bhat7975 Posted May 12, 2010 ID:248661 Share Posted May 12, 2010 I have just contracted a Malware virus, as usual posing as an Antivirus Program. The Alerts continually pop up as well distasteful websites. Most importantly it prevents programs from opening, a popup appears that says "Application cannot be executed. The file *******.exe is infected. Do you want to activate you antivirus software now?I cannot access task manager, and using safe mode to open malwarebytes also does not work. I downloaded Malwarebytes to my C: but then was blocked access to install it, I then downloaded it to another drive and that allowed me to install it, however, now i am unable to run malwarebytes and do a scan.I have tried using the advice your site offers i.e. fist get "defogger" and so on, but i am unable to open the programs.Thanks in advance,Benjamin Link to post Share on other sites More sharing options...
kahdah Posted May 12, 2010 ID:248767 Share Posted May 12, 2010 Hello bhat7975Welcome to Malwarebytes.Please attempt to run these in Safe Mode.If it does not work then just report it back to me and we will do something else.=====================Please download OTH.scr to your desktop.Download OTL to your desktop.Double click the OTH file and select Kill All Processes, your desktop will go blankThen select Start OTL OTL will now run When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Under Custom scan's and fixes section paste in the below in boldnetsvcs%SYSTEMDRIVE%\*.*%systemroot%\*. /mp /s%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfiles%systemroot%\System32\config\*.sav %systemroot%\system32\drivers\*.sys /90Check the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.====================Download the following GMER Rootkit Scanner from HereDownload the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on RunIt may take a minute to load and become available.If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKEDIAT/EATDrives/Partition other than Systemdrive (typically only C:\ should be checked)Show All (don't miss this one)Then click the Scan button & wait for it to finish.Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.Save it where you can easily find it, such as your desktop**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entriesClick OK and quit the GMER program.Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.Post that log in your next reply. Link to post Share on other sites More sharing options...
bhat7975 Posted May 15, 2010 Author ID:250186 Share Posted May 15, 2010 Thanks Kahdah,Here is my OTL log.OTL logfile created on: 14/05/2010 7:48:26 PM - Run 1OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Benjamin\Downloads\DesktopWindows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstationInternet Explorer (Version = 7.0.6001.18000)Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 84.00% Memory free6.00 Gb Paging File | 6.00 Gb Available in Paging File | 95.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program FilesDrive C: | 144.04 Gb Total Space | 33.17 Gb Free Space | 23.03% Space Free | Partition Type: NTFSDrive D: | 139.00 Gb Total Space | 136.73 Gb Free Space | 98.37% Space Free | Partition Type: NTFSE: Drive not present or media not loadedDrive F: | 5.04 Gb Total Space | 4.49 Gb Free Space | 88.95% Space Free | Partition Type: NTFSG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: BENJAMIN-PCCurrent User Name: BenjaminLogged in as Administrator.Current Boot Mode: SafeMode with NetworkingScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Processes (SafeList) ==========PRC - C:\Users\Benjamin\Downloads\Desktop\OTL.exe (OldTimer Tools)PRC - C:\Users\Benjamin\Downloads\Desktop\OTH.scr (OldTimer Tools)========== Modules (SafeList) ==========MOD - C:\Users\Benjamin\Downloads\Desktop\OTL.exe (OldTimer Tools)MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)========== Win32 Services (SafeList) ==========SRV - (RelevantKnowledge) -- C:\Program Files\RelevantKnowledge\rlservice.exe (TMRG, Inc.)SRV - (avg8wd) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)SRV - (ETService) -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()SRV - (eDataSecurity Service) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)SRV - (BUNAgentSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)SRV - (NTISchedulerSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()SRV - (NTIBackupSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)SRV - (vfsFPService) -- C:\Windows\System32\vfsFPService.exe (Validity Sensors, Inc.)SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)SRV - (RS_Service) -- C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)SRV - (usnjsvc) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)SRV - (IAANTMON) Intel® -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)SRV - (IJPLMSVC) -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()========== Driver Services (SafeList) ==========DRV - (AvgLdx86) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)DRV - (AvgMfx86) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)DRV - (AvgTdiX) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()DRV - (AlfaFF) -- C:\Windows\system32\Drivers\AlfaFF.sys (Alfa Corporation)DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)DRV - (L1E) -- C:\Windows\System32\drivers\L1E60x86.sys (Atheros Communications, Inc.)DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)DRV - (psdvdisk) -- C:\Windows\System32\drivers\PSDVdisk.sys (Egis Incorporated)DRV - (PSDNServ) -- C:\Windows\System32\drivers\PSDNServ.sys (Egis Incorporated)DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (Egis Incorporated)DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)DRV - (vfs101x) -- C:\Windows\System32\drivers\vfs101x.sys (Validity Sensors, Inc.)DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)DRV - (E1G60) Intel® -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)DRV - (NETw4v32) Intel® -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. )DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)DRV - (int15) -- C:\Windows\System32\drivers\int15.sys ()DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)DRV - (DritekPortIO) -- C:\Program Files\Launch Manager\DPortIO.sys (Dritek System Inc.)DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)========== Standard Registry (All) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.comIE - HKLM\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)IE - HKCU\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555========== FireFox ==========FF - prefs.js..browser.search.defaultengine: "Ask.com"FF - prefs.js..browser.search.defaultenginename: "Web Search..."FF - prefs.js..browser.search.order.1: "Ask.com"FF - prefs.js..browser.search.selectedEngine: "Google"FF - prefs.js..browser.search.useDBForOrder: trueFF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.429FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.5.1.110FF - prefs.js..extensions.enabledItems: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}:2.1.0.19FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1FF - prefs.js..extensions.enabledItems: radiobar@toolbar:1.0.0FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.9FF - prefs.js..keyword.URL: "http://radiobar.toolbarhome.com/search.aspx?srch=ku&q="FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/26 16:36:45 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/12/22 20:22:27 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/08 16:16:46 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/08 16:16:46 | 000,000,000 | ---D | M][2009/08/17 19:39:05 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Extensions[2009/08/17 19:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}[2010/05/11 20:12:04 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions[2009/09/16 02:29:55 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}[2009/12/10 07:09:37 | 000,000,000 | ---D | M] (BS Player Toolbar) -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}[2009/09/16 02:29:55 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\heurist@zotero.org[2010/05/04 19:34:51 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\radiobar@toolbar[2010/02/19 17:36:01 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\toolbar@ask.com[2010/02/19 17:36:07 | 000,002,426 | ---- | M] () -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\searchplugins\askcom.xml[2010/05/04 19:35:09 | 000,001,598 | ---- | M] () -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\searchplugins\web-search.xml[2009/08/17 19:38:10 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions[2010/04/08 16:16:46 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}[2010/04/08 16:16:42 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll[2010/04/08 16:16:42 | 000,137,176 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll[2010/04/08 16:16:43 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll[2008/10/14 21:33:30 | 000,095,600 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll[2009/09/22 18:40:24 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml[2009/09/22 18:40:24 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml[2009/09/22 18:40:24 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml[2009/09/22 18:40:24 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml[2009/09/22 18:40:24 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml[2009/09/22 18:40:24 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml[2009/09/22 18:40:24 | 000,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xmlO1 HOSTS File: ([2006/09/19 07:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: ::1 localhostO2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)O2 - BHO: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O3 - HKLM\..\Toolbar: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)O3 - HKCU\..\Toolbar\WebBrowser: (BS Player Toolbar) - {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe ()O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer\Acer Registration\ACE1.exe (Leader Technologies)O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [bkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()O4 - HKLM..\Run: [brStsWnd] C:\Program Files\Brownie\BrstsWnd.exe (brother)O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)O4 - HKLM..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)O4 - HKLM..\Run: [eRecoveryService] File not foundO4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)O4 - HKLM..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)O4 - HKLM..\Run: [igfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)O4 - HKLM..\Run: [sSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)O4 - HKLM..\Run: [ZPdtWzdVitaKey MC3000] C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe (Arachnoid Biometrics Identification Group Corp.)O4 - HKCU..\Run: [asam] C:\Users\Benjamin\AppData\Local\asam.exe ()O4 - HKCU..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)O4 - HKCU..\Run: [nppgrwxw] C:\Users\Benjamin\AppData\Local\onaoevpdi\fqbdetwtssd.exe ()O4 - HKCU..\Run: [ojrurfme] C:\Users\Benjamin\AppData\Local\iokmwxmxp\dokomeotssd.exe File not foundO4 - HKCU..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)O4 - Startup: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)O4 - Startup: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Orion.lnk = C:\Convesoft\Orion\Messenger.exe File not foundO4 - Startup: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SANYO Screen Capture 1.1.lnk = C:\Users\Benjamin\AppData\Roaming\Microsoft\Installer\{59498F87-43F8-4A02-AAE6-DD91519A9D05}\_53DB54D1AAC28DB5D10AED.exe ()O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)O9 - Extra Button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe ()O9 - Extra 'Tools' menuitem : Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe ()O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O13 - gopher Prefix: missingO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab (Java Plug-in 1.6.0_07)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\msdaipp - No CLSID value foundO18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)O20 - Winlogon\Notify\AWinNotifyVitaKey MC3000: DllName - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll (Arachnoid Biometrics Identification Group Corp.)O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)O24 - Desktop WallPaper: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpgO24 - Desktop BackupWallPaper: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpgO28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2006/09/19 07:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]O33 - MountPoints2\{0f2022f5-6606-11dd-bf3f-806e6f6e6963}\Shell - "" = AutoRunO33 - MountPoints2\{0f2022f5-6606-11dd-bf3f-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{0f202308-6606-11dd-bf3f-001de08374cf}\Shell - "" = AutoRunO33 - MountPoints2\{0f202308-6606-11dd-bf3f-001de08374cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{5a816d51-1921-11de-bb0f-00a0d1a486a2}\Shell - "" = AutoRunO33 - MountPoints2\{5a816d51-1921-11de-bb0f-00a0d1a486a2}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{658ec2af-5d69-11df-a50c-8cf151ea2435}\Shell\AutoRun\command - "" = G:\Setup.exe -- File not foundO33 - MountPoints2\{98d7bc4d-59d7-11df-b2a1-fdc01a6c53ba}\Shell\AutoRun\command - "" = G:\SamsungSoftware\APPInst.exe -- File not foundO33 - MountPoints2\{ceb73d0c-7fcb-11de-9752-80304c010fc9}\Shell - "" = AutoRunO33 - MountPoints2\{ceb73d0c-7fcb-11de-9752-80304c010fc9}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{d39fbdae-6474-11dd-9acc-001de08374cf}\Shell - "" = AutoRunO33 - MountPoints2\{d39fbdae-6474-11dd-9acc-001de08374cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{d39fbdd3-6474-11dd-9acc-001de08374cf}\Shell - "" = AutoRunO33 - MountPoints2\{d39fbdd3-6474-11dd-9acc-001de08374cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{db242266-1be0-11de-b104-00a0d1a486a2}\Shell - "" = AutoRunO33 - MountPoints2\{db242266-1be0-11de-b104-00a0d1a486a2}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{e7415c1a-55c3-11df-9d5d-ef34a1169895}\Shell - "" = AutoRunO33 - MountPoints2\{e7415c1a-55c3-11df-9d5d-ef34a1169895}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{f59c1917-1833-11de-8ba9-00a0d1a486a2}\Shell - "" = AutoRunO33 - MountPoints2\{f59c1917-1833-11de-8ba9-00a0d1a486a2}\Shell\AutoRun\command - "" = H:\AutoRun.exe -- File not foundO33 - MountPoints2\G\Shell - "" = AutoRunO33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*NetSvcs: FastUserSwitchingCompatibility - File not foundNetSvcs: Ias - C:\Windows\System32\ias [2008/01/21 12:34:27 | 000,000,000 | ---D | M]NetSvcs: Nla - File not foundNetSvcs: Ntmssvc - File not foundNetSvcs: NWCWorkstation - File not foundNetSvcs: Nwsapagent - File not foundNetSvcs: SRService - File not foundNetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)NetSvcs: WmdmPmSp - File not foundNetSvcs: LogonHours - File not foundNetSvcs: PCAudit - File not foundNetSvcs: helpsvc - File not foundNetSvcs: uploadmgr - File not found========== Files/Folders - Created Within 30 Days ==========[2010/05/14 19:11:33 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTL.exe[2010/05/14 19:00:17 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTH.scr[2010/05/12 12:55:55 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\AppData\Roaming\Malwarebytes[2010/05/12 12:55:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys[2010/05/12 12:55:44 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys[2010/05/12 12:55:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2010/05/11 14:47:27 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\AppData\Local\onaoevpdi[2010/05/10 19:06:32 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\AppData\Local\iokmwxmxp[2010/05/06 21:48:23 | 000,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\Windows\System32\lameACM.acm[2010/05/06 21:48:22 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\System32\yv12vfw.dll[2010/05/06 21:48:22 | 000,151,552 | ---- | C] (fccHandler) -- C:\Windows\System32\ac3acm.acm[2010/05/06 21:48:17 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack[2010/04/26 22:12:12 | 000,000,000 | R--D | C] -- C:\Users\Benjamin\AppData\Roaming\Brother[2 C:\Users\Benjamin\Downloads\Desktop\*.tmp files -> C:\Users\Benjamin\Downloads\Desktop\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2010/05/14 19:45:46 | 000,694,964 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI[2010/05/14 19:45:46 | 000,601,686 | ---- | M] () -- C:\Windows\System32\perfh009.dat[2010/05/14 19:45:46 | 000,105,502 | ---- | M] () -- C:\Windows\System32\perfc009.dat[2010/05/14 19:41:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/05/14 19:37:33 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT[2010/05/14 19:37:32 | 003,407,872 | -HS- | M] () -- C:\Users\Benjamin\ntuser.dat[2010/05/14 19:37:31 | 000,524,288 | -HS- | M] () -- C:\Users\Benjamin\ntuser.dat{3d20db04-a17e-11de-b9df-8d0f6211ecb4}.TMContainer00000000000000000001.regtrans-ms[2010/05/14 19:37:31 | 000,065,536 | -HS- | M] () -- C:\Users\Benjamin\ntuser.dat{3d20db04-a17e-11de-b9df-8d0f6211ecb4}.TM.blf[2010/05/14 19:37:25 | 000,000,267 | ---- | M] () -- C:\Windows\Brownie.ini[2010/05/14 19:37:24 | 002,241,580 | -H-- | M] () -- C:\Users\Benjamin\AppData\Local\IconCache.db[2010/05/14 19:35:52 | 000,002,585 | ---- | M] () -- C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SANYO Screen Capture 1.1.lnk[2010/05/14 19:35:17 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job[2010/05/14 19:35:11 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml[2010/05/14 19:34:46 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0[2010/05/14 19:34:46 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0[2010/05/14 19:29:39 | 000,054,784 | ---- | M] () -- C:\Users\Benjamin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2010/05/14 19:11:46 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTL.exe[2010/05/14 19:11:21 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTH.scr[2010/05/12 20:57:46 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini[2010/05/12 20:41:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job[2010/05/12 12:55:48 | 000,000,510 | ---- | M] () -- C:\Users\Public\Desktop\a.exe.lnk[2010/05/12 11:43:07 | 000,061,184 | ---- | M] () -- C:\Users\Benjamin\AppData\Local\syssvc.exe[2010/05/12 11:43:07 | 000,061,184 | ---- | M] () -- C:\Users\Benjamin\AppData\Local\asam.exe[2010/05/11 08:53:39 | 059,799,897 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm[2010/05/10 19:48:36 | 000,000,633 | ---- | M] () -- C:\Users\Benjamin\Downloads\Desktop\Downloads - Shortcut.lnk[2010/05/09 22:50:06 | 040,154,636 | ---- | M] () -- C:\Users\Benjamin\Downloads\Desktop\3101 vid pres final.wmv[2010/04/29 21:42:11 | 000,001,975 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys[2010/04/26 22:12:12 | 000,000,426 | ---- | M] () -- C:\Windows\BRWMARK.INI[2010/04/22 18:55:00 | 000,002,077 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk[2010/04/17 04:00:00 | 000,085,504 | ---- | M] () -- C:\Windows\System32\ff_vfw.dll[2010/04/17 04:00:00 | 000,000,038 | ---- | M] () -- C:\Windows\avisplitter.ini[2 C:\Users\Benjamin\Downloads\Desktop\*.tmp files -> C:\Users\Benjamin\Downloads\Desktop\*.tmp -> ]========== Files Created - No Company Name ==========[2010/05/12 12:55:48 | 000,000,510 | ---- | C] () -- C:\Users\Public\Desktop\a.exe.lnk[2010/05/12 11:44:09 | 000,061,184 | ---- | C] () -- C:\Users\Benjamin\AppData\Local\asam.exe[2010/05/12 11:43:06 | 000,061,184 | ---- | C] () -- C:\Users\Benjamin\AppData\Local\syssvc.exe[2010/05/10 19:48:36 | 000,000,633 | ---- | C] () -- C:\Users\Benjamin\Downloads\Desktop\Downloads - Shortcut.lnk[2010/05/09 22:52:37 | 040,154,636 | ---- | C] () -- C:\Users\Benjamin\Downloads\Desktop\3101 vid pres final.wmv[2010/05/06 21:48:24 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll[2010/05/06 21:48:24 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini[2010/05/06 21:48:23 | 000,000,414 | ---- | C] () -- C:\Windows\System32\lame_acm.xml[2010/05/06 21:48:22 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll[2010/05/06 21:48:22 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll[2010/05/06 21:48:19 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll[2010/05/06 21:48:19 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest[2010/04/22 18:55:00 | 000,002,077 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk[2010/02/26 16:51:00 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI[2010/02/26 16:51:00 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini[2010/02/26 16:50:27 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini[2010/02/26 16:50:26 | 000,009,853 | ---- | C] () -- C:\Windows\HL-2140.INI[2010/02/26 16:50:11 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI[2010/02/26 16:46:02 | 000,000,267 | ---- | C] () -- C:\Windows\Brownie.ini[2009/12/15 03:58:26 | 000,000,028 | ---- | C] () -- C:\Windows\v2d.INI[2009/11/03 11:38:42 | 000,000,418 | ---- | C] () -- C:\Windows\ArcView9x.INI[2009/05/14 09:06:54 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI[2009/03/25 20:00:05 | 000,000,412 | ---- | C] () -- C:\Windows\MAXLINK.INI[2009/03/13 17:12:06 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys[2009/03/12 11:40:47 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini[2009/02/17 10:29:22 | 000,000,112 | ---- | C] () -- C:\Windows\ActiveSkin.INI[2008/12/31 16:04:42 | 000,691,560 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll[2008/10/11 08:36:36 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI[2008/08/12 21:08:40 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2008/08/12 21:08:22 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini[2008/07/19 15:04:39 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll[2008/07/19 15:04:39 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini[2008/07/19 15:03:50 | 001,548,099 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll[2008/03/21 17:40:31 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll[2008/03/21 17:40:31 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll[2008/03/21 17:01:08 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll[2008/03/21 16:57:18 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll[2008/03/21 16:52:58 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini[2008/03/21 01:32:29 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll[2008/03/21 01:32:15 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll[2007/11/15 08:17:34 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CogentBioSDK.dll[2007/01/26 16:32:18 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys[2006/11/02 22:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll[2006/11/02 17:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini[2004/11/17 13:46:44 | 000,125,440 | ---- | C] () -- C:\Windows\System32\UnzDll.dll[2004/11/17 13:46:42 | 000,130,560 | ---- | C] () -- C:\Windows\System32\ZipDll.dll[2001/12/27 09:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll[2001/09/04 16:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll[2001/07/31 09:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll[2001/07/24 15:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll[1997/06/25 14:24:16 | 000,040,448 | ---- | C] () -- C:\Windows\System32\RegObj.dll========== LOP Check ==========[2008/08/26 08:56:18 | 000,000,000 | -HSD | M] -- C:\Users\Benjamin\AppData\Roaming\.#[2009/04/11 10:55:35 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\aAvgApi[2008/08/06 21:47:23 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Acer[2008/03/21 17:16:03 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Acer GameZone Console[2009/12/10 07:25:25 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\BSplayer[2009/12/10 07:09:36 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\BSplayer Pro[2008/08/13 10:16:08 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\eSobi[2010/04/09 18:38:53 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\ESRI[2008/08/06 21:40:19 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\FloodLightGames[2008/08/06 19:19:14 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Leadertech[2010/05/08 17:29:59 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\LimeWire[2008/08/08 10:31:31 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\PlayFirst[2009/03/13 17:18:03 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Samsung[2009/03/25 19:59:55 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\ScanSoft[2010/05/11 14:57:26 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\uTorrent[2008/08/06 19:19:11 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Validity[2008/08/09 20:40:47 | 000,000,260 | ---- | M] () -- C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job[2010/05/14 19:37:33 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==================== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2006/09/19 07:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat[2008/01/21 12:24:42 | 000,333,203 | RHS- | M] () -- C:\bootmgr[2008/03/21 01:34:47 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK[2006/09/19 07:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys[2009/02/17 10:29:26 | 000,001,256 | ---- | M] () -- C:\INSTALL.LOG[2008/10/22 13:22:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS[2008/10/22 