New Virus?!

Hammyobob · September 15, 2010

I went onto the internet to download me a new game that my friend told me about, which was all fine and dandy until I started getting popups from Security suite, and Antimalware doctor or something. Well I downloaded MWB, which helped me clear them all out but I accidentally deleted a system file I wasn't supposed to. So I did a system restore, which then I had to RE-delete the viruses, which was fine but I made extra careful not to delete any system files that I wasn't supposed to.

Well my laptop overheated somehow, then I tried logging on and it wouldn't let me. I waited about 4 hours which then it finally let me on, but said I had a new virus called yruzae.sys. I have looked on Google, haven't found anything concerning it, (It's located in the drivers file). I've found out that it's not a driver, and can't be deleted. Short story is that when I try to boot over 3/4ths of the time it says the driver is corrupt and won't let me log on, gives me a blue screen and then restarts.

When it does work though, I have to wait about 20 minutes for my laptop to start up and the taskbar to unfreeze. I have gotten rid of so many viruses within the past day; and I just did a report that told me 2 programs might have rootkits.. Can anyone PLEASE help me.

kahdah · September 15, 2010

Hello Hammyobob

Welcome to Malwarebytes.

=====================

Download OTL to your desktop.
Double click on OTL to run it.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Under Custom scan's and fixes section paste in the below in bold

netsvcs

%SYSTEMDRIVE%\*.*

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Please download Rootkit Unhooker and save it to your desktop.

Double-click RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan
Check Drivers, Stealth Code, Files, and Code Hooks
Uncheck the rest, then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished then go File > Save Report
Save the report somewhere you can find it, typically your desktop. Click Close
Copy the entire contents of the report and paste it in your next reply.

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Hammyobob · September 15, 2010

Here are the logs.

Roothook.txt

OTL.Txt

Extras.Txt

kahdah · September 15, 2010

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Hammyobob · September 15, 2010

Alright, the scan is done again.

Here's the log

ComboFix.txt

kahdah · September 16, 2010

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:Filefind
autochk.*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Hammyobob · September 16, 2010

Here you go.

SystemLook.txt

kahdah · September 16, 2010

1. Please open Notepad

Click Start , then Run
type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://forums.malwarebytes.org/index.php?showtopic=62732&st=0entry314217

FCopy::
C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe|c:\windows\System32\autochk.exe

Driver::
yruzae

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:6092
uInternet Settings,ProxyOverride = <local>

Collect::
C:\Windows\System32\drivers\yruzae.sys

Dirlook::
C:\ProgramData\MSLPSS
C:\ProgramData\ef92953

2. Save the above as CFScript.txt

3. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

4. During this run Combofix will collect and automatically upload some sample files.

You will see it say Combofix needs to upload some samples.

If it fails to do that do the requested steps at the bottom of this post to manually upload the samples.

5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:

Combofix.txt

===========

Note::

If Combofix fails to upload anything please do the following:

Go to Start > My Computer > C:\

Then Navigate to C:\Qoobox\Quarantine\[4]-Submit_Date_Time.zip

Click Here to upload the submit.zip please.

Hammyobob · September 16, 2010

Sorry for the long wait. Also, thank you for all of your help.

ComboFix.txt

kahdah · September 16, 2010

No problem you are welcome

Update Run Malwarebytes

Please update\run Malwarebytes' Anti-Malware.

Double Click the Malwarebytes Anti-Malware icon to run the application.

Click on the update tab then click on Check for updates.
If an update is found, it will download and install the latest version.
Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

=====

Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.

The program will install and then begin downloading the latest definition files.
After the files have been downloaded on the left side of the page in the Scan section select My Computer
This will start the program and scan your system.
The scan will take a while, so be patient and let it run.
Once the scan is complete, click on View scan report
Now, click on the Save Report as button.
Save the file to your desktop.
Copy and paste that information in your next post.

Hammyobob · September 16, 2010

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4628

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

9/16/2010 8:44:47 AM

mbam-log-2010-09-16 (08-44-47).txt

Scan type: Quick scan

Objects scanned: 125306

Time elapsed: 10 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\YXE7DXCQ37 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Kapersky scan is below

Unfortunately, it won't let me use the online scanner no matter what browser I use, as it says Safari 543.3 (Or something); which I just downloaded Safari and it still won't let me.

kahdah · September 16, 2010

OK try this one then please:

* Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Check next options: Remove found threats and Scan unwanted applications.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt
Copy and paste that log as a reply to this topic

Hammyobob · September 16, 2010

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=0fe403dee74e3e41baca3bfc953f7599

# end=stopped

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-09-16 01:34:49

# local_time=2010-09-16 09:34:49 (-0500, Eastern Daylight Time)

# country="United States"

# lang=9

# osver=6.1.7600 NT

# compatibility_mode=768 16777215 100 0 0 0 0 0

# compatibility_mode=5893 16776573 100 94 0 36188066 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=2301

# found=0

# cleaned=0

# scan_time=817

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=0fe403dee74e3e41baca3bfc953f7599

