mord3ca1 Posted October 22, 2010 ID:331825 Share Posted October 22, 2010 So recently my computer has been running much slower than normal and kinda lagging a bit so I ran MBAM and got these results and was hoping someone could help me out. (This is 64-bit Win7 btw)Malwarebytes' Anti-Malware 1.41Database version: 2928Windows 6.1.760010/22/2010 5:40:34 AMmbam-log-2010-10-22 (05-40-34).txtScan type: Quick ScanObjects scanned: 84876Time elapsed: 2 minute(s), 18 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 1Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.Folders Infected:(No malicious items detected)Files Infected:C:\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.Since I have seen you guys ask for the OTL and the Rootkit I ran a test just in case and here are the results.OTL logfile created on: 10/22/2010 12:32:52 PM - Run 1OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\James\Desktop64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 59.00% Memory free8.00 Gb Paging File | 6.00 Gb Available in Paging File | 73.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 465.76 Gb Total Space | 297.14 Gb Free Space | 63.80% Space Free | Partition Type: NTFSDrive D: | 232.88 Gb Total Space | 53.82 Gb Free Space | 23.11% Space Free | Partition Type: NTFSDrive F: | 139.73 Gb Total Space | 17.18 Gb Free Space | 12.30% Space Free | Partition Type: NTFSDrive G: | 465.76 Gb Total Space | 32.02 Gb Free Space | 6.87% Space Free | Partition Type: NTFSComputer Name: JAMES-PC | User Name: James | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days[color=#E56717]========== Processes (SafeList) ==========[/color]PRC - [2010/10/22 12:16:11 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exePRC - [2010/09/03 05:25:30 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exePRC - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exePRC - [2010/07/12 09:32:48 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exePRC - [2010/07/09 16:09:52 | 000,248,936 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exePRC - [2010/07/09 12:04:34 | 003,493,776 | ---- | M] (Xfire Inc.) -- C:\Program Files (x86)\Xfire\Xfire.exePRC - [2010/05/30 21:13:24 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exePRC - [2010/05/12 17:04:48 | 000,599,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exePRC - [2010/05/12 17:03:22 | 000,300,472 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exePRC - [2010/04/01 10:58:04 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exePRC - [2009/11/24 16:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exePRC - [2009/11/24 16:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exePRC - [2009/11/24 16:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exePRC - [2009/11/24 16:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exePRC - [2009/11/24 16:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exePRC - [2009/09/22 16:57:50 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razerhid.exePRC - [2009/06/17 04:44:11 | 000,085,160 | ---- | M] (Elaborate Bytes AG) -- C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exePRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exePRC - [2008/11/18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exePRC - [2008/06/11 22:43:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exePRC - [2007/12/19 12:58:24 | 000,163,840 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\DeathAdder\razerofa.exePRC - [2007/04/30 19:43:54 | 003,450,608 | ---- | M] (Stardock) -- C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exePRC - [2007/04/07 13:02:08 | 002,010,624 | ---- | M] (Samurize.com) -- C:\Program Files (x86)\Samurize\Client.exePRC - [2006/11/24 16:24:16 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[color=#E56717]========== Modules (SafeList) ==========[/color]MOD - [2010/10/22 12:16:11 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exeMOD - [2010/08/20 22:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dllMOD - [2010/07/09 12:04:44 | 000,970,640 | ---- | M] (Xfire Inc.) -- C:\Program Files (x86)\Xfire\xfire_toucan_43094.dllMOD - [2009/07/13 18:16:20 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wsock32.dllMOD - [2007/11/01 17:23:00 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msvcr71.dllMOD - [2007/04/30 19:18:50 | 000,112,400 | ---- | M] () -- C:\Program Files (x86)\Stardock\ObjectDock\DockShellHook.dll[color=#E56717]========== Win32 Services (SafeList) ==========[/color]SRV:[b]64bit:[/b] - File not found [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)SRV:[b]64bit:[/b] - [2010/05/12 21:16:09 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)SRV:[b]64bit:[/b] - [2009/11/24 16:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)SRV:[b]64bit:[/b] - [2009/11/24 16:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)SRV:[b]64bit:[/b] - [2009/11/24 16:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)SRV:[b]64bit:[/b] - [2009/11/24 16:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)SRV:[b]64bit:[/b] - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)SRV:[b]64bit:[/b] - [2009/07/13 18:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)SRV - [2010/09/03 12:25:50 