13:22:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS[2010/05/14 19:41:10 | 3524,980,736 | -HS- | M] () -- C:\pagefile.sys[2008/07/19 15:10:17 | 000,000,060 | ---- | M] () -- C:\Partition.txt[2008/03/21 16:53:14 | 000,000,477 | ---- | M] () -- C:\RHDSetup.log[2001/05/24 11:59:30 | 000,162,304 | ---- | M] () -- C:\UNWISE.EXE< %systemroot%\*. /mp /s >< %systemroot%\system32\*.dll /lockedfiles >< %systemroot%\Tasks\*.job /lockedfiles >< %systemroot%\System32\config\*.sav >[2008/01/21 13:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV[2008/01/21 13:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV[2008/01/21 13:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV[2006/11/02 20:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV[2006/11/02 20:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV< %systemroot%\system32\drivers\*.sys /90 >[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys========== Alternate Data Streams ==========@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:8AB6C1D7@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FEBEC560@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:8173A019@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:2B99FE60< End of report >And here is my Extras Log.OTL Extras logfile created on: 14/05/2010 7:48:26 PM - Run 1OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Benjamin\Downloads\DesktopWindows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstationInternet Explorer (Version = 7.0.6001.18000)Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 84.00% Memory free6.00 Gb Paging File | 6.00 Gb Available in Paging File | 95.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program FilesDrive C: | 144.04 Gb Total Space | 33.17 Gb Free Space | 23.03% Space Free | Partition Type: NTFSDrive D: | 139.00 Gb Total Space | 136.73 Gb Free Space | 98.37% Space Free | Partition Type: NTFSE: Drive not present or media not loadedDrive F: | 5.04 Gb Total Space | 4.49 Gb Free Space | 88.95% Space Free | Partition Type: NTFSG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: BENJAMIN-PCCurrent User Name: BenjaminLogged in as Administrator.Current Boot Mode: SafeMode with NetworkingScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Extra Registry (SafeList) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation).hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]"DisableMonitoring" = 1[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"AntiVirusOverride" = 1"AntiSpywareOverride" = 0"FirewallOverride" = 0"VistaSp1" = Reg Error: Unknown registry data type -- File not found[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"EnableFirewall" = 1"DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"EnableFirewall" = 1"DisableNotifications" = 0========== Authorized Applications List ==================== Vista Active Open Ports Exception List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{9FCC8EB0-68E3-464B-8D76-A3A3C48480B4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{A61F0307-CB29-49DC-821B-7D10FA3F3F0E}" = lport=2869 | protocol=6 | dir=in | app=system | "{F2C089D1-BF92-4033-AB2D-760D746CB244}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | ========== Vista Active Application Exception List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{253FAC67-49EC-4FF3-848D-3E840125F50B}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{27C7C917-F601-482E-98CC-A0122D9F0279}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{3D23D351-415E-4434-81A8-31E3E5304672}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe | "{42CED2C6-F316-4249-B21D-33F47684362F}" = protocol=58 | dir=in | app=system | "{457AA695-7FFC-4F2B-82F6-5AB78E2BA0DB}" = protocol=17 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | "{537A9624-CADB-4A6A-8DF6-75822CAB634A}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-203 | "{6B8C3D63-A612-42DE-A585-14F7E7652E06}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{6CEE7A7F-DD8F-4A27-948B-7CB5F6CBC7E5}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | "{6F4B52BD-D6D8-4373-A0AC-7003B99C5339}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "{771E7141-CDA4-40D9-A7E7-4E5346568461}" = protocol=6 | dir=in | app=c:\windows\temp\~os622a.tmp\rlvknlg.exe | "{776552F0-7A4A-4EE5-AC89-679862B1781C}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{7C0C1501-39EC-4D71-98AD-050898D60E68}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | "{7FB554D7-839A-48C3-917C-A56F866EE4D0}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | "{80D55C5F-9292-4CED-AFF6-492430194F74}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{855DB573-69EB-4E55-BDC3-3A75562BCC70}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "{89A86A7E-74AA-4474-BF25-CE5206CF42E5}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | "{8C11EB16-B028-4E49-B5B8-E0EE84460F17}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe | "{8D9D221F-9BD6-428F-9D83-9924474F89E9}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{9EA92398-65C6-4F77-9B7F-BF52250E45F5}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{A094FF55-222D-489F-B734-2DC7CAAEFE22}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | "{A6F93BA5-E3B5-4291-9076-B7C9F68FE523}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{A9ADAAEC-218C-463C-A461-41FF10AE2E02}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe | "{B0D6A975-C143-4552-9D1C-051306D65D43}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | "{BC24146F-82BD-4C12-BDE9-1B1281CA7210}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | "{C733A4B4-7A34-425B-A753-925C98278067}" = protocol=6 | dir=in | app=c:\windows\temp\~osf843.tmp\rlvknlg.exe | "{CC8FB80C-E717-41A2-9BFF-FE7F99B2ABE2}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{CE51BF8F-DF49-4675-8EE0-0DA886046A97}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{E09502F9-8921-49AF-A000-02F12646F216}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | "{E543C699-AF74-489F-B231-980481D0EBFA}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{F354F89D-2CF0-4A6D-90B4-508E9B59C56F}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | "{F7B71395-308A-4858-AEEB-3A1140179C70}" = protocol=6 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | "{FEE6146F-FF33-41E5-88D6-A550CFB90D21}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | "TCP Query User{6B3E6E2C-50C7-4BB2-9D5F-9E6FEF23EED2}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | "TCP Query User{6D51C91F-F732-4C25-90C7-2B5FF5F0C6DA}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "TCP Query User{B44B71FC-03DF-43E7-AA49-754FD11473B3}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | "TCP Query User{D4C80C0E-D882-49B5-BAA7-F1F1DC8E409D}C:\program files\relevantknowledge\rlvknlg.exe" = protocol=6 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | "TCP Query User{F9A0F146-A463-47C9-8C03-01C6BD143073}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | "UDP Query User{1893A243-E54C-4C8A-A3A9-8AC2F3058B70}C:\program files\relevantknowledge\rlvknlg.exe" = protocol=17 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | "UDP Query User{5A07FF0C-39A9-49E4-B7C7-1E2B4C66B3D5}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | "UDP Query User{7136DA94-227B-45EF-B169-69306A391CD1}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | "UDP Query User{98DA18A3-B80E-46A6-B4B3-C0E9135E01D0}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "UDP Query User{EBCD3116-3767-4B6D-BE27-F591237C9089}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM"{0549DFDB-7370-45CE-B5C7-3D928E62719D}" = Brother HL-2140"{06A940CD-4924-485E-8500-476C9E08A820}" = Samsung PC Studio 3"{08C0729E-3E50-11DF-9D81-005056806466}" = Google Earth"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP470_series" = Canon MP470 series"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer"{1C00A3F1-6DA0-49F8-94E4-01AB6FC01033}" = Nero 7 Essentials"{1CF65E18-6463-4D28-A476-7DA10FBCE816}" = ArcGIS Desktop Evaluation Edition"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)"{3DE0053C-FD9A-483E-B7C9-B06E4392206E}" = iTunes"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour"{508CE775-4BA4-4748-82DF-FE28DA9F03B0}" = Windows Live Messenger"{567E8236-C414-4888-8211-3D61608D57AE}" = Validity Sensors software"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management"{59498F87-43F8-4A02-AAE6-DD91519A9D05}" = SANYO Screen Capture 1.1"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Link to post Share on other sites More sharing options...
kahdah Posted May 15, 2010 ID:250358 Share Posted May 15, 2010 Run OTLUnder the Custom Scans/Fixes box at the bottom, paste in the following:OTLSRV - (RelevantKnowledge) -- C:\Program Files\RelevantKnowledge\rlservice.exe (TMRG, Inc.)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555FF - prefs.js..browser.search.defaultengine: "Ask.com"FF - prefs.js..browser.search.defaultenginename: "Web Search..."FF - prefs.js..browser.search.order.1: "Ask.com"FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.5.1.110O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)O4 - HKCU..\Run: [asam] C:\Users\Benjamin\AppData\Local\asam.exe ()O4 - HKCU..\Run: [nppgrwxw] C:\Users\Benjamin\AppData\Local\onaoevpdi\fqbdetwtssd.exe ()O4 - HKCU..\Run: [ojrurfme] C:\Users\Benjamin\AppData\Local\iokmwxmxp\dokomeotssd.exe File not foundO33 - MountPoints2\{0f2022f5-6606-11dd-bf3f-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found33 - MountPoints2\{0f202308-6606-11dd-bf3f-001de08374cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{5a816d51-1921-11de-bb0f-00a0d1a486a2}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{658ec2af-5d69-11df-a50c-8cf151ea2435}\Shell\AutoRun\command - "" = G:\Setup.exe -- File not foundO33 - MountPoints2\{ceb73d0c-7fcb-11de-9752-80304c010fc9}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{d39fbdae-6474-11dd-9acc-001de08374cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{d39fbdd3-6474-11dd-9acc-001de08374cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{db242266-1be0-11de-b104-00a0d1a486a2}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{e7415c1a-55c3-11df-9d5d-ef34a1169895}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not foundO33 - MountPoints2\{f59c1917-1833-11de-8ba9-00a0d1a486a2}\Shell\AutoRun\command - "" = H:\AutoRun.exe -- File not found[2010/05/11 14:47:27 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\AppData\Local\onaoevpdi[2010/05/10 19:06:32 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\AppData\Local\iokmwxmxp2010/05/12 12:55:48 | 000,000,510 | ---- | M] () -- C:\Users\Public\Desktop\a.exe.lnk[2010/05/12 11:43:07 | 000,061,184 | ---- | M] () -- C:\Users\Benjamin\AppData\Local\syssvc.exe[2010/05/12 11:43:07 | 000,061,184 | ---- | M] () -- C:\Users\Benjamin\AppData\Local\asam.exe[2008/08/26 08:56:18 | 000,000,000 | -HSD | M] -- C:\Users\Benjamin\AppData\Roaming\.#:Commands[emptytemp]Then click the Run Fix button at the topLet the program run unhindered, reboot when it is doneIt will produce a log for you on reboot, please post that log in your next reply.============Please visit this webpage for download links, and instructions for running Combofix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review. Link to post Share on other sites More sharing options...
bhat7975 Posted May 16, 2010 Author ID:250736 Share Posted May 16, 2010 OTL log:All processes killed========== OTL ==========Service RelevantKnowledge stopped successfully!Service RelevantKnowledge deleted successfully!C:\Program Files\RelevantKnowledge\rlservice.exe moved successfully.HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!Prefs.js: "Ask.com" removed from browser.search.defaultenginePrefs.js: "Web Search..." removed from browser.search.defaultenginenamePrefs.js: "Ask.com"FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.5.1.110 removed from browser.search.order.1Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\asam deleted successfully.C:\Users\Benjamin\AppData\Local\asam.exe moved successfully.Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\nppgrwxw deleted successfully.C:\Users\Benjamin\AppData\Local\onaoevpdi\fqbdetwtssd.exe moved successfully.Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ojrurfme deleted successfully.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f2022f5-6606-11dd-bf3f-806e6f6e6963}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f2022f5-6606-11dd-bf3f-806e6f6e6963}\ not found.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5a816d51-1921-11de-bb0f-00a0d1a486a2}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5a816d51-1921-11de-bb0f-00a0d1a486a2}\ not found.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{658ec2af-5d69-11df-a50c-8cf151ea2435}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{658ec2af-5d69-11df-a50c-8cf151ea2435}\ not found.File G:\Setup.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb73d0c-7fcb-11de-9752-80304c010fc9}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb73d0c-7fcb-11de-9752-80304c010fc9}\ not found.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d39fbdae-6474-11dd-9acc-001de08374cf}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d39fbdae-6474-11dd-9acc-001de08374cf}\ not found.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d39fbdd3-6474-11dd-9acc-001de08374cf}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d39fbdd3-6474-11dd-9acc-001de08374cf}\ not found.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{db242266-1be0-11de-b104-00a0d1a486a2}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db242266-1be0-11de-b104-00a0d1a486a2}\ not found.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e7415c1a-55c3-11df-9d5d-ef34a1169895}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e7415c1a-55c3-11df-9d5d-ef34a1169895}\ not found.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.File G:\AutoRun.exe not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f59c1917-1833-11de-8ba9-00a0d1a486a2}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f59c1917-1833-11de-8ba9-00a0d1a486a2}\ not found.File H:\AutoRun.exe not found.C:\Users\Benjamin\AppData\Local\onaoevpdi folder moved successfully.C:\Users\Benjamin\AppData\Local\iokmwxmxp folder moved successfully.C:\Users\Benjamin\AppData\Local\syssvc.exe moved successfully.File C:\Users\Benjamin\AppData\Local\asam.exe not found.C:\Users\Benjamin\AppData\Roaming\.# folder moved successfully.========== COMMANDS ==========[EMPTYTEMP]User: All UsersUser: Benjamin->Temp folder emptied: 70277833 bytes->Temporary Internet Files folder emptied: 49158850 bytes->Java cache emptied: 10531268 bytes->FireFox cache emptied: 58359836 bytes->Google Chrome cache emptied: 0 bytes->Flash cache emptied: 4198 bytesUser: Default->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33170 bytesUser: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytesUser: PublicUser: Sarah->Temp folder emptied: 286385 bytes->Temporary Internet Files folder emptied: 7964075 bytes->Flash cache emptied: 778 bytes%systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 0 bytes%systemroot%\System32 .tmp files removed: 0 bytes%systemroot%\System32\drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 540838 bytesRecycleBin emptied: 864256 bytesTotal Files Cleaned = 189.00 mbOTL by OldTimer - Version 3.2.4.1 log created on 05162010_192944Files\Folders moved on Reboot...Registry entries deleted on Reboot...I have run the ComboFix program multiple times, but it fails to produce a log as is described in the instructions you gave me. The scan runs till the end screen but fails to show the last line that states the log will be saved in C: and the log does not automatically come up. Link to post Share on other sites More sharing options...
kahdah Posted May 16, 2010 ID:250772 Share Posted May 16, 2010 See if you can find it here C:\Combofix.txtIf not hen look in the folder that says Qoobox and post the combofix quarantined files.txt Link to post Share on other sites More sharing options...