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-09-16 03:11:34

# local_time=2010-09-16 11:11:34 (-0500, Eastern Daylight Time)

# country="United States"

# lang=9

# osver=6.1.7600 NT

# compatibility_mode=768 16777215 100 0 0 0 0 0

# compatibility_mode=5893 16776573 100 94 0 36189140 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=121017

# found=10

# cleaned=10

# scan_time=5564

C:\Qoobox\Quarantine\[4]-Submit_2010-09-16_07.36.13.zip a variant of Win32/Bubnix.BA trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Users\Hammyobob\AppData\Local\75711.exe.vir a variant of Win32/Kryptik.GQU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Windows\System32\drivers\_yruzae_.sys.zip a variant of Win32/Bubnix.BA trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Users\Hammyobob\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\10ff7513-4b7ccc65 a variant of Java/Exploit.Agent.F trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Users\Hammyobob\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\22faab26-30bbd1e1 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Users\Hammyobob\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\2d475f78-46306e4f a variant of Java/Exploit.Agent.F trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\hlp.dat Win32/Bamital.DZ trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OWEB6739\upgrade[1].cab multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XPPX623K\upgrade[1].cab multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\sysprep\CRYPTBASE.dll Win32/Bamital.DL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

===========================================================

Also, i've noticed a decrease in GB memory today. I went from 182 to 178 in less than 4 hours.

kahdah · September 16, 2010

Also, i've noticed a decrease in GB memory today. I went from 182 to 178 in less than 4 hours.

You mean hard drive space?

Have you added anything to it?

Please submit the following file to one of these online file scanners.

(All you have to do is copy and paste the file path into the box when you click on Browse then once you have done that click on the open button then submit)

c:\windows\System32\autochk.exe

Jotti File Scan
VirusTotal File Scan

This will produce a report after the scan is complete, please copy and paste those results in your next post.

How are things running?

Hammyobob · September 16, 2010

AhnLab-V3 2010.09.17.00 2010.09.16 -

AntiVir 8.2.4.52 2010.09.16 -

Antiy-AVL 2.0.3.7 2010.09.16 -

Authentium 5.2.0.5 2010.09.16 -

Avast 4.8.1351.0 2010.09.16 -

Avast5 5.0.594.0 2010.09.16 -

AVG 9.0.0.851 2010.09.16 -

BitDefender 7.2 2010.09.16 -

CAT-QuickHeal 11.00 2010.09.16 -

ClamAV 0.96.2.0-git 2010.09.16 -

Comodo 6101 2010.09.16 -

DrWeb 5.0.2.03300 2010.09.16 -

Emsisoft 5.0.0.37 2010.09.16 -

eSafe 7.0.17.0 2010.09.15 -

eTrust-Vet 36.1.7860 2010.09.16 -

F-Prot 4.6.1.107 2010.09.16 -

F-Secure 9.0.15370.0 2010.09.16 -

Fortinet 4.1.143.0 2010.09.16 -

GData 21 2010.09.16 -

Ikarus T3.1.1.88.0 2010.09.16 -

Jiangmin 13.0.900 2010.09.16 -

K7AntiVirus 9.63.2533 2010.09.16 -

Kaspersky 7.0.0.125 2010.09.16 -

McAfee 5.400.0.1158 2010.09.16 -

McAfee-GW-Edition 2010.1C 2010.09.16 -

Microsoft 1.6103 2010.09.16 -

NOD32 5456 2010.09.16 -

Norman 6.06.06 2010.09.16 -

nProtect 2010-09-16.02 2010.09.16 -

Panda 10.0.2.7 2010.09.16 -

PCTools 7.0.3.5 2010.09.16 -

Prevx 3.0 2010.09.17 -

Rising 22.65.03.04 2010.09.16 -

Sophos 4.57.0 2010.09.16 -

Sunbelt 6884 2010.09.16 -

SUPERAntiSpyware 4.40.0.1006 2010.09.16 -

Symantec 20101.1.1.7 2010.09.16 -

TheHacker 6.7.0.0.020 2010.09.16 -

TrendMicro 9.120.0.1004 2010.09.16 -

TrendMicro-HouseCall 9.120.0.1004 2010.09.16 -

VBA32 3.12.14.0 2010.09.16 -

ViRobot 2010.8.25.4006 2010.09.16 -

VirusBuster 12.65.10.0 2010.09.16 -

====================================

Things are running well, but i'm afraid that if I turn off my laptop it might not come back on (It's happened before..)

kahdah · September 17, 2010

Things are running well, but i'm afraid that if I turn off my laptop it might not come back on (It's happened before..)

