corporation) SafeBootMin: dmadmin - %SystemRoot%\System32\dmadmin.exe (Microsoft Corp., Veritas Software) SafeBootMin: dmboot.sys - %SystemRoot%\System32\drivers\dmboot.sys (Microsoft Corp., Veritas Software) SafeBootMin: dmio.sys - %SystemRoot%\System32\drivers\dmio.sys (Microsoft Corp., Veritas Software) SafeBootMin: dmload.sys - %SystemRoot%\System32\drivers\dmload.sys (Microsoft Corp., Veritas Software.) SafeBootMin: dmserver - %SystemRoot%\System32\dmserver.dll (Microsoft Corp.) SafeBootMin: EventLog - %SystemRoot%\system32\services.exe (Microsoft Corporation) SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - %SystemRoot%\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SafeBootMin: Netlogon - %SystemRoot%\system32\lsass.exe (Microsoft Corporation) SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PlugPlay - %SystemRoot%\system32\services.exe (Microsoft Corporation) SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: RpcSs - %SystemRoot%\system32\rpcss.dll (Microsoft Corporation) SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: sr.sys - %SystemRoot%\system32\DRIVERS\sr.sys (Microsoft Corporation) SafeBootMin: SRService - %SystemRoot%\system32\srsvc.dll (Microsoft Corporation) SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: vgasave.sys - %SystemRoot%\System32\drivers\vga.sys (Microsoft Corporation) SafeBootMin: WinMgmt - %SystemRoot%\system32\wbem\WMIsvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: AFD - %SystemRoot%\System32\drivers\afd.sys (Microsoft Corporation) SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll (Microsoft Corporation) SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: Browser - %SystemRoot%\System32\browser.dll (Microsoft Corporation) SafeBootNet: CryptSvc - %SystemRoot%\System32\cryptsvc.dll (Microsoft Corporation) SafeBootNet: DcomLaunch - %SystemRoot%\system32\rpcss.dll (Microsoft Corporation) SafeBootNet: Dhcp - %SystemRoot%\System32\dhcpcsvc.dll (Microsoft Corporation) SafeBootNet: dmadmin - %SystemRoot%\System32\dmadmin.exe (Microsoft Corp., Veritas Software) SafeBootNet: dmboot.sys - %SystemRoot%\System32\drivers\dmboot.sys (Microsoft Corp., Veritas Software) SafeBootNet: dmio.sys - %SystemRoot%\System32\drivers\dmio.sys (Microsoft Corp., Veritas Software) SafeBootNet: dmload.sys - %SystemRoot%\System32\drivers\dmload.sys (Microsoft Corp., Veritas Software.) SafeBootNet: dmserver - %SystemRoot%\System32\dmserver.dll (Microsoft Corp.) SafeBootNet: DnsCache - %SystemRoot%\System32\dnsrslvr.dll (Microsoft Corporation) SafeBootNet: EventLog - %SystemRoot%\system32\services.exe (Microsoft Corporation) SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - %SystemRoot%\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SafeBootNet: ip6fw.sys - %SystemRoot%\system32\drivers\ip6fw.sys (Microsoft Corporation) SafeBootNet: ipnat.sys - %SystemRoot%\system32\DRIVERS\ipnat.sys (Microsoft Corporation) SafeBootNet: LanmanServer - %SystemRoot%\System32\srvsvc.dll (Microsoft Corporation) SafeBootNet: LanmanWorkstation - %SystemRoot%\System32\wkssvc.dll (Microsoft Corporation) SafeBootNet: LmHosts - %SystemRoot%\System32\lmhsvc.dll (Microsoft Corporation) SafeBootNet: Messenger - %SystemRoot%\System32\msgsvc.dll (Microsoft Corporation) SafeBootNet: NDIS - %SystemRoot%\System32\drivers\ndis.sys (Microsoft Corporation) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: Ndisuio - %SystemRoot%\system32\DRIVERS\ndisuio.sys (Microsoft Corporation) SafeBootNet: NetBIOS - %SystemRoot%\system32\DRIVERS\netbios.sys (Microsoft Corporation) SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetBT - %SystemRoot%\system32\DRIVERS\netbt.sys (Microsoft Corporation) SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Netlogon - %SystemRoot%\system32\lsass.exe (Microsoft Corporation) SafeBootNet: NetMan - %SystemRoot%\System32\netman.dll (Microsoft Corporation) SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NtLmSsp - %SystemRoot%\system32\lsass.exe (Microsoft Corporation) SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PlugPlay - %SystemRoot%\system32\services.exe (Microsoft Corporation) SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdpcdd.sys - %SystemRoot%\System32\DRIVERS\RDPCDD.sys (Microsoft Corporation) SafeBootNet: rdpdd.sys - %SystemRoot%\System32\rdpdd.dll (Microsoft Corporation) SafeBootNet: rdpwd.sys - %SystemRoot%\System32\drivers\rdpwd.sys (Microsoft Corporation) SafeBootNet: rdsessmgr - %SystemRoot%\system32\sessmgr.exe (Microsoft Corporation) SafeBootNet: RpcSs - %SystemRoot%\system32\rpcss.dll (Microsoft Corporation) SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: SharedAccess - %SystemRoot%\System32\ipnathlp.dll (Microsoft Corporation) SafeBootNet: sr.sys - %SystemRoot%\system32\DRIVERS\sr.sys (Microsoft Corporation) SafeBootNet: SRService - %SystemRoot%\system32\srsvc.dll (Microsoft Corporation) SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: Tcpip - %SystemRoot%\system32\DRIVERS\tcpip.sys (Microsoft Corporation) SafeBootNet: TDI - Driver Group SafeBootNet: tdpipe.sys - %SystemRoot%\System32\drivers\tdpipe.sys (Microsoft Corporation) SafeBootNet: tdtcp.sys - %SystemRoot%\System32\drivers\tdtcp.sys (Microsoft Corporation) SafeBootNet: termservice - %SystemRoot%\System32\termsrv.dll (Microsoft Corporation) SafeBootNet: vga.sys - Driver SafeBootNet: vgasave.sys - %SystemRoot%\System32\drivers\vga.sys (Microsoft Corporation) SafeBootNet: WinMgmt - %SystemRoot%\system32\wbem\WMIsvc.dll (Microsoft Corporation) SafeBootNet: WZCSVC - %SystemRoot%\System32\wzcsvc.dll (Microsoft Corporation) SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error. SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {0430454D-47EA-11D6-AD58-00010333D0AD} - Yahoo! Import WAB ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {0E92DD42-76F5-4EF2-B381-F9C1D72BE23D} - Security Update for Microsoft .NET Framework 2.0 (KB922770) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML) ActiveX: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} - ActiveX: {1BC46932-21B2-4130-86E0-B4EB4F7A7A7B} - Microsoft .NET Framework 1.0 Hotfix (KB887998) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {29D2E297-B1FD-41AA-8123-ECBE547AA58E} - Yahoo! Toolbar for Internet Explorer ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {407408d4-94ed-4d86-ab69-a7f649d112ee} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} - Reg Error: Value error. ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} - Security Update for Microsoft .NET Framework 2.0 (KB928365) ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser ActiveX: {8D1D0E9A-C799-4D28-9E29-0061D1E66E43} - Microsoft .NET Framework 1.1 Hotfix (KB928366) ActiveX: {924C1588-90C3-4910-B6CA-D57A1C0418FE} - ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider ActiveX: {967B098A-042D-4367-BAC9-8BC11684174F} - Security Update for Microsoft .NET Framework 2.0 (KB917283) ActiveX: {BDE0FA43-6952-4BA8-8C58-09AF690F88E1} - Microsoft .NET Framework 1.0 Hotfix (KB930494) ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E3BF3F59-9A82-4D0A-82D8-7AE91464EB39} - Yahoo! IE7 Tracking ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {EA29D410-CE41-4953-A862-2DE706A1DAD7} - Microsoft .NET Framework 1.0 Service Pack 3 ActiveX: {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - .NET Framework ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE ActiveX: >{7715C0A7-4389-4AC6-9944-131E9822270F} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE ActiveX: KB910393 - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall ActiveX: Microsoft Base Smart Card Crypto Provider Package - Drivers32: aux - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: midi - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\WINDOWS\system32\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.ac3filter - C:\WINDOWS\system32\ac3filter.acm () Drivers32: msacm.alf2cd - C:\WINDOWS\system32\alf2cd.acm (NCT Company) Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.imaadpcm - C:\WINDOWS\system32\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\WINDOWS\system32\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msaudio1 - C:\WINDOWS\system32\msaud32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\WINDOWS\system32\msg711.acm (Microsoft Corporation) Drivers32: msacm.msg723 - C:\WINDOWS\system32\msg723.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\WINDOWS\system32\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.scg726 - C:\WINDOWS\system32\scg726.acm (SHARP Corporation) Drivers32: msacm.sl_anet - C:\WINDOWS\system32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\system32\tssoft32.acm (DSP GROUP, INC.) Drivers32: msacm.vorbis - C:\WINDOWS\system32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/) Drivers32: msacm.voxacm160 - C:\WINDOWS\system32\vct3216.acm (Voxware, Inc.) Drivers32: MSVideo8 - C:\WINDOWS\system32\VfWWDM32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\system32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\WINDOWS\system32\DivX.dll (DivX, Inc.) Drivers32: vidc.dvsd - C:\WINDOWS\system32\mcdvd_32.dll (MainConcept) Drivers32: VIDC.FFDS - C:\WINDOWS\system32\ff_vfw.dll () Drivers32: VIDC.I420 - C:\WINDOWS\system32\msh263.drv (Microsoft Corporation) Drivers32: vidc.iv31 - C:\WINDOWS\system32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\system32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\system32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\system32\ir50_32.dll (Intel Corporation) Drivers32: VIDC.IYUV - C:\WINDOWS\system32\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.M261 - C:\WINDOWS\system32\msh261.drv (Microsoft Corporation) Drivers32: vidc.M263 - C:\WINDOWS\system32\msh263.drv (Microsoft Corporation) Drivers32: vidc.mp42 - C:\WINDOWS\system32\mpg4c32.dll (Microsoft Corporation) Drivers32: vidc.mp43 - C:\WINDOWS\system32\mpg4c32.dll (Microsoft Corporation) Drivers32: vidc.mpg4 - C:\WINDOWS\system32\mpg4c32.dll (Microsoft Corporation) Drivers32: vidc.mrle - C:\WINDOWS\system32\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\WINDOWS\system32\msvidc32.dll (Microsoft Corporation) Drivers32: VIDC.UYVY - C:\WINDOWS\system32\msyuv.dll (Microsoft Corporation) Drivers32: VIDC.XVID - C:\WINDOWS\system32\xvidvfw.dll () Drivers32: VIDC.YUY2 - C:\WINDOWS\system32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yv12 - C:\WINDOWS\system32\DivX.dll (DivX, Inc.) Drivers32: VIDC.YVU9 - C:\WINDOWS\system32\tsbyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVYU - C:\WINDOWS\system32\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\WINDOWS\system32\msacm32.drv (Microsoft Corporation) ========== Files/Folders - Created Within 30 Days ========== [2009/04/24 09:07:55 \| 00,501,248 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTListIt2.exe [2009/04/24 08:57:38 \| 00,000,000 \| ---D \| C] -- C:\_OTMoveIt [2009/04/24 08:56:32 \| 00,389,632 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTMoveIt3.exe [2009/04/21 23:47:06 \| 00,000,000 \| ---D \| C] -- C:\Rooter$ [2009/04/21 23:46:46 \| 00,267,612 \| ---- \| C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\Rooter.exe [2009/04/20 12:49:19 \| 18,104,19712 \| -HS- \| C] () -- C:\hiberfil.sys [2009/04/20 11:32:49 \| 00,002,468 \| ---- \| C] () -- C:\WINDOWS\System32\tmp.reg [2009/04/20 11:32:05 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Compaq_Administrator\Desktop\SmitfraudFix [2009/04/20 11:24:01 \| 01,831,732 \| ---- \| C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\SmitfraudFix.exe [2009/04/19 00:59:27 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Compaq_Administrator\Application Data\licenses [2009/04/19 00:59:21 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Compaq_Administrator\Application Data\PCMM2009 [2009/04/19 00:58:47 \| 00,000,000 \| ---D \| C] -- C:\Program Files\PC MightyMax 2009 [2009/04/14 17:14:07 \| 00,401,408 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcss.dll [2009/04/14 17:14:07 \| 00,284,160 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pdh.dll [2009/04/14 17:14:06 \| 00,729,088 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lsasrv.dll [2009/04/14 17:14:06 \| 00,617,472 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\advapi32.dll [2009/04/14 17:14:06 \| 00,473,600 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fastprox.dll [2009/04/14 17:14:06 \| 00,453,120 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvsd.dll [2009/04/14 17:14:06 \| 00,227,840 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvse.exe [2009/04/14 17:14:06 \| 00,110,592 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\services.exe [2009/04/14 17:14:05 \| 00,714,752 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntdll.dll [2009/04/14 17:13:43 \| 01,203,922 \| ---- \| C] () -- C:\WINDOWS\System32\dllcache\sysmain.sdb [2009/04/14 17:13:43 \| 00,002,560 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp4res.dll [2009/04/14 17:13:42 \| 00,215,552 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wordpad.exe [2009/04/13 23:27:08 \| 00,014,923 \| ---- \| C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\Transformers Revenge of the Fallen[2009].XviD.DvDrip. - aXXo [mininova].torrent [2009/04/13 23:20:18 \| 00,017,032 \| ---- \| C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\X-Men Origins Wolverine[2009]DvDrip-aXXo [mininova].torrent [2009/01/27 10:40:10 \| 00,000,038 \| ---- \| C] () -- C:\WINDOWS\AviSplitter.INI [2008/11/16 14:33:58 \| 00,028,672 \| ---- \| C] () -- C:\WINDOWS\System32\CMRMDRV3.DLL [2008/11/16 14:33:58 \| 00,000,464 \| ---- \| C] () -- C:\WINDOWS\CMUDA3.ini [2008/09/19 16:57:34 \| 03,596,288 \| ---- \| C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008/09/19 16:55:10 \| 00,000,416 \| ---- \| C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2008/09/19 16:55:10 \| 00,000,416 \| ---- \| C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2008/09/19 16:54:18 \| 00,012,288 \| ---- \| C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2008/02/21 15:23:16 \| 00,040,960 \| ---- \| C] () -- C:\WINDOWS\System32\B11gUSB.dll [2008/01/30 11:12:28 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\Dvm.INI [2007/09/26 04:09:38 \| 00,009,728 \| ---- \| C] () -- C:\WINDOWS\System32\BASSMOD.dll [2007/07/26 09:25:14 \| 00,039,808 \| R--- \| C] () -- C:\WINDOWS\System32\drivers\SRS_SSCFilter_i386.sys [2007/07/26 09:25:08 \| 00,047,360 \| R--- \| C] () -- C:\WINDOWS\System32\drivers\Surroundhp_kern_i386.sys [2007/07/26 09:25:08 \| 00,042,112 \| R--- \| C] () -- C:\WINDOWS\System32\drivers\csiidecoder_kern_i386.sys [2007/07/26 09:25:06 \| 00,047,104 \| R--- \| C] () -- C:\WINDOWS\System32\drivers\tshd4_kern_i386.sys [2007/07/22 13:51:09 \| 00,094,208 \| ---- \| C] () -- C:\WINDOWS\System32\GTW32N50.dll [2007/07/10 19:51:30 \| 00,000,118 \| ---- \| C] () -- C:\WINDOWS\System32\MRT.INI [2007/07/03 13:42:17 \| 00,593,920 \| ---- \| C] () -- C:\WINDOWS\System32\xvidcore.dll [2007/07/03 13:42:16 \| 00,180,224 \| ---- \| C] () -- C:\WINDOWS\System32\xvidvfw.dll [2007/07/03 13:42:15 \| 00,007,680 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll [2007/07/03 13:42:15 \| 00,000,547 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2007/06/28 04:51:18 \| 00,135,168 \| ---- \| C] () -- C:\WINDOWS\System32\DVDEncoder.dll [2007/05/29 12:30:24 \| 00,015,390 \| ---- \| C] () -- C:\WINDOWS\cdplayer.ini [2007/03/25 00:56:25 \| 00,000,242 \| ---- \| C] () -- C:\WINDOWS\iPlayer.INI [2006/10/16 20:06:43 \| 00,000,038 \| ---- \| C] () -- C:\WINDOWS\RealityFusion.ini [2006/10/16 19:55:43 \| 00,000,544 \| ---- \| C] () -- C:\WINDOWS\_delis32.ini [2006/10/16 19:43:01 \| 00,065,536 \| ---- \| C] () -- C:\WINDOWS\System32\YCRWin32.dll [2006/05/04 22:48:52 \| 00,000,061 \| ---- \| C] () -- C:\WINDOWS\smscfg.ini [2006/05/04 22:27:38 \| 00,028,848 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\USBkey.sys [2006/05/04 22:23:33 \| 00,012,988 \| ---- \| C] () -- C:\WINDOWS\System32\CHODDI.SYS [2006/05/04 22:23:25 \| 00,045,056 \| ---- \| C] () -- C:\WINDOWS\System32\hpreg.dll [2006/05/04 22:20:47 \| 00,000,031 \| ---- \| C] () -- C:\WINDOWS\QUICKEN.INI [2006/05/04 22:19:46 \| 00,000,376 \| ---- \| C] () -- C:\WINDOWS\ODBC.INI [2006/05/04 22:09:54 \| 00,000,112 \| ---- \| C] () -- C:\WINDOWS\WININIT.INI [2006/05/04 22:08:38 \| 00,000,698 \| ---- \| C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini [2006/05/04 22:02:23 \| 00,001,793 \| ---- \| C] () -- C:\WINDOWS\System32\fxsperf.ini [2006/05/04 22:00:08 \| 00,102,400 \| ---- \| C] () -- C:\WINDOWS\System32\hcwXDS.dll [2006/05/04 21:59:02 \| 01,662,976 \| ---- \| C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006/05/04 