bhat7975 Posted May 17, 2010 Author ID:251125 Share Posted May 17, 2010 Yer, ComboFix did not produce a log.Here is the Quarantine Txt (The only one I could find anyway)-------- 2010-05-16 - 19:51:16 -------------driver loading error error: 6-------- 2010-05-16 - 20:16:30 -------------error: 31 Link to post Share on other sites More sharing options...
kahdah Posted May 17, 2010 ID:251153 Share Posted May 17, 2010 Ok Update Run MalwarebytesPlease update\run Malwarebytes' Anti-Malware.Double Click the Malwarebytes Anti-Malware icon to run the application.Click on the update tab then click on Check for updates.If an update is found, it will download and install the latest version.Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.=====* Go here to run an online scannner from ESET.Note: You will need to use Internet explorer for this scanTick the box next to YES, I accept the Terms of Use.Click StartWhen asked, allow the activex control to installClick StartCheck next options: Remove found threats and Scan unwanted applications.Click ScanWait for the scan to finishUse notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txtCopy and paste that log as a reply to this topic Link to post Share on other sites More sharing options...
bhat7975 Posted May 17, 2010 Author ID:251231 Share Posted May 17, 2010 Thanks Kahdah, This morning i noticed that i am not getting all the pop ups anymore, in fact there is no sign of the malware at all.Hope thats a good sign.Here is the mbam log:Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4107Windows 6.0.6001 Service Pack 1Internet Explorer 7.0.6001.1800017/05/2010 12:35:23 PMmbam-log-2010-05-17 (12-35-23).txtScan type: Quick scanObjects scanned: 159106Time elapsed: 16 minute(s), 38 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 1Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 1Files Infected: 4Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.Files Infected:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Uninstall Instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.And this is the only ESET log I got (seems a little small)ESETSmartInstaller@High as CAB hook log:OnlineScanner.ocx - registred OKI did save the results the scan produced though:C:\Qoobox\Quarantine\C\Program Files\RelevantKnowledge\rlls.dll.vir.vir a variant of Win32/Adware.RK application cleaned by deleting - quarantinedC:\Users\Benjamin\Downloads\VideoEncoderSetup.exe Win32/Adware.RK.AB application deleted - quarantined Link to post Share on other sites More sharing options...
kahdah Posted May 17, 2010 ID:251332 Share Posted May 17, 2010 Ok looks good.Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply. Link to post Share on other sites More sharing options...
bhat7975 Posted May 17, 2010 Author ID:251640 Share Posted May 17, 2010 Awesome,OTL log:OTL logfile created on: 18/05/2010 9:06:16 AM - Run 2OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Benjamin\Downloads\DesktopWindows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstationInternet Explorer (Version = 7.0.6001.18000)Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 55.00% Memory free6.00 Gb Paging File | 5.00 Gb Available in Paging File | 78.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program FilesDrive C: | 144.04 Gb Total Space | 28.64 Gb Free Space | 19.89% Space Free | Partition Type: NTFSDrive D: | 139.00 Gb Total Space | 136.73 Gb Free Space | 98.37% Space Free | Partition Type: NTFSE: Drive not present or media not loadedDrive F: | 5.04 Gb Total Space | 4.49 Gb Free Space | 88.95% Space Free | Partition Type: NTFSG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: BENJAMIN-PCCurrent User Name: BenjaminLogged in as Administrator.Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Processes (SafeList) ==========PRC - C:\Users\Benjamin\AppData\Local\temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)PRC - C:\Users\Benjamin\Downloads\Desktop\OTL.exe (OldTimer Tools)PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)PRC - C:\Windows\explorer.exe (Microsoft Corporation)PRC - C:\Program Files\Brownie\BrStsWnd.exe (brother)PRC - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe ()PRC - C:\Program Files\Acer\Acer Bio Protection\CompPtcVUI.exe (Arachnoid Biometrics Identification Group Corp.)PRC - C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe (Arachnoid Biometrics Identification Group Corp.)PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)PRC - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)PRC - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()PRC - C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)PRC - C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)PRC - C:\Windows\System32\igfxext.exe (Intel Corporation)PRC - C:\Windows\System32\vfsFPService.exe (Validity Sensors, Inc.)PRC - C:\Program Files\SANYO\SANYOScreenCapture\SetClip.exe (SANYO Electric Co., Ltd.)PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)PRC - C:\Program Files\Brownie\brpjp04a.exe (brother)PRC - C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)PRC - C:\ACER\Mobility Center\MobilityService.exe ()PRC - C:\Windows\PLFSetI.exe ()PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)PRC - C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)PRC - C:\Program Files\Acer\Acer VCM\acp2HID.exe (Acer Inc.)PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)========== Modules (SafeList) ==========MOD - C:\Users\Benjamin\Downloads\Desktop\OTL.exe (OldTimer Tools)MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)========== Win32 Services (SafeList) ==========SRV - (avg8wd) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)SRV - (ETService) -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()SRV - (eDataSecurity Service) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)SRV - (BUNAgentSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)SRV - (NTISchedulerSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()SRV - (NTIBackupSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)SRV - (vfsFPService) -- C:\Windows\System32\vfsFPService.exe (Validity Sensors, Inc.)SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)SRV - (RS_Service) -- C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)SRV - (usnjsvc) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)SRV - (IAANTMON) Intel® -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)SRV - (IJPLMSVC) -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()========== Driver Services (SafeList) ==========DRV - (AvgLdx86) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)DRV - (AvgMfx86) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)DRV - (AvgTdiX) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()DRV - (AlfaFF) -- C:\Windows\system32\Drivers\AlfaFF.sys (Alfa Corporation)DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)DRV - (L1E) -- C:\Windows\System32\drivers\L1E60x86.sys (Atheros Communications, Inc.)DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)DRV - (psdvdisk) -- C:\Windows\System32\drivers\PSDVdisk.sys (Egis Incorporated)DRV - (PSDNServ) -- C:\Windows\System32\drivers\PSDNServ.sys (Egis Incorporated)DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (Egis Incorporated)DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)DRV - (vfs101x) -- C:\Windows\System32\drivers\vfs101x.sys (Validity Sensors, Inc.)DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)DRV - (E1G60) Intel® -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)DRV - (NETw4v32) Intel® -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. )DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)DRV - (int15) -- C:\Windows\System32\drivers\int15.sys ()DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)DRV - (DritekPortIO) -- C:\Program Files\Launch Manager\DPortIO.sys (Dritek System Inc.)DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)========== Standard Registry (All) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htmIE - HKLM\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not foundIE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)IE - HKCU\..