This sounds like a hardware issue.

How often does that happen?

Hammyobob · September 20, 2010

Sorry for the late reply; I just got the notification .

It's only happened while I had the viruses, and now that we've gotten rid of them it hasn't happened since.

kahdah · September 20, 2010

Great.

Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

kahdah · September 24, 2010

Can you please post an updated status on this?

Hammyobob · September 25, 2010

OTL logfile created on: 9/24/2010 8:49:22 PM - Run 2

OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Hammyobob\Downloads

Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free

4.00 Gb Paging File | 2.00 Gb Available in Paging File | 55.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 223.27 Gb Total Space | 180.70 Gb Free Space | 80.93% Space Free | Partition Type: NTFS

Drive D: | 142.39 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: HAMMYOBOB-PC

Current User Name: Hammyobob

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Hammyobob\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Users\Hammyobob\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)

PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)

PRC - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)

PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Windows\System32\StikyNot.exe (Microsoft Corporation)

PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)

========== Modules (SafeList) ==========

MOD - C:\Users\Hammyobob\Downloads\OTL.exe (OldTimer Tools)

MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)

MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)

MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)

MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)

MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)

MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)

MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)

MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)

MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (gusvc) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe File not found

SRV - (gupdate) Google Update Service (gupdate) -- C:\Program Files\Google\Update\GoogleUpdate.exe File not found

SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)

SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (GameConsoleService) -- C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe (WildTangent, Inc.)

SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)

SRV - (TMachInfo) -- C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)

SRV - (cfWiMAXService) -- C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)

SRV - (TosCoSrv) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)

SRV - (TOSHIBA HDD SSD Alert Service) -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)

SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)

SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)

SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)

SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)

SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)

SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)

SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)

SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)

SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)

SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)

SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)

SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)

SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)

SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

SRV - (AxInstSV) ActiveX Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)

SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)

SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)

SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)

========== Driver Services (SafeList) ==========

DRV - (USBCCID) -- C:\Windows\System32\DRIVERS\RtsUCcid.sys File not found

DRV - (RtsUIR) -- C:\Windows\System32\DRIVERS\Rts516xIR.sys File not found

DRV - (RSUSBSTOR) -- C:\Windows\System32\Drivers\RtsUStor.sys File not found

DRV - (EagleNT) -- C:\Windows\System32\drivers\EagleNT.sys File not found

DRV - (catchme) -- C:\Users\HAMMYO~1\AppData\Local\Temp\catchme.sys File not found

DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)

DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software)

DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (ALWIL Software)

DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software)

DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (ALWIL Software)

DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software)

DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)

DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)

DRV - (RTL8187B) -- C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation )

DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)

DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)

DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics Incorporated)

DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)

DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)

DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)

DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)

DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)

DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)

DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)

DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)

DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)

DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)

DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)

DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)

DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)

DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)

DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)

DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)

DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)

DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)

DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)

DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)

DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)

DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)

DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)

DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)

DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)

DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)

DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)

DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)

DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)

DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)

DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)

DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)

DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)

DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)

DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)

DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)

DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)

DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)

DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)

DRV - (rdpbus) -- C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)

DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)

DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)

DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)

DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)

DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)

DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)

DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)

DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)

DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)

DRV - (CompositeBus) -- C:\Windows\system32\DRIVERS\CompositeBus.sys (Microsoft Corporation)

DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)

DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)

DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)

DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)

DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)

DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)

DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)

DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)

DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)

DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)

DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)

DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)

DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)

DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)

DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)

DRV - (LPCFilter) -- C:\Windows\system32\DRIVERS\LPCFilter.sys (COMPAL ELECTRONIC INC.)

DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)

DRV - (RTL8167) -- C:\Windows\System32\drivers\Rt86win7.sys (Realtek )

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br...A&bmod=TSNA

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z007&form=ZGAPHP

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.dogpile.com/

IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Crawler Search"

FF - prefs.js..browser.search.defaultthis.engineName: "T-W Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2578255&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Crawler Search"

FF - prefs.js..browser.search.selectedEngine: "Inbox Search"

FF - prefs.js..browser.search.suggest.enabled: false

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.kongregate.com"

FF - prefs.js..extensions.enabledItems: betterkongregate@matthewammann.com:2.6

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4

FF - prefs.js..extensions.enabledItems: inboxcomtoolbar@inbox.com:1.0.0.36

FF - prefs.js..extensions.enabledItems: prizelivetoolbar@prizelive.com:5.2

FF - prefs.js..extensions.enabledItems: toolbar@alexa.com:1.54

FF - prefs.js..extensions.enabledItems: msntoolbar@msn.com:4.0

FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0

FF - prefs.js..extensions.enabledItems: autosurfer@mygpt.com:1.5

FF - prefs.js..extensions.enabledItems: searchtoolbar@zugo.com:1.2

FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6

FF - prefs.js..extensions.enabledItems: {ACF2B083-3A27-476F-BB88-C928C2ABD8B6}:1.9.1

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.9

FF - prefs.js..keyword.URL: "http://toolbar.inbox.com/search/dispatcher.aspx?tp=sf&tbid=80408&language=en&qkw="

FF - prefs.js..network.proxy.type: 0

FF - user.js..network.proxy.type: 0

FF - user.js..network.proxy.http: ""

FF - user.js..network.proxy.http_port:

FF - user.js..network.proxy.no_proxies_on: ""

FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\Firefox [2010/02/06 02:29:28 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/06/10 11:55:39 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/11 15:41:57 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/11 15:41:57 | 000,000,000 | ---D | M]

[2010/01/16 02:34:52 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Extensions

[2010/07/07 13:40:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2010/01/16 02:34:52 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com

[2010/09/19 04:52:52 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions

[2010/01/10 23:39:34 | 000,000,000 | ---D | M] (FaceFun) -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}

[2010/09/06 22:02:58 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

[2010/08/27 01:58:47 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\autosurfer@mygpt.com

[2010/05/23 15:19:32 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\betterkongregate@matthewammann.com

[2010/05/23 15:19:31 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\firebug@software.joehewitt.com

[2010/07/02 01:57:54 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\inboxcomtoolbar@inbox.com

[2010/04/29 20:02:42 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\prizelivetoolbar@prizelive.com

[2010/08/27 22:43:41 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\searchtoolbar@zugo.com

[2010/06/03 23:11:21 | 000,000,000 | ---D | M] -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\extensions\toolbar@alexa.com

[2010/01/01 20:33:12 | 000,002,424 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\askcom.xml

[2010/08/27 22:43:44 | 000,001,955 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\bing-zugo.xml

[2010/02/09 21:03:53 | 000,002,186 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\bing.xml

[2010/04/21 12:13:10 | 000,000,909 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\conduit.xml

[2010/05/20 23:32:36 | 000,002,179 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\inbox-search.xml

[2010/02/11 07:56:55 | 000,009,977 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\mywebsearch.xml

[2010/06/02 18:52:04 | 000,002,373 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\search-the-web.xml

[2010/06/05 01:27:02 | 000,001,545 | ---- | M] () -- C:\Users\Hammyobob\AppData\Roaming\Mozilla\Firefox\Profiles\nvd7yk0k.default\searchplugins\web-search-powered-by-google.xml

[2010/08/22 10:14:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/09/10 20:19:59 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2010/07/22 22:07:09 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll

[2010/07/22 22:07:10 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll

[2010/07/22 22:07:11 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll

[2010/07/22 19:41:04 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml

[2010/07/22 19:41:04 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml

[2010/07/22 19:41:04 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml

[2010/07/22 19:41:04 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml

[2010/07/22 19:41:04 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml

[2010/07/22 19:41:04 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml

[2010/07/22 19:41:04 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: ([2010/09/16 08:03:43 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll File not found

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll File not found

O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll (Microsoft Corporation)

O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found

O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found

O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found

O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTProAgent.exe (DT Soft Ltd.)

O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe (Microsoft Corporation)

O4 - HKCU..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKCU..\Run: [skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll File not found

O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll File not found

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} http://www.worldwinner.com/games/v57/wof/wof.cab (WoF Control)

O16 - DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} http://www.worldwinner.com/games/v46/monopoly/monopoly.cab (Monopoly Control)

O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 97.81.22.195 24.217.0.5

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL File not found

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL File not found

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll File not found

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/24 11:14:30 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\Desktop\New folder

[2010/09/19 05:03:23 | 000,000,000 | ---D | C] -- C:\Windows\.jagex_cache_32

[2010/09/18 20:20:13 | 000,679,936 | ---- | C] (Generated by JEDI) -- C:\Windows\System32\D3DX81ab.dll

[2010/09/18 20:20:13 | 000,000,000 | ---D | C] -- C:\Program Files\Cheat Engine

[2010/09/16 09:18:00 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2010/09/16 09:17:18 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Program Files

[2010/09/16 09:16:32 | 000,000,000 | R--D | C] -- C:\Users\Hammyobob\Favorites

[2010/09/16 08:51:02 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Roaming\Apple Computer

[2010/09/16 08:51:02 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Local\Apple Computer

[2010/09/16 08:50:43 | 000,000,000 | ---D | C] -- C:\Program Files\Safari

[2010/09/16 08:50:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer

[2010/09/16 08:50:11 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour

[2010/09/16 08:47:13 | 000,000,000 | ---D | C] -- C:\Windows\Sun

[2010/09/16 08:31:29 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Roaming\Malwarebytes