21:59:02 \| 01,466,368 \| ---- \| C] () -- C:\WINDOWS\System32\nview.dll [2006/05/04 21:59:02 \| 01,019,904 \| ---- \| C] () -- C:\WINDOWS\System32\nvwimg.dll [2006/05/04 21:59:02 \| 00,573,440 \| ---- \| C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006/05/04 21:59:02 \| 00,466,944 \| ---- \| C] () -- C:\WINDOWS\System32\nvshell.dll [2006/05/04 21:59:02 \| 00,286,720 \| ---- \| C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006/05/04 21:59:01 \| 00,106,496 \| ---- \| C] () -- C:\WINDOWS\System32\nvapi.dll [2006/05/04 21:57:39 \| 00,000,791 \| ---- \| C] () -- C:\WINDOWS\orun32.ini [2006/05/04 21:37:33 \| 00,016,896 \| ---- \| C] () -- C:\WINDOWS\System32\bcbmm.dll [2006/03/17 12:23:44 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\System32\px.ini [2005/08/30 16:02:00 \| 00,000,624 \| ---- \| C] () -- C:\WINDOWS\win.ini [2005/08/30 08:52:36 \| 00,000,227 \| ---- \| C] () -- C:\WINDOWS\SYSTEM.INI [2005/08/05 16:01:54 \| 00,235,008 \| ---- \| C] () -- C:\WINDOWS\System32\psisdecd.dll [2005/08/02 18:19:16 \| 00,050,176 \| ---- \| C] () -- C:\WINDOWS\armcex.dll [2004/07/26 02:51:38 \| 00,000,592 \| ---- \| C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/01/07 17:05:08 \| 00,002,695 \| ---- \| C] () -- C:\WINDOWS\System32\OUTLPERF.INI [1999/08/10 12:02:20 \| 00,116,736 \| ---- \| C] () -- C:\WINDOWS\System32\LFKODAK.DLL [1999/08/10 12:02:16 \| 00,343,040 \| ---- \| C] () -- C:\WINDOWS\System32\lffpx7.dll ========== Files - Modified Within 30 Days ========== [1 C:\WINDOWS\System32\.tmp files] [3 C:\WINDOWS\.tmp files] [2009/04/24 09:07:56 \| 00,501,248 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTListIt2.exe [2009/04/24 09:02:56 \| 00,000,183 \| ---- \| M] () -- C:\WINDOWS\System\hpsysdrv.DAT [2009/04/24 09:02:46 \| 00,043,531 \| ---- \| M] () -- C:\WINDOWS\System32\nvapps.xml [2009/04/24 09:02:16 \| 00,001,158 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2009/04/24 09:01:15 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2009/04/24 09:00:53 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2009/04/24 09:00:46 \| 18,104,19712 \| -HS- \| M] () -- C:\hiberfil.sys [2009/04/24 08:59:29 \| 07,177,882 \| -H-- \| M] () -- C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\IconCache.db [2009/04/24 08:56:33 \| 00,389,632 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTMoveIt3.exe [2009/04/21 23:46:46 \| 00,267,612 \| ---- \| M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\Rooter.exe [2009/04/20 12:53:04 \| 00,124,416 \| -HS- \| M] () -- C:\WINDOWS\Thumbs.db [2009/04/20 11:32:49 \| 00,002,468 \| ---- \| M] () -- C:\WINDOWS\System32\tmp.reg [2009/04/20 11:26:03 \| 01,831,732 \| ---- \| M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\SmitfraudFix.exe [2009/04/19 17:17:21 \| 00,207,360 \| ---- \| M] () -- C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/04/18 14:00:10 \| 00,000,922 \| ---- \| M] () -- C:\WINDOWS\System\Cmicnfg3.ini [2009/04/15 03:16:07 \| 00,478,390 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/04/15 03:16:07 \| 00,406,278 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2009/04/15 03:16:07 \| 00,064,384 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2009/04/15 03:04:10 \| 00,001,374 \| ---- \| M] () -- C:\WINDOWS\imsins.BAK [2009/04/13 23:27:09 \| 00,014,923 \| ---- \| M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\Transformers Revenge of the Fallen[2009].XviD.DvDrip. - aXXo [mininova].torrent [2009/04/13 23:20:19 \| 00,017,032 \| ---- \| M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\X-Men Origins Wolverine[2009]DvDrip-aXXo [mininova].torrent [2009/04/06 15:32:54 \| 00,038,496 \| ---- \| M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/04/06 15:32:46 \| 00,015,504 \| ---- \| M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/04/06 09:57:24 \| 24,921,544 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009/03/27 01:58:38 \| 01,203,922 \| ---- \| M] () -- C:\WINDOWS\System32\dllcache\sysmain.sdb ========== LOP Check ========== [2009/03/19 14:01:05 \| 00,000,000 \| RH-D \| M] -- C:\Documents and Settings\All Users\Application Data [2008/09/13 08:58:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Adobe [2008/12/06 11:09:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\ArcSoft [2008/09/15 10:22:38 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\ashampoo [2009/01/14 21:17:42 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\avg8 [2007/08/29 14:26:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Azureus [2007/08/23 08:43:03 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\DFX [2006/08/01 16:01:27 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Digital Interactive Systems Corporation [2009/03/22 17:35:23 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Google [2007/04/30 12:07:56 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard [2009/03/18 23:55:22 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\HP [2006/05/04 22:09:54 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\InstallShield [2006/05/04 22:20:48 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Intuit [2009/03/18 23:21:12 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2007/12/18 03:23:55 \| 00,000,000 \| --SD \| M] -- C:\Documents and Settings\All Users\Application Data\Microsoft [2007/03/05 19:28:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Motive [2007/09/06 11:10:33 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Mozilla [2007/09/26 02:36:59 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\My Movies [2007/11/10 13:14:25 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Nero [2008/11/03 13:12:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\NOS [2006/08/26 14:54:25 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\nView_Profiles [2007/07/18 04:26:02 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Otto [2006/05/04 21:58:41 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\SBSI [2007/08/23 08:48:42 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\SlySoft [2006/05/04 22:04:12 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Sonic [2008/09/20 20:39:25 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy [2007/09/06 06:46:49 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\SRS Labs [2009/03/18 23:19:50 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com [2008/09/20 20:49:24 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Symantec [2008/09/20 20:33:23 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2007/04/30 12:22:38 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\WEBREG [2007/08/24 12:10:01 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition) [2006/10/16 09:43:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage [2007/10/28 01:23:02 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\yahoo! [2009/04/20 11:32:49 \| 00,000,000 \| -H-D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data [2008/09/15 11:52:09 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Adobe [2008/09/13 08:56:39 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\AdobeUM [2007/09/27 09:47:21 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Apple Computer [2008/12/15 11:14:20 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Arcsoft [2008/09/15 10:23:17 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Ashampoo [2008/09/15 10:37:38 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Ashampoo Photo Commander 5 [2007/06/28 04:38:06 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\AVSMedia [2009/04/24 08:59:23 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Azureus [2007/08/30 06:46:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\BitTorrent [2007/10/19 16:11:27 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\CyberLink [2007/10/03 02:03:30 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\DivX [2007/11/11 16:13:29 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\FlashFXP [2007/09/24 00:27:51 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\GlarySoft [2006/10/22 15:55:49 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Google [2007/10/02 20:56:59 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Help [2007/04/30 13:42:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\HP [2006/07/22 20:54:17 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\HPQ [2005/11/14 13:04:10 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Identities [2006/05/04 22:20:48 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Intuit [2007/06/24 11:26:38 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Leadertech [2009/04/19 00:59:27 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\licenses [2007/10/26 19:04:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\LimeWire [2007/11/30 16:43:22 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\LimeWireTurbo [2008/09/15 11:52:09 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia [2009/03/18 23:21:17 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Malwarebytes [2007/07/03 13:43:15 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Media Player Classic [2008/11/25 20:16:00 \| 00,000,000 \| --SD \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Microsoft [2007/10/19 16:11:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\mIRC [2009/03/22 17:35:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Move Networks [2009/03/22 17:29:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla [2007/09/12 00:21:36 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\MySpace [2007/10/28 00:24:53 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Nero [2008/06/09 13:04:22 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Netscape [2007/07/18 04:26:02 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Otto [2009/04/19 00:59:21 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\PCMM2009 [2008/09/12 09:51:55 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Real [2007/08/29 14:17:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\SlySoft [2007/06/24 11:26:46 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Sonic [2007/08/23 08:26:12 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\SoundSpectrum [2006/11/11 12:45:22 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Sun [2009/03/18 23:19:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\SUPERAntiSpyware.com [2008/09/20 02:08:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Symantec [2007/09/06 11:10:55 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Talkback [2006/08/01 16:02:59 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Template [2008/12/15 10:21:29 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\U3 [2007/10/04 01:11:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Uniblue [2007/07/12 22:44:46 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\WinBatch [2007/10/10 01:20:01 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\WinRAR [2007/10/28 02:16:19 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Yahoo! [2004/08/09 23:00:00 \| 00,000,065 \| RH-- \| M] () -- C:\WINDOWS\Tasks\desktop.ini [2009/04/24 09:01:15 