\URLSearchHook: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0========== FireFox ==========FF - prefs.js..browser.search.defaultengine: ""FF - prefs.js..browser.search.defaultenginename: ""FF - prefs.js..browser.search.order.1: "Ask.com"FF - prefs.js..browser.search.selectedEngine: "Google"FF - prefs.js..browser.search.useDBForOrder: trueFF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.429FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.5.1.110FF - prefs.js..extensions.enabledItems: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}:2.1.0.19FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1FF - prefs.js..extensions.enabledItems: radiobar@toolbar:1.0.0FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.9FF - prefs.js..keyword.URL: "http://radiobar.toolbarhome.com/search.aspx?srch=ku&q="FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/26 16:36:45 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/12/22 20:22:27 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/08 16:16:46 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/08 16:16:46 | 000,000,000 | ---D | M][2009/08/17 19:39:05 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Extensions[2009/08/17 19:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}[2010/05/17 17:35:03 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions[2009/09/16 02:29:55 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}[2009/12/10 07:09:37 | 000,000,000 | ---D | M] (BS Player Toolbar) -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}[2009/09/16 02:29:55 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\heurist@zotero.org[2010/05/04 19:34:51 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\radiobar@toolbar[2010/02/19 17:36:01 | 000,000,000 | ---D | M] -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\extensions\toolbar@ask.com[2010/02/19 17:36:07 | 000,002,426 | ---- | M] () -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\searchplugins\askcom.xml[2010/05/04 19:35:09 | 000,001,598 | ---- | M] () -- C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\mrwa316f.default\searchplugins\web-search.xml[2009/08/17 19:38:10 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions[2010/04/08 16:16:46 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}[2010/04/08 16:16:42 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll[2010/04/08 16:16:42 | 000,137,176 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll[2010/04/08 16:16:43 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll[2008/10/14 21:33:30 | 000,095,600 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll[2009/09/22 18:40:24 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml[2009/09/22 18:40:24 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml[2009/09/22 18:40:24 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml[2009/09/22 18:40:24 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml[2009/09/22 18:40:24 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml[2009/09/22 18:40:24 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml[2009/09/22 18:40:24 | 000,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xmlO1 HOSTS File: ([2010/05/16 20:23:32 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)O2 - BHO: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O3 - HKLM\..\Toolbar: (BS Player Toolbar) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()O3 - HKCU\..\Toolbar\WebBrowser: (BS Player Toolbar) - {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - C:\Program Files\BS_Player\tbBS_P.dll (Conduit Ltd.)O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe ()O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer\Acer Registration\ACE1.exe (Leader Technologies)O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [bkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()O4 - HKLM..\Run: [brStsWnd] C:\Program Files\Brownie\BrstsWnd.exe (brother)O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)O4 - HKLM..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)O4 - HKLM..\Run: [eRecoveryService] File not foundO4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)O4 - HKLM..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)O4 - HKLM..\Run: [igfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] D:\Malwarebytes' Anti-Malware\a.exe.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)O4 - HKLM..\Run: [sSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)O4 - HKLM..\Run: [ZPdtWzdVitaKey MC3000] C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe (Arachnoid Biometrics Identification Group Corp.)O4 - HKCU..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)O4 - HKCU..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)O4 - Startup: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)O4 - Startup: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Orion.lnk = C:\Convesoft\Orion\Messenger.exe File not foundO4 - Startup: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SANYO Screen Capture 1.1.lnk = C:\Users\Benjamin\AppData\Roaming\Microsoft\Installer\{59498F87-43F8-4A02-AAE6-DD91519A9D05}\_53DB54D1AAC28DB5D10AED.exe ()O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)O9 - Extra Button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe ()O9 - Extra 'Tools' menuitem : Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe ()O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab (Java Plug-in 1.6.0_07)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\msdaipp - No CLSID value foundO18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)O20 - Winlogon\Notify\AWinNotifyVitaKey MC3000: DllName - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll (Arachnoid Biometrics Identification Group Corp.)O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)O24 - Desktop WallPaper: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpgO24 - Desktop BackupWallPaper: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpgO28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not foundO28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2006/09/19 07:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = ComFile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 30 Days ==========[2010/05/17 12:46:39 | 000,000,000 | ---D | C] -- C:\Program Files\ESET[2010/05/17 09:59:27 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\Downloads\Desktop\APPLE[2010/05/16 20:23:42 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN[2010/05/16 20:21:53 | 000,000,000 | ---D | C] -- C:\Windows\temp[2010/05/16 20:21:53 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\AppData\Local\temp[2010/05/16 20:16:29 | 000,000,000 | ---D | C] -- C:\ComboFix[2010/05/16 20:16:10 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe[2010/05/16 20:16:08 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW[2010/05/16 19:51:22 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe[2010/05/16 19:51:22 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe[2010/05/16 19:51:22 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe[2010/05/16 19:51:16 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT[2010/05/16 19:50:47 | 000,000,000 | ---D | C] -- C:\Qoobox[2010/05/16 19:29:44 | 000,000,000 | ---D | C] -- C:\_OTL[2010/05/14 19:11:33 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTL.exe[2010/05/14 19:00:17 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTH.scr[2010/05/12 12:55:55 | 000,000,000 | ---D | C] -- C:\Users\Benjamin\AppData\Roaming\Malwarebytes[2010/05/12 12:55:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys[2010/05/12 12:55:44 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys[2010/05/12 12:55:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2010/05/06 21:48:23 | 000,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\Windows\System32\lameACM.acm[2010/05/06 21:48:22 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\System32\yv12vfw.dll[2010/05/06 21:48:22 | 000,151,552 | ---- | C] (fccHandler) -- C:\Windows\System32\ac3acm.acm[2010/05/06 21:48:17 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack[2010/04/26 22:12:12 | 000,000,000 | R--D | C] -- C:\Users\Benjamin\AppData\Roaming\Brother[2 C:\Users\Benjamin\Downloads\Desktop\*.tmp files -> C:\Users\Benjamin\Downloads\Desktop\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2010/05/18 09:07:18 | 003,407,872 | -HS- | M] () -- C:\Users\Benjamin\ntuser.dat[2010/05/18 08:42:41 | 000,694,964 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI[2010/05/18 08:42:41 | 000,603,282 | ---- | M] () -- C:\Windows\System32\perfh009.dat[2010/05/18 08:42:41 | 000,106,696 | ---- | M] () -- C:\Windows\System32\perfc009.dat[2010/05/18 08:41:01 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job[2010/05/18 08:36:17 | 000,000,319 | ---- | M] () -- C:\Windows\Brownie.ini[2010/05/18 08:35:53 | 000,002,585 | ---- | M] () -- C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SANYO Screen Capture 1.1.lnk[2010/05/18 08:35:17 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml[2010/05/18 08:35:05 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job[2010/05/18 08:34:50 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0[2010/05/18 08:34:50 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0[2010/05/18 08:34:48 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT[2010/05/18 08:34:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/05/18 08:34:40 | 3211,190,272 | -HS- | M] () -- C:\hiberfil.sys[2010/05/17 21:44:54 | 000,524,288 | -HS- | M] () -- C:\Users\Benjamin\ntuser.dat{3d20db04-a17e-11de-b9df-8d0f6211ecb4}.TMContainer00000000000000000001.regtrans-ms[2010/05/17 21:44:54 | 000,065,536 | -HS- | M] () -- C:\Users\Benjamin\ntuser.dat{3d20db04-a17e-11de-b9df-8d0f6211ecb4}.TM.blf[2010/05/17 21:44:46 | 002,283,359 | -H-- | M] () -- C:\Users\Benjamin\AppData\Local\IconCache.db[2010/05/17 15:47:38 | 000,002,077 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk[2010/05/17 14:02:20 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini[2010/05/17 10:18:05 | 060,054,673 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm[2010/05/17 10:07:27 | 000,002,231 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk[2010/05/17 09:24:47 | 000,001,356 | ---- | M] () -- C:\Users\Benjamin\AppData\Local\d3d9caps.dat[2010/05/16 20:23:40 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini[2010/05/16 20:23:32 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts[2010/05/16 19:49:30 | 003,689,585 | R--- | M] () -- C:\Users\Benjamin\Downloads\Desktop\ComboFix.exe[2010/05/15 20:48:23 | 000,055,808 | ---- | M] () -- C:\Users\Benjamin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2010/05/14 22:40:30 | 000,293,376 | ---- | M] () -- C:\Users\Benjamin\Downloads\Desktop\2d7e27sh.exe[2010/05/14 19:11:46 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTL.exe[2010/05/14 19:11:21 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\Benjamin\Downloads\Desktop\OTH.scr[2010/05/12 12:55:48 | 000,000,510 | ---- | M] () -- C:\Users\Public\Desktop\a.exe.lnk[2010/05/10 19:48:36 | 000,000,633 | ---- | M] () -- C:\Users\Benjamin\Downloads\Desktop\Downloads - Shortcut.lnk[2010/05/09 22:50:06 | 040,154,636 | ---- | M] () -- C:\Users\Benjamin\Downloads\Desktop\3101 vid pres final.wmv[2010/04/29 21:42:11 | 000,001,975 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys[2010/04/26 22:12:12 | 000,000,426 | ---- | M] () -- C:\Windows\BRWMARK.INI[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\Windows\PEV.exe[2 C:\Users\Benjamin\Downloads\Desktop\*.tmp files -> C:\Users\Benjamin\Downloads\Desktop\*.tmp -> ]========== Files Created - No Company Name ==========[2010/05/17 15:47:38 | 000,002,077 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk[2010/05/17 10:14:46 | 3211,190,272 | -HS- | C] () -- C:\hiberfil.sys[2010/05/16 19:51:22 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe[2010/05/16 19:51:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe[2010/05/16 19:51:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe[2010/05/16 19:51:22 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe[2010/05/16 19:51:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe[2010/05/16 19:48:52 | 003,689,585 | R--- | C] () -- C:\Users\Benjamin\Downloads\Desktop\ComboFix.exe[2010/05/14 22:39:36 | 000,293,376 | ---- | C] () -- C:\Users\Benjamin\Downloads\Desktop\2d7e27sh.exe[2010/05/12 12:55:48 | 000,000,510 | ---- | C] () -- C:\Users\Public\Desktop\a.exe.lnk[2010/05/10 19:48:36 | 000,000,633 | ---- | C] () -- C:\Users\Benjamin\Downloads\Desktop\Downloads - Shortcut.lnk[2010/05/09 22:52:37 | 040,154,636 | ---- | C] () -- C:\Users\Benjamin\Downloads\Desktop\3101 vid pres final.wmv[2010/05/06 21:48:24 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll[2010/05/06 21:48:24 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini[2010/05/06 21:48:23 | 000,000,414 | ---- | C] () -- C:\Windows\System32\lame_acm.xml[2010/05/06 21:48:22 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll[2010/05/06 21:48:22 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll[2010/05/06 21:48:19 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll[2010/05/06 21:48:19 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest[2010/02/26 16:51:00 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI[2010/02/26 16:51:00 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini[2010/02/26 16:50:27 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini[2010/02/26 16:50:26 | 000,009,853 | ---- | C] () -- C:\Windows\HL-2140.INI[2010/02/26 16:50:11 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI[2010/02/26 16:46:02 | 000,000,319 | ---- | C] () -- C:\Windows\Brownie.ini[2009/12/15 03:58:26 | 000,000,028 | ---- | C] () -- C:\Windows\v2d.INI[2009/11/03 11:38:42 | 000,000,418 | ---- | C] () -- C:\Windows\ArcView9x.INI[2009/05/14 09:06:54 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI[2009/03/25 20:00:05 | 000,000,412 | ---- | C] () -- C:\Windows\MAXLINK.INI[2009/03/13 17:12:06 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys[2009/03/12 11:40:47 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini[2009/02/17 10:29:22 | 000,000,112 | ---- | C] () -- C:\Windows\ActiveSkin.INI[2008/12/31 16:04:42 | 000,691,560 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll[2008/10/11 08:36:36 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI[2008/08/12 21:08:40 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2008/08/12 21:08:22 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini[2008/07/19 15:04:39 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll[2008/07/19 15:04:39 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini[2008/07/19 15:03:50 | 001,548,099 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll[2008/03/21 17:40:31 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll[2008/03/21 17:40:31 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll[2008/03/21 17:01:08 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll[2008/03/21 16:57:18 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll[2008/03/21 16:52:58 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini[2008/03/21 01:32:29 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll[2008/03/21 01:32:15 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll[2007/11/15 08:17:34 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CogentBioSDK.dll[2007/01/26 16:32:18 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys[2006/11/02 22:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll[2006/11/02 17:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini[2004/11/17 13:46:44 | 000,125,440 | ---- | C] () -- C:\Windows\System32\UnzDll.dll[2004/11/17 13:46:42 | 000,130,560 | ---- | C] () -- C:\Windows\System32\ZipDll.dll[2001/12/27 09:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll[2001/09/04 16:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll[2001/07/31 09:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll[2001/07/24 15:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll[1997/06/25 14:24:16 | 000,040,448 | ---- | C] () -- C:\Windows\System32\RegObj.dll========== Alternate Data Streams ==========@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:8AB6C1D7@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FEBEC560@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:8173A019@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:2B99FE60< End of report > Link to post Share on other sites More sharing options...
kahdah Posted May 18, 2010 ID:251854 Share Posted May 18, 2010 Please delete this shortcut icon from off of the desktop: C:\Users\Public\Desktop\a.exe.lnk=======Cleanup======= Click START then RUN Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the Uninstall, it needs to be there.======Next======Double click on OTL to run it.Click on the Cleanup button at the top.You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.This will remove itself and other tools we may have used.===============Update Java===============Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:Download the latest version of Java SE Runtime Environment (JRE) and save it to your desktop.Scroll down to where it says "(JRE) then click on itClick the "Download" button to the right.Select your Platform: "Windows".Select your Language: "Multi-language".Read the License Agreement, and then check the box that says: "Accept License Agreement".Click Continue and the page will refresh.Click on the link to download Windows Offline Installation and save the file to your desktop.Close any programs you may have running - especially your web browser.Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.Click the Remove or Change/Remove button.Repeat as many times as necessary to remove each Java versions.Reboot your computer once all Java components are removed.Then from your desktop double-click on jre-6u20-windows-i586.exe to install the newest version.======================Clear out infected System Restore points======================Then we need to reset your System Restore points.The link below shows how to do this.How to Turn On and Turn Off System Restore in Windows XPhttp://support.microsoft.com/kb/310405/en-usIf you are using Vista then see this link: http://www.bleepingcomputer.com/tutorials/...143.html#manual Delete\uninstall anything else that we have used that is leftover.=====================================After that your all set. The following are some articles and a Windows Update link that I like to suggest to people to prevent malware and general PC maintenance. Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.Prevention article To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes. If your computer is slow Is a tutorial on what you can do if your computer is slow.File sharing program dangers Reasons to stay away from File sharing programs for ex: BitTorrent,Limewire,Kazaa,emule,Utorrent,Limewire etc... Link to post Share on other sites More sharing options...
Recommended Posts