[2010/09/16 08:00:18 | 000,000,000 | ---D | C] -- C:\Device

[2010/09/16 07:59:46 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Local\temp

[2010/09/16 07:31:46 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe

[2010/09/16 07:31:41 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW

[2010/09/15 19:22:58 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2010/09/15 19:22:58 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2010/09/15 19:22:58 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2010/09/15 19:22:35 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2010/09/15 19:19:52 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/09/14 22:27:31 | 000,000,000 | ---D | C] -- C:\Windows\System32\MpEngineStore

[2010/09/13 22:29:30 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Roaming\WildTangent

[2010/09/13 22:28:44 | 000,000,000 | ---D | C] -- C:\ProgramData\WildTangent

[2010/09/12 18:14:38 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\Desktop\Keep everything stored inside HERE

[2010/09/12 02:57:32 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Roaming\skypePM

[2010/09/12 02:56:36 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Roaming\Skype

[2010/09/12 02:56:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2010/09/12 02:56:08 | 000,000,000 | R--D | C] -- C:\Program Files\Skype

[2010/09/10 05:07:09 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Roaming\Opera

[2010/09/10 05:07:09 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Local\Opera

[2010/09/10 05:06:55 | 000,000,000 | ---D | C] -- C:\Program Files\Opera

[2010/09/07 19:13:10 | 000,000,000 | ---D | C] -- C:\Program Files\Windows NT

[2010/09/07 19:13:08 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Journal

[2010/09/07 19:10:30 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Mail

[2010/09/07 18:39:06 | 000,017,744 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswFsBlk.sys

[2010/09/07 18:39:05 | 000,165,456 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswSP.sys

[2010/09/07 18:39:05 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswRdr.sys

[2010/09/07 18:39:04 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswTdi.sys

[2010/09/07 18:38:58 | 000,050,256 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2010/09/07 18:37:52 | 000,165,032 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe

[2010/09/07 18:37:52 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\Windows\avastSS.scr

[2010/09/07 18:37:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software

[2010/09/07 18:37:48 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software

[2010/09/07 17:05:05 | 000,000,000 | -HSD | C] -- C:\ProgramData\MSLPSS

[2010/09/07 17:04:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\ef92953

[2010/09/07 15:54:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010/09/07 15:54:50 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010/09/07 15:54:50 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/09/07 15:54:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010/09/06 23:19:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools

[2010/09/06 22:49:19 | 000,000,000 | ---D | C] -- C:\Users\Hammyobob\AppData\Local\{ACF2B083-3A27-476F-BB88-C928C2ABD8B6}

[2010/09/03 23:14:14 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/24 20:56:09 | 003,407,872 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat

[2010/09/24 20:05:01 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-380095986-3521463129-3638579945-1002UA.job

[2010/09/24 18:52:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010/09/24 16:05:01 | 000,000,872 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-380095986-3521463129-3638579945-1002Core.job

[2010/09/24 11:27:31 | 000,726,316 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2010/09/24 11:27:31 | 000,624,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010/09/24 11:27:31 | 000,106,522 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010/09/24 07:17:27 | 000,016,304 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2010/09/24 07:17:27 | 000,016,304 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2010/09/19 15:23:03 | 000,044,544 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\agremove.exe

[2010/09/19 15:20:41 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010/09/19 15:19:56 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys

[2010/09/19 15:18:49 | 002,567,097 | -H-- | M] () -- C:\Users\Hammyobob\AppData\Local\IconCache.db

[2010/09/19 06:01:33 | 000,000,099 | ---- | M] () -- C:\Users\Hammyobob\jagex_runescape_preferences2.dat

[2010/09/19 05:06:26 | 000,000,046 | ---- | M] () -- C:\Users\Hammyobob\jagex_runescape_preferences.dat

[2010/09/19 05:05:39 | 000,000,000 | ---- | M] () -- C:\Users\Hammyobob\jagex__preferences3.dat

[2010/09/16 08:51:16 | 000,144,768 | -H-- | M] () -- C:\Windows\System32\mlfcache.dat

[2010/09/16 08:50:55 | 000,002,503 | ---- | M] () -- C:\Users\Hammyobob\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk

[2010/09/16 08:04:51 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini

[2010/09/16 08:03:43 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2010/09/16 03:08:26 | 000,000,184 | ---- | M] () -- C:\Windows\System32\MRT.INI

[2010/09/15 02:15:17 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{24328143-c08c-11df-99c9-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/15 02:15:17 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{24328143-c08c-11df-99c9-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/15 02:15:17 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{24328143-c08c-11df-99c9-701a0472a2dd}.TM.blf

[2010/09/15 02:07:27 | 000,000,056 | -H-- | M] () -- C:\Windows\System32\ezsidmv.dat