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)SRV - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)SRV - [2010/07/09 16:09:52 | 000,248,936 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)SRV - [2010/05/30 21:13:24 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)SRV - [2010/05/12 21:13:57 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)SRV - [2010/05/12 20:41:09 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)SRV - [2009/10/09 01:05:14 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)SRV - [2008/11/18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)SRV - [2008/08/15 05:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4)[color=#E56717]========== Driver Services (SafeList) ==========[/color]DRV:[b]64bit:[/b] - [2010/06/21 15:07:36 | 000,131,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)DRV:[b]64bit:[/b] - [2010/04/19 20:47:42 | 000,050,688 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:[b]64bit:[/b] - [2009/12/17 15:25:17 | 000,034,472 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)DRV:[b]64bit:[/b] - [2009/11/24 16:50:05 | 000,022,096 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)DRV:[b]64bit:[/b] - [2009/11/24 16:49:56 | 000,065,616 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)DRV:[b]64bit:[/b] - [2009/10/16 06:44:56 | 001,309,696 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\P17.sys -- (P17)DRV:[b]64bit:[/b] - [2009/08/09 14:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)DRV:[b]64bit:[/b] - [2009/07/13 18:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:[b]64bit:[/b] - [2009/07/13 18:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:[b]64bit:[/b] - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:[b]64bit:[/b] - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:[b]64bit:[/b] - [2009/07/13 18:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:[b]64bit:[/b] - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:[b]64bit:[/b] - [2009/06/10 13:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)DRV:[b]64bit:[/b] - [2009/06/10 13:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)DRV:[b]64bit:[/b] - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:[b]64bit:[/b] - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:[b]64bit:[/b] - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:[b]64bit:[/b] - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:[b]64bit:[/b] - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:[b]64bit:[/b] - [2009/04/21 19:08:10 | 000,012,800 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\danew.sys -- (danewFltr)DRV:[b]64bit:[/b] - [2008/07/26 15:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)DRV:[b]64bit:[/b] - [2008/07/26 15:22:34 | 002,624,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)DRV:[b]64bit:[/b] - [2008/02/06 03:00:00 | 000,054,480 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)DRV:[b]64bit:[/b] - [2007/08/02 09:33:04 | 000,012,672 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dadder.sys -- (DAdderFltr)DRV:[b]64bit:[/b] - [2005/03/29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)DRV - [2008/08/14 07:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWow64\drivers\adfs.sys -- (adfs)[color=#E56717]========== Standard Registry (SafeList) ==========[/color][color=#E56717]========== Internet Explorer ==========[/color]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 80 E1 84 67 82 71 CB 01 [binary data]IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local[color=#E56717]========== FireFox ==========[/color]FF - prefs.js..browser.search.selectedEngine: "Google"FF - prefs.js..browser.search.useDBForOrder: trueFF - prefs.js..browser.startup.homepage: "google.com"FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1FF - prefs.js..extensions.enabledItems: YoutubeDownloader@PeterOlayev.com:1.5FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21FF - prefs.js..extensions.enabledItems: tabutils@ithinc.cn:0.9.9.8.3FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/10/21 05:39:31 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/10/07 21:20:06 | 000,000,000 | ---D | M][2010/05/23 20:44:18 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Extensions[2010/05/23 20:44:18 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org[2010/10/22 05:46:52 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions[2010/03/10 08:58:02 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}[2010/10/20 21:58:24 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}[2010/05/17 21:46:53 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\firebug@software.joehewitt.com[2010/10/21 17:45:06 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\tabutils@ithinc.cn[2010/08/20 04:27:11 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\YoutubeDownloader@PeterOlayev.com[2010/03/10 09:14:07 | 000,001,201 | ---- | M] () -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\searchplugins\winamp-search.xml[2010/10/22 05:30:55 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions[2010/05/12 21:58:39 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2010/05/30 20:33:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}[2010/08/20 03:56:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}[2010/05/12 