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\Tasks\SA.DAT ========== Purity Check ========== ========== Custom Scans ========== < %systemroot%\System32\antiwpa.dll > < %systemroot%\SYSTEM32\wpa.dll > < %systemroot%\setup\scripts\biestart.exe > < %systemroot%\system32\drivers\royal.sys > < %SYSTEMDRIVE%\. > [2009/04/24 09:07:55 \| 00,000,000 \| ---D \| M] -- C: [2009/04/24 08:57:38 \| 00,000,000 \| ---D \| M] -- C:\_OTMoveIt [2007/09/27 01:29:29 \| 00,000,000 \| ---D \| M] -- C:\816457907272af163a76 [2007/09/30 00:08:43 \| 00,000,000 \| RHSD \| M] -- C:\cmdcons [2005/11/14 13:03:06 \| 00,000,000 \| ---D \| M] -- C:\CMPNENTS [2009/04/13 16:49:44 \| 00,000,000 \| ---D \| M] -- C:\Config.Msi [2008/11/16 14:33:41 \| 00,000,000 \| ---D \| M] -- C:\Diamond [2008/06/09 13:14:20 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings [2007/05/08 22:50:20 \| 00,000,000 \| -H-D \| M] -- C:\hp [2007/09/27 01:29:29 \| 00,000,000 \| ---D \| M] -- C:\i386 [2007/08/24 11:15:52 \| 00,000,000 \| ---D \| M] -- C:\OtsLabs [2009/04/20 11:32:50 \| 00,000,000 \| ---D \| M] -- C:\Program Files [2006/10/16 11:07:15 \| 00,000,000 \| ---D \| M] -- C:\Python22 [2008/06/09 13:14:20 \| 00,000,000 \| -HSD \| M] -- C:\RECYCLER [2009/04/21 23:49:30 \| 00,000,000 \| ---D \| M] -- C:\Rooter$ [2006/10/16 09:57:36 \| 00,000,000 \| ---D \| M] -- C:\softpaq [2009/03/20 14:48:45 \| 00,000,000 \| -HSD \| M] -- C:\System Volume Information [2008/02/21 22:37:12 \| 00,000,000 \| ---D \| M] -- C:\temp [2009/01/14 21:46:50 \| 00,000,000 \| ---D \| M] -- C:\ubuntu [2009/01/04 11:45:43 \| 00,000,000 \| ---D \| M] -- C:\ubuntu-backup [2009/04/24 09:01:29 \| 00,000,000 \| ---D \| M] -- C:\WINDOWS < %PROGRAMFILES%\. > [2009/04/20 11:32:50 \| 00,000,000 \| ---D \| M] -- C:\Program Files [2007/07/02 08:57:13 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Absolute Video Splitter Joiner [2008/09/22 13:44:05 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Adobe [2007/10/04 01:26:45 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Alwil Software [2008/12/04 19:07:47 \| 00,000,000 \| ---D \| M] -- C:\Program Files\ArcSoft [2008/09/15 10:46:09 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Ashampoo [2008/09/21 11:34:22 \| 00,000,000 \| ---D \| M] -- C:\Program Files\AVG [2009/03/09 14:31:33 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Azureus [2008/02/21 15:23:13 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Belkin [2007/11/10 13:14:27 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Burn4Free [2008/09/21 11:32:17 \| 00,000,000 \| ---D \| M] -- C:\Program Files\CA [2009/03/18 23:43:46 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Common Files [2005/11/11 10:56:40 \| 00,000,000 \| ---D \| M] -- C:\Program Files\ComPlus Applications [2007/09/25 09:46:36 \| 00,000,000 \| ---D \| M] -- C:\Program Files\CUEcards 2000 [2008/11/24 22:07:31 \| 00,000,000 \| ---D \| M] -- C:\Program Files\DivX [2007/09/06 08:50:41 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Duplicate Cleaner [2007/11/12 00:57:52 \| 00,000,000 \| ---D \| M] -- C:\Program Files\FlashFXP [2006/10/16 11:04:49 \| 00,000,000 \| ---D \| M] -- C:\Program Files\GemMaster [2009/03/22 17:35:24 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Google [2009/03/18 23:54:46 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Hewlett-Packard [2009/03/18 23:56:51 \| 00,000,000 \| ---D \| M] -- C:\Program Files\HP [2009/03/18 23:49:50 \| 00,000,000 \| -H-D \| M] -- C:\Program Files\InstallShield Installation Information [2007/10/05 22:51:49 \| 00,000,000 \| ---D \| M] -- C:\Program Files\InterActual [2009/04/15 03:03:53 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Internet Explorer [2008/11/04 10:23:38 \| 00,000,000 \| ---D \| M] -- C:\Program Files\iXi Tools [2009/04/13 16:49:38 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Java [2007/07/03 13:42:16 \| 00,000,000 \| ---D \| M] -- C:\Program Files\K-Lite Codec Pack [2006/10/16 19:56:59 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Logitech [2007/08/30 13:22:31 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Lumesoft [2009/04/15 10:06:07 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Malwarebytes' Anti-Malware [2008/09/16 17:08:25 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Messenger [2006/05/04 22:19:08 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft ActiveSync [2005/11/14 13:06:48 \| 00,000,000 \| ---D \| M] -- C:\Program Files\microsoft frontpage [2006/05/04 22:18:58 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Office [2006/05/04 22:18:58 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Visual Studio [2007/06/28 05:54:00 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Works [2006/05/04 22:18:45 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft.NET [2007/09/21 00:43:13 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MindArk [2007/06/28 04:55:29 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Movie DVD Maker [2008/09/16 16:46:12 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Movie Maker [2009/04/24 09:04:04 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox [2007/09/24 00:01:32 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mresreg [2005/11/14 13:07:00 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MSN [2007/06/28 05:54:24 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MSN Encarta Standard [2005/11/14 13:07:16 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MSN Gaming Zone [2006/11/18 01:24:28 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MSXML 4.0 [2007/06/28 05:54:01 \| 00,000,000 \| ---D \| M] -- C:\Program Files\music_now [2007/11/10 13:14:14 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MySpace [2008/09/16 16:43:43 \| 00,000,000 \| ---D \| M] -- C:\Program Files\NetMeeting [2006/05/04 22:08:28 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Netscape [2007/08/30 13:09:59 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Norton Internet Security [2008/11/03 13:11:34 \| 00,000,000 \| ---D \| M] -- C:\Program Files\NOS [2006/05/04 22:31:24 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Online Services [2008/09/16 16:43:39 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Outlook Express [2009/04/19 01:02:24 \| 00,000,000 \| ---D \| M] -- C:\Program Files\PC MightyMax 2009 [2006/05/04 22:27:40 \| 00,000,000 \| ---D \| M] -- C:\Program Files\PC-Doctor for DOS [2008/06/09 13:05:25 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Quicken [2007/09/29 09:31:05 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Real [2006/10/16 19:57:24 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Reality Fusion [2008/11/04 10:57:29 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Realtek [2007/09/18 01:27:39 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SBC LightSpeed Self Support Tool [2007/03/05 19:28:24 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SBC Self Support Tool [2006/10/16 11:08:22 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Sonic [2007/09/30 03:54:25 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SoundSpectrum [2008/09/20 20:49:23 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Spybot - Search & Destroy [2007/09/26 04:10:45 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SRS Labs [2009/03/27 09:34:32 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SUPERAntiSpyware [2008/01/30 11:10:25 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Thomson [2009/03/18 14:10:44 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Trend Micro [2008/02/19 20:57:29 \| 00,000,000 \| -H-D \| M] -- C:\Program Files\Uninstall Information [2007/10/25 22:13:57 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Veoh Networks [2007/09/21 00:43:52 \| 00,000,000 \| ---D \| M] -- C:\Program Files\VstPlugins [2006/10/16 11:09:12 \| 00,000,000 \| ---D \| M] -- C:\Program Files\WildTangent [2007/08/30 13:01:18 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Media Bonus Pack for Windows XP [2007/06/28 05:54:17 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Media Connect 2 [2007/09/30 01:05:15 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Media Player [2008/09/16 16:43:39 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows NT [2005/11/14 13:08:32 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Plus [2005/11/11 10:56:16 \| 00,000,000 \| -H-D \| M] -- C:\Program Files\WindowsUpdate [2007/10/10 01:19:58 \| 00,000,000 \| ---D \| M] -- C:\Program Files\WinRAR [2005/11/14 13:08:44 \| 00,000,000 \| ---D \| M] -- C:\Program Files\xerox [2008/11/16 14:33:41 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Xtreme Sound Driver Setup [2008/11/16 14:33:58 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Xtreme Sound PCI [2009/03/19 14:01:06 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Yahoo! ========== Alternate Data Streams ========== @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 < End of report >

Rorschach112 View Member Profile Find Member's Posts	Apr 25 2009, 11:04 AM Post #14
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	hello Run OTList2.exe Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTLI PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - Reg Error: Key error. File not found O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Key error. File not found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - Reg Error: Key error. File not found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found O33 - MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\Shell - "" = AutoRun O33 - MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found [2007/08/29 14:26:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Azureus [2009/04/24 08:59:23 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Azureus [2007/08/30 06:46:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\BitTorrent [2007/10/26 19:04:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\LimeWire [2007/11/30 16:43:22 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Compaq_Administrator\Application Data\LimeWireTurbo [2009/03/09 14:31:33 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Azureus :Services :Reg :Files :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Then post a new OTL2 log ( don't check the boxes beside LOP Check or Purity this time, and don't run the Custom Scan ) -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 25 2009, 02:17 PM Post #15
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	========== OTLISTIT ========== Process explorer.exe killed successfully! Unable to kill active process SUPERAntiSpyware.exe! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6be95f42-a4c6-11dd-a97d-001731abe403}\ not found. File not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6be95f42-a4c6-11dd-a97d-001731abe403}\ not found. File not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6be95f42-a4c6-11dd-a97d-001731abe403}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6be95f42-a4c6-11dd-a97d-001731abe403}\ not found. File J:\LaunchU3.exe not found. C:\Documents and Settings\All Users\Application Data\Azureus moved successfully. C:\Documents and Settings\Compaq_Administrator\Application Data\Azureus moved successfully. C:\Documents and Settings\Compaq_Administrator\Application Data\BitTorrent moved successfully. C:\Documents and Settings\Compaq_Administrator\Application Data\LimeWire moved successfully. C:\Documents and Settings\Compaq_Administrator\Application Data\LimeWireTurbo moved successfully. C:\Program Files\Azureus moved successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_1f0.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_618.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTListIt2 by OldTimer - Version 2.0.14.0 log created on 04252009_091249 Files moved on Reboot... File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. File C:\WINDOWS\temp\Perflib_Perfdata_1f0.dat not found! File C:\WINDOWS\temp\Perflib_Perfdata_618.dat not found! Registry entries deleted on Reboot...

Rorschach112 View Member Profile Find Member's Posts	Apr 25 2009, 02:30 PM Post #16
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	hello Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. Please download Malwarebytes' Anti-Malware from Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 26 2009, 09:41 PM Post #17
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	Malwarebytes' Anti-Malware 1.36 Database version: 2045 Windows 5.1.2600 Service Pack 3 4/26/2009 12:06:37 PM mbam-log-2009-04-26 (12-06-37).txt Scan type: Quick Scan Objects scanned: 81452 Time elapsed: 3 minute(s), 14 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Sunday, April 26, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Sunday, April 26, 2009 20:08:01 Records in database: 2081647 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Files scanned: 98065 Threat name: 2 Infected objects: 6 Suspicious objects: 0 Duration of the scan: 01:57:57 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\57C22B51.exe Infected: Worm.Win32.VB.an 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\57EC4D22.exe Infected: Worm.Win32.VB.an 1 D:\I386\APPS\APP18921\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 2 D:\I386\APPS\APP18921\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 2 The selected area was scanned.

Rorschach112 View Member Profile Find Member's Posts	Apr 27 2009, 02:19 PM Post #18
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	hello Please download OTMoveIt3 by OldTimer Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes explorer.exe :Services :Reg :Files D:\I386\APPS\APP18921\src\CompaqPresario_Spring06.exe D:\I386\APPS\APP18921\src\HPPavillion_Spring06.exe :Commands [purity] [emptytemp] [start explorer] [Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

pletscjm View Member Profile Find Member's Posts	Apr 27 2009, 10:59 PM Post #19
Full Newbie Member Group: Members+ Posts: 12 Joined: 19-April 09 Member No.: 4,627	========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== D:\I386\APPS\APP18921\src\CompaqPresario_Spring06.exe moved successfully. D:\I386\APPS\APP18921\src\HPPavillion_Spring06.exe moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\hsperfdata_Compaq_Administrator\620 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\etilqs_9gneLiSgUOEHDIhyTra4 scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.

Rorschach112 View Member Profile Find Member's Posts	Apr 27 2009, 11:31 PM Post #20
Malware Expert Group: Experts Posts: 632 Joined: 7-July 08 Member No.: 3,889	your logs are clean Now we need to create a new System Restore point. Click Start Menu > Run > type (or copy and paste) %SystemRoot%\System32\restore\rstrui.exe Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close. Next goto Start Menu > Run > type cleanmgr Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created. To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window. Download OTCleanIt to your desktop and run it Click Yes to beginning the Cleanup process and remove these components, including this application. You will be asked to reboot the machine to finish the Cleanup process. Choose Yes. Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here : http://www.adobe.com/products/acrobat/readstep2.html Below I have included a number of recommendations for how to protect your computer against malware infections. Keep Windows updated by regularly checking their website at : http://windowsupdate.microsoft.com/ This will ensure your computer has always the latest security updates available installed on your computer. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict. Make Internet Explorer more secure Click Start > Run Type Inetcpl.cpl & click OK Click on the Security tab Click Reset all zones to default level Make sure the Internet Zone is selected & Click Custom level In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable". Next Click OK, then Apply button and then OK to exit the Internet Properties page. ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future. Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure. NoScript - for blocking ads and other potential website attacks McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions. ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws. Please read my guide on how to prevent malware and about safe computing here Thank you for your patience, and performing all of the procedures requested. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

« Next Oldest · PC Cleanup Archive (resolved and inactive topics) · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 9th February 2010 - 11:57 AM