[2010/09/15 01:50:03 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2010/09/15 01:26:23 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{8938a7c3-c089-11df-8273-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/15 01:26:22 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{8938a7c3-c089-11df-8273-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/15 01:26:22 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{8938a7c3-c089-11df-8273-701a0472a2dd}.TM.blf

[2010/09/14 21:13:05 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{17966f82-c066-11df-9cac-002622ea4e64}.TMContainer00000000000000000002.regtrans-ms

[2010/09/14 21:13:05 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{17966f82-c066-11df-9cac-002622ea4e64}.TMContainer00000000000000000001.regtrans-ms

[2010/09/14 21:13:05 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{17966f82-c066-11df-9cac-002622ea4e64}.TM.blf

[2010/09/14 20:41:11 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{d7c55244-c047-11df-a9b9-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/14 20:41:11 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{d7c55244-c047-11df-a9b9-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/14 20:41:11 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{d7c55244-c047-11df-a9b9-701a0472a2dd}.TM.blf

[2010/09/14 19:07:01 | 000,079,536 | ---- | M] () -- C:\Users\Hammyobob\AppData\Local\GDIPFONTCACHEV1.DAT

[2010/09/13 19:51:54 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{d3d6f8c3-bf91-11df-af64-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/13 19:51:53 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{d3d6f8c3-bf91-11df-af64-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/13 19:51:53 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{d3d6f8c3-bf91-11df-af64-701a0472a2dd}.TM.blf

[2010/09/13 19:21:12 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{ed2876c1-bf8a-11df-a2da-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/13 19:21:12 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{ed2876c1-bf8a-11df-a2da-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/13 19:21:12 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{ed2876c1-bf8a-11df-a2da-701a0472a2dd}.TM.blf

[2010/09/13 18:53:50 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{7cc86301-bf89-11df-aa0a-e20abd15681d}.TMContainer00000000000000000002.regtrans-ms

[2010/09/13 18:53:50 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{7cc86301-bf89-11df-aa0a-e20abd15681d}.TMContainer00000000000000000001.regtrans-ms

[2010/09/13 18:53:50 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{7cc86301-bf89-11df-aa0a-e20abd15681d}.TM.blf

[2010/09/11 11:50:27 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{016a4942-bdbc-11df-8f39-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/11 11:50:27 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{016a4942-bdbc-11df-8f39-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/11 11:50:27 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{016a4942-bdbc-11df-8f39-701a0472a2dd}.TM.blf

[2010/09/11 10:55:44 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{4507c281-bdb3-11df-9dbf-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/11 10:55:44 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{4507c281-bdb3-11df-9dbf-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/11 10:55:44 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{4507c281-bdb3-11df-9dbf-701a0472a2dd}.TM.blf

[2010/09/07 23:10:49 | 113,868,220 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2010/09/07 23:08:10 | 000,000,960 | ---- | M] () -- C:\Users\Hammyobob\Documents\Backup.reg

[2010/09/07 15:25:51 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{56ece043-bab4-11df-81ad-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/07 15:25:51 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{56ece043-bab4-11df-81ad-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/07 15:25:51 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{56ece043-bab4-11df-81ad-701a0472a2dd}.TM.blf

[2010/09/07 00:11:20 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{eb642dc3-ba35-11df-8662-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/07 00:11:20 | 000,524,288 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{eb642dc3-ba35-11df-8662-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/07 00:11:20 | 000,065,536 | -HS- | M] () -- C:\Users\Hammyobob\ntuser.dat{eb642dc3-ba35-11df-8662-701a0472a2dd}.TM.blf

[2010/09/03 23:15:38 | 000,000,262 | ---- | M] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/19 05:05:39 | 000,000,000 | ---- | C] () -- C:\Users\Hammyobob\jagex__preferences3.dat

[2010/09/19 05:05:30 | 000,000,099 | ---- | C] () -- C:\Users\Hammyobob\jagex_runescape_preferences2.dat

[2010/09/19 05:03:50 | 000,000,046 | ---- | C] () -- C:\Users\Hammyobob\jagex_runescape_preferences.dat

[2010/09/18 20:20:14 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll

[2010/09/16 08:51:15 | 000,144,768 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat

[2010/09/16 08:50:55 | 000,002,503 | ---- | C] () -- C:\Users\Hammyobob\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk

[2010/09/16 03:08:26 | 000,000,184 | ---- | C] () -- C:\Windows\System32\MRT.INI

[2010/09/15 19:22:58 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe

[2010/09/15 19:22:58 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2010/09/15 19:22:58 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2010/09/15 19:22:58 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe

[2010/09/15 19:22:58 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2010/09/15 02:07:27 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

[2010/09/15 01:43:42 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{24328143-c08c-11df-99c9-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/15 01:43:42 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{24328143-c08c-11df-99c9-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/15 01:43:42 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{24328143-c08c-11df-99c9-701a0472a2dd}.TM.blf

[2010/09/15 01:26:23 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{8938a7c3-c089-11df-8273-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/15 01:26:22 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{8938a7c3-c089-11df-8273-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/15 01:26:22 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{8938a7c3-c089-11df-8273-701a0472a2dd}.TM.blf

[2010/09/14 21:13:05 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{17966f82-c066-11df-9cac-002622ea4e64}.TMContainer00000000000000000002.regtrans-ms

[2010/09/14 21:13:05 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{17966f82-c066-11df-9cac-002622ea4e64}.TMContainer00000000000000000001.regtrans-ms

[2010/09/14 21:13:05 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{17966f82-c066-11df-9cac-002622ea4e64}.TM.blf

[2010/09/14 17:34:48 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{d7c55244-c047-11df-a9b9-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/14 17:34:48 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{d7c55244-c047-11df-a9b9-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/14 17:34:48 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{d7c55244-c047-11df-a9b9-701a0472a2dd}.TM.blf

[2010/09/13 19:51:54 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{d3d6f8c3-bf91-11df-af64-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/13 19:51:53 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{d3d6f8c3-bf91-11df-af64-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/13 19:51:53 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{d3d6f8c3-bf91-11df-af64-701a0472a2dd}.TM.blf

[2010/09/13 19:02:27 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{ed2876c1-bf8a-11df-a2da-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/13 19:02:27 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{ed2876c1-bf8a-11df-a2da-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/13 19:02:27 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{ed2876c1-bf8a-11df-a2da-701a0472a2dd}.TM.blf

[2010/09/13 18:53:50 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{7cc86301-bf89-11df-aa0a-e20abd15681d}.TMContainer00000000000000000002.regtrans-ms

[2010/09/13 18:53:50 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{7cc86301-bf89-11df-aa0a-e20abd15681d}.TMContainer00000000000000000001.regtrans-ms

[2010/09/13 18:53:50 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{7cc86301-bf89-11df-aa0a-e20abd15681d}.TM.blf

[2010/09/11 11:50:27 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{016a4942-bdbc-11df-8f39-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/11 11:50:27 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{016a4942-bdbc-11df-8f39-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/11 11:50:27 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{016a4942-bdbc-11df-8f39-701a0472a2dd}.TM.blf

[2010/09/11 10:46:18 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{4507c281-bdb3-11df-9dbf-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/11 10:46:17 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{4507c281-bdb3-11df-9dbf-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/11 10:46:17 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{4507c281-bdb3-11df-9dbf-701a0472a2dd}.TM.blf

[2010/09/07 15:23:11 | 000,000,960 | ---- | C] () -- C:\Users\Hammyobob\Documents\Backup.reg

[2010/09/07 15:16:20 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{56ece043-bab4-11df-81ad-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/07 15:16:20 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{56ece043-bab4-11df-81ad-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/07 15:16:20 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{56ece043-bab4-11df-81ad-701a0472a2dd}.TM.blf

[2010/09/07 00:11:20 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{eb642dc3-ba35-11df-8662-701a0472a2dd}.TMContainer00000000000000000002.regtrans-ms

[2010/09/07 00:11:20 | 000,524,288 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{eb642dc3-ba35-11df-8662-701a0472a2dd}.TMContainer00000000000000000001.regtrans-ms

[2010/09/07 00:11:20 | 000,065,536 | -HS- | C] () -- C:\Users\Hammyobob\ntuser.dat{eb642dc3-ba35-11df-8662-701a0472a2dd}.TM.blf

[2010/09/03 23:15:11 | 000,000,262 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini

[2010/08/03 09:11:36 | 000,000,055 | ---- | C] () -- C:\Windows\SpeedGear.INI

[2010/07/27 02:08:20 | 000,107,520 | ---- | C] () -- C:\Windows\System32\SIMANT.DLL

[2010/07/27 02:08:20 | 000,027,136 | ---- | C] () -- C:\Windows\System32\VERMONT1.DLL

[2010/07/27 02:08:20 | 000,012,416 | ---- | C] () -- C:\Windows\System32\VRX1.DLL

[2010/07/24 19:41:00 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2010/07/24 19:27:13 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll

[2010/07/24 19:27:13 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll

[2010/07/24 19:27:13 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll

[2010/06/21 15:19:00 | 000,176,235 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll

[2010/02/09 18:48:50 | 000,000,338 | ---- | C] () -- C:\Users\Hammyobob\AppData\Roaming\settings.dat

[2009/12/25 18:12:03 | 000,009,728 | ---- | C] () -- C:\Windows\System32\BASSMOD.dll

[2009/12/25 07:58:43 | 000,000,952 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2009/12/25 07:58:43 | 000,000,088 | RHS- | C] () -- C:\ProgramData\AA48E39757.sys

[2009/12/25 06:02:20 | 000,000,013 | RHS- | C] () -- C:\Windows\System32\drivers\fbd.sys

[2009/11/18 06:48:26 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI

[2009/11/18 06:29:29 | 000,045,056 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll

[2009/11/18 06:27:39 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll

[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009/07/13 19:12:37 | 000,000,000 | ---- | C] () -- C:\Windows\System32\lz32.dll

[2009/04/28 08:37:00 | 000,028,672 | ---- | C] () -- C:\Windows\System32\SPCtl.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 23040 bytes -> C:\Windows\System32\autochk.exe:BAK

< End of report >

====================================================

Sorry, been so busy lately.

kahdah · September 25, 2010

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

::OTL
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found
[2010/09/07 17:05:05 | 000,000,000 | -HSD | C] -- C:\ProgramData\MSLPSS
[2010/09/07 17:04:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\ef92953
@Alternate Data Stream - 23040 bytes -> C:\Windows\System32\autochk.exe:BAK

Then click the Run Fix button at the top
Let the program run unhindered,when it is done it will say "Fix Complete press ok to open log"
Post that log in your next reply.

==========

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
autochk.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Hammyobob · September 26, 2010

Error: Unable to interpret <::OTL> in the current context!

Error: Unable to interpret <O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll File not found> in the current context!

Error: Unable to interpret <O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.> in the current context!

Error: Unable to interpret <O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found> in the current context!

Error: Unable to interpret <O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.> in the current context!

Error: Unable to interpret <O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found> in the current context!

Error: Unable to interpret <O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found> in the current context!

Error: Unable to interpret <[2010/09/07 17:05:05 | 000,000,000 | -HSD | C] -- C:\ProgramData\MSLPSS> in the current context!

Error: Unable to interpret <[2010/09/07 17:04:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\ef92953> in the current context!

Error: Unable to interpret <@Alternate Data Stream - 23040 bytes -> C:\Windows\System32\autochk.exe:BAK> in the current context!

OTL by OldTimer - Version 3.2.14.1 log created on 09252010_214917

=============================================

SystemLook.txt

kahdah · September 26, 2010

Let me know how things are running?

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found
[2010/09/07 17:05:05 | 000,000,000 | -HSD | C] -- C:\ProgramData\MSLPSS
[2010/09/07 17:04:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\ef92953
@Alternate Data Stream - 23040 bytes -> C:\Windows\System32\autochk.exe:BAK

:Files
C:\Windows\System32\autochk.exe|C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe /replace

Then click the Run Fix button at the top
Let the program run unhindered,when it is done it will say "Fix Complete press ok to open log"
Post that log in your next reply.

================================Follow up scan=================================

Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

Hammyobob · September 27, 2010

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ deleted successfully.

C:\ProgramData\MSLPSS folder moved successfully.

C:\ProgramData\ef92953 folder moved successfully.

ADS C:\Windows\System32\autochk.exe:BAK deleted successfully.

========== FILES ==========

File C:\Windows\System32\autochk.exe successfully replaced with C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe

OTL by OldTimer - Version 3.2.14.1 log created on 09272010_013107

OTL.Txt

kahdah · September 27, 2010

=======Cleanup=======

Click START then RUN
Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the Uninstall, it needs to be there.

======Next======

Double click on OTL to run it.
Click on the Cleanup button at the top.
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.
This will remove itself and other tools we may have used.

===============Update Java===============

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java SE Runtime Environment (JRE) and save it to your desktop.
Scroll down to where it says "(JRE) then click on it
Click the "Download" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.

======================Clear out infected System Restore points======================

Then we need to reset your System Restore points.

The link below shows how to do this.

How to Turn On and Turn Off System Restore in Windows XP

http://support.microsoft.com/kb/310405/en-us

If you are using Vista then see this link: http://www.bleepingcomputer.com/tutorials/...143.html#manual

Delete\uninstall anything else that we have used that is leftover.

After that your all set.

===The following are some articles and a Windows Update link that I like to suggest to people to prevent malware and general PC maintenance===

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Prevention article Some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.

"How did I get infected in the first place?" Also this one by Tony Klein.

If your computer is slow Is a tutorial on what you can do if your computer is slow.

File sharing program dangers Reasons to stay away from File sharing programs for ex: BitTorrent,Limewire,Kazaa,emule,Utorrent etc...

===Free antimalware tools used for on demand scanning and cleaning no real time unless purchased===

Malwarebytes Antimalware

superantispyware

===Free antivirus links===

This is antivirus and antispyware.

Microsoft Security Essentials

This is free antispyware protection and Antivirus protection.

AVG free 9.0

This is just antivirus protection.

Antivir

This is antivirus and antispyware protection.

Avast

New Virus?!

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information