16:42:04 | 000,124,344 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\CCMSDK.dll[2010/05/12 16:43:54 | 000,070,592 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\CgpCore.dll[2010/05/12 16:42:52 | 000,091,576 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\confmgr.dll[2010/05/12 16:42:32 | 000,022,464 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\ctxlogging.dll[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll[2010/05/12 17:22:36 | 000,423,328 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll[2010/07/12 09:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll[2010/05/12 16:43:56 | 000,024,000 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\TcpPServ.dllO1 HOSTS File: ([2010/05/12 21:08:22 | 000,344,272 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO1 - Hosts: 127.0.0.1 www.007guard.comO1 - Hosts: 127.0.0.1 007guard.comO1 - Hosts: 127.0.0.1 008i.comO1 - Hosts: 127.0.0.1 www.008k.comO1 - Hosts: 127.0.0.1 008k.comO1 - Hosts: 127.0.0.1 www.00hq.comO1 - Hosts: 127.0.0.1 00hq.comO1 - Hosts: 127.0.0.1 010402.comO1 - Hosts: 127.0.0.1 www.032439.comO1 - Hosts: 127.0.0.1 032439.comO1 - Hosts: 127.0.0.1 www.0scan.comO1 - Hosts: 127.0.0.1 0scan.comO1 - Hosts: 127.0.0.1 1000gratisproben.comO1 - Hosts: 127.0.0.1 www.1000gratisproben.comO1 - Hosts: 127.0.0.1 1001namen.comO1 - Hosts: 127.0.0.1 www.1001namen.comO1 - Hosts: 127.0.0.1 100888290cs.comO1 - Hosts: 127.0.0.1 www.100888290cs.comO1 - Hosts: 127.0.0.1 www.100sexlinks.comO1 - Hosts: 127.0.0.1 100sexlinks.comO1 - Hosts: 127.0.0.1 10sek.comO1 - Hosts: 127.0.0.1 www.10sek.comO1 - Hosts: 127.0.0.1 www.1-2005-search.comO1 - Hosts: 127.0.0.1 1-2005-search.comO1 - Hosts: 127.0.0.1 123haustiereundmehr.comO1 - Hosts: 11798 more lines...O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()O2 - BHO: (no name) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - No CLSID value found.O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()O3 - HKLM\..\Toolbar: (no name) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - No CLSID value found.O3 - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Default.lnk = C:\Program Files (x86)\Samurize\Client.exe (Samurize.com)O4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files (x86)\LimeWire\LimeWire.exe (Lime Wire, LLC)O4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe (Stardock)O4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0O8:[b]64bit:[/b] - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()O8:[b]64bit:[/b] - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8:[b]64bit:[/b] - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8:[b]64bit:[/b] - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8:[b]64bit:[/b] - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O13 - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab (Creative Software AutoUpdate Support Package)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.238.64.12O18:[b]64bit:[/b] - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not foundO18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not foundO18:[b]64bit:[/b] - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not foundO18:[b]64bit:[/b] - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not foundO18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]O32 - AutoRun File - [2007/08/17 14:48:16 | 000,000,040 | ---- | M] () - G:\autorun.inf -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*[color=#E56717]========== Files/Folders - Created Within 90 Days ==========[/color][2010/10/22 12:15:52 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe[2010/10/22 05:17:30 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee[2010/10/22 05:13:27 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live[2010/10/22 05:12:09 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Windows Live[2010/10/22 05:08:22 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%[2010/10/21 05:39:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect[2010/10/21 05:38:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp[2010/10/20 21:44:24 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Activision[2010/10/20 21:26:04 | 000,000,000 | -HSD | C] -- C:\Windows\ftpcache[2010/10/20 20:01:18 | 001,017,545 | ---- | C] (CPUID) -- C:\Windows\SysWow64\cpuz.exe[2010/10/20 19:59:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CEVO[2010/10/20 18:57:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samurize[2010/10/20 18:37:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER[2010/10/20 18:35:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office[2010/10/20 18:35:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services[2010/10/20 18:34:52 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Microsoft Help[2010/10/20 18:34:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office[2010/10/20 18:34:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help[2010/10/20 18:34:36 | 000,000,000 | RH-D | C] -- C:\MSOCache[2010/10/07 21:22:42 | 000,000,000 | ---D | C] -- C:\Users\James\Documents\Stardock[2010/10/07 21:22:41 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Stardock[2010/10/07 21:22:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Stardock[2010/10/07 21:22:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Stardock[2010/10/07 21:20:10 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\ICAClient[2010/10/07 21:20:10 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Citrix[2010/10/07 21:20:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Citrix[2010/09/25 05:23:12 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes[2010/09/25 05:23:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes[2010/09/25 05:23:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod[2010/09/19 21:09:52 | 000,000,000 | ---D | C] -- C:\SwarmCache[2010/09/19 20:59:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SystemRequirementsLab[2010/09/19 20:59:07 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\SystemRequirementsLab[2010/09/19 20:59:03 | 000,000,000 | ---D | C] -- C:\Windows\Sun[2010/09/19 17:30:38 | 000,000,000 | ---D | C] -- C:\UDK[2010/09/19 17:22:25 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\NVIDIA[2010/09/19 00:14:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Chart Controls[2010/09/18 23:53:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime[2010/09/12 04:20:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET[2010/09/12 03:42:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenAL[2010/09/12 03:21:31 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour[2010/09/12 03:21:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour[2010/09/03 05:31:16 | 000,000,000 | ---D | C] -- C:\Users\James\Documents\My Games[2010/09/03 05:29:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SquareEnix[2010/08/20 04:35:55 | 000,000,000 | ---D | C] -- C:\Users\James\Documents\3DReaperDX[2010/08/20 04:29:58 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation[2010/08/20 04:29:20 | 000,065,128 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll[2010/08/20 04:29:20 | 000,056,936 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll[2010/08/20 04:02:39 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Do not install[2010/08/20 04:02:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\3DRipperDX[2010/08/20 03:56:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java[color=#E56717]========== Files - Modified Within 90 Days ==========[/color][2010/10/22 12:16:11 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe[2010/10/22 12:09:56 | 000,133,632 | ---- | M] () -- C:\Users\James\Desktop\RKUnhookerLE.EXE[2010/10/22 12:04:18 | 000,000,293 | ---- | M] () -- C:\Windows\game.ini[2010/10/22 11:52:57 | 000,028,910 | ---- | M] () -- C:\Users\James\Documents\cc_20101022_115249.reg[2010/10/22 11:20:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/10/22 05:49:54 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2010/10/22 05:49:54 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2010/10/22 05:42:10 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys[2010/10/22 05:19:27 | 000,743,066 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2010/10/22 05:19:27 | 000,626,844 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2010/10/22 05:19:27 | 000,107,160 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2010/10/21 19:17:10 | 000,233,960 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr[2010/10/21 19:02:03 | 000,233,960 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe[2010/10/21 05:39:31 | 000,001,016 | ---- | M] () -- C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk[2010/10/21 04:52:56 | 000,001,940 | ---- | M] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Default.lnk[2010/10/21 04:42:26 | 003,018,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT[2010/10/20 22:07:08 | 000,737,238 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2010/10/07 21:22:42 | 000,002,069 | ---- | M] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk[2010/10/04 17:55:21 | 002,601,752 | ---- | M] () -- C:\Windows\SysWow64\pbsvc_moh.exe[2010/09/21 22:36:24 | 000,000,487 | ---- | M] () -- C:\WorkerOutput.bin[2010/09/18 23:42:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf[2010/09/12 03:42:43 | 000,419,840 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll[2010/09/12 03:42:43 | 000,413,696 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll[color=#E56717]========== Files Created - No Company Name ==========[/color][2010/10/22 12:09:48 | 000,133,632 | ---- | C] () -- C:\Users\James\Desktop\RKUnhookerLE.EXE[2010/10/22 11:52:53 | 000,028,910 | ---- | C] () -- C:\Users\James\Documents\cc_20101022_115249.reg[2010/10/22 05:19:27 | 000,743,066 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2010/10/21 04:52:56 | 000,001,940 | ---- | C] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Default.lnk[2010/10/20 20:01:18 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\pv_c3.exe[2010/10/07 21:22:41 | 000,002,069 | ---- | C] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk[2010/10/04 18:07:35 | 002,601,752 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_moh.exe[2010/09/21 22:36:24 | 000,000,487 | ---- | C] () -- C:\WorkerOutput.bin[2010/09/18 23:42:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf[2010/08/20 04:29:20 | 000,012,264 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb[2010/07/09 12:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll[2010/05/31 17:00:58 | 000,000,580 | ---- | C] () -- C:\Program Files (x86)\KalOnlineEng - Shortcut.lnk[2010/05/13 12:10:05 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll[2010/05/12 21:52:38 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\nvTextureToolsUtil.dll[2010/05/12 21:52:38 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\nvISWOW64.dll[2010/05/12 20:33:00 | 000,000,029 | ---- | C] () -- C:\Windows\sfbm.INI[2010/03/10 08:25:14 | 000,000,293 | ---- | C] () -- C:\Windows\game.ini[2009/10/09 00:48:57 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini[2009/10/09 00:30:05 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL[2009/10/09 00:30:05 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL[2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll[2009/07/13 14:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll[2008/11/13 14:07:24 | 000,002,177 | ---- | C] () -- C:\Windows\P17EP.ini[2007/12/04 13:20:30 | 000,001,489 | ---- | C] () -- C:\Windows\P17EP51.ini[2007/06/07 13:25:42 | 000,001,578 | ---- | C] () -- C:\Windows\P17EPLS.ini[2006/10/10 20:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS[color=#E56717]========== LOP Check ==========[/color][2010/05/30 22:15:39 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\FileZilla[2010/10/21 07:39:06 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\ICAClient[2010/10/22 05:43:35 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\LimeWire[2010/03/12 14:50:16 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Notepad++[2010/03/10 09:26:08 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Planetside Software[2010/03/10 08:12:18 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Razer[2010/09/19 20:59:08 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\SystemRequirementsLab[2010/03/10 09:26:08 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\uk.co.planetside[2009/07/13 22:08:49 | 000,019,144 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT[color=#E56717]========== Purity Check ==========[/color][color=#E56717]========== Alternate Data Streams ==========[/color]@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:CE2C623F< End of report >OTL Extras logfile created on: 10/22/2010 12:32:52 PM - Run 1OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\James\Desktop64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 59.00% Memory free8.00 Gb Paging File | 6.00 Gb Available in Paging File | 73.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 465.76 Gb Total Space | 297.14 Gb Free Space | 63.80% Space Free | Partition Type: NTFSDrive D: | 232.88 Gb Total Space | 53.82 Gb Free Space | 23.11% Space Free | Partition Type: NTFSDrive F: | 139.73 Gb Total Space | 17.18 Gb Free Space | 12.30% Space Free | Partition Type: NTFSDrive G: | 465.76 Gb Total Space | 32.02 Gb Free Space | 6.87% Space Free | Partition Type: NTFSComputer Name: JAMES-PC | User Name: James | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days[color=#E56717]========== Extra Registry (SafeList) ==========[/color][color=#E56717]========== File Associations ==========[/color][b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation).url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)[HKEY_USERS\S-1-5-21-1495976551-2759534863-3276432394-1001\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)[color=#E56717]========== Shell Spawning ==========[/color][b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %* File not foundcmdfile [open] -- "%1" %* File not foundcomfile [open] -- "%1" %* File not foundexefile [open] -- "%1" %* File not foundhelpfile [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %* File not foundregfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1" File not foundscrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /S File not foundtxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not foundDirectory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)[color=#E56717]========== Security Center Settings ==========[/color][b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc][color=#E56717]========== Firewall Settings ==========[/color][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"DisableNotifications" = 0"EnableFirewall" = 1[color=#E56717]========== Authorized Applications List ==========[/color][color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{104FB32A-7CE3-4C4B-B2AA-70C613FF9DFA}" = iTunes"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant"{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64"{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17"{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64"{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64"{B37A99DD-88E2-4ED0-80B4-1E054AB354BF}" = Adobe InDesign CS4 Icon Handler x64"{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile"KLiteCodecPack64_is1" = K-Lite Codec Pack (64-bit) v2.6.3"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile"NVIDIA Display Control Panel" = NVIDIA Display Control Panel"NVIDIA Drivers" = NVIDIA Drivers"UDK-94877a1f-b8dd-4421-b55f-8afdfb974fba" = Unreal Development Kit: 2010-01"UDK-97925c8c-5ebc-4c00-928f-bb1ebc2a5b18" = Unreal Development Kit: 2010-01"UDK-acaa9e9e-431e-4f32-bf89-507116a3a443" = Unreal Development Kit: 2010-08"UDK-d07108ae-da60-4cf6-be22-d89ffecbd4eb" = Unreal Development Kit: 2010-01"WinRAR archiver" = WinRAR archiver[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam"{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4"{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty(R) - World at War(TM) 1.6 Patch"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4"{14F70205-1940-4000-88C7-BE799A6B2CAD}" = Adobe Soundbooth CS4"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en"{23F79416-CAD1-41BF-99A3-040F6C814AAA}" = NVIDIA Photoshop Plug-ins"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 21"{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}" = Adobe CS4 American English Speech Analysis Models"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)"{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty(R) - World at War(TM) 1.2 Patch"{2D7F824B-6744-4C30-B78B-0966E9BD461D}" = KalOnlineEng"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin"{41785C66-90F2-40CE-8CB5-1C94BFC97280}" = Microsoft Chart Controls for Microsoft .NET Framework 3.5"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform"{52232EF4-CC12-4C21-ABCF-ADB79618302D}" = Adobe Soundbooth CS4 Codecs"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter"{5EAD5443-7194-46CC-A055-428E6ABB1BAF}" = Adobe Encore CS4"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support"{65C967FA-29D8-4A5F-99C5-BC9AF1F8F9D2}" = NVIDIA Texture Tools 2 - 64 bit"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack"{7406DF60-016D-476B-A2C7-55D997592047}" = Adobe OnLocation CS4"{750C87B8-AF19-4C3C-B791-50D9C83AE572}" = Call of Duty(R) - World at War(TM) 1.7 Patch"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail"{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty(R) - World at War(TM) 1.4 Patch"{A6EC82A0-1414-475D-8AFD-469089F3080D}" = Adobe Contribute CS4"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Fran Link to post Share on other sites More sharing options...
Gammo Posted October 24, 2010 ID:332923 Share Posted October 24, 2010 Hi,Download TFC to your desktopOpen the file and close any other windows.It will close all programs itself when run, make sure to let it run uninterrupted.Click the Start button to begin the process. The program should not take long to finish its jobOnce its finished it should reboot your machine, if not, do this yourself to ensure a complete clean~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Please download Malwarebytes' Anti-Malware from HereDouble Click mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.Once the program has loaded, click the "Update" tab and click the "Check For updates" button.Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~First delete your copy of OTL.exe from the desktop.Then download the latest version of OTL to your DesktopDouble click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.Check the box that says Scan All Users.Under the Custom Scan box paste this innetsvcsdrivers32 %SYSTEMDRIVE%\*.*%systemroot%\*. /mp /sCREATERESTOREPOINT%systemroot%\System32\config\*.sav HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AUHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rsClick the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic Link to post Share on other sites More sharing options...
mord3ca1 Posted October 25, 2010 Author ID:333375 Share Posted October 25, 2010 The OTL only produced the OTl.txt and did not open up or show a EXTRA.txt fileMalwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4940Windows 6.1.7600Internet Explorer 8.0.7600.1638510/25/2010 12:11:05 AMmbam-log-2010-10-25 (00-11-05).txtScan type: Quick scanObjects scanned: 138839Time elapsed: 3 minute(s), 32 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)============================================================OTL logfile created on: 10/25/2010 12:11:45 AM - Run 2OTL by OldTimer - Version 3.2.17.1 Folder = C:\Users\James\Desktop64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 68.00% Memory free8.00 Gb Paging File | 6.00 Gb Available in Paging File | 79.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 465.76 Gb Total Space | 295.59 Gb Free Space | 63.46% Space Free | Partition Type: NTFSDrive D: | 232.88 Gb Total Space | 52.45 Gb Free Space | 22.52% Space Free | Partition Type: NTFSDrive F: | 139.73 Gb Total Space | 17.18 Gb Free Space | 12.30% Space Free | Partition Type: NTFSDrive G: | 465.76 Gb Total Space | 32.02 Gb Free Space | 6.87% Space Free | Partition Type: NTFSComputer Name: JAMES-PC | User Name: James | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days[color=#E56717]========== Processes (SafeList) ==========[/color]PRC - [2010/10/25 00:08:29 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exePRC - [2010/09/03 05:25:30 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exePRC - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exePRC - [2010/07/12 09:32:48 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exePRC - [2010/07/09 16:09:52 | 000,248,936 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exePRC - [2010/07/09 12:04:34 | 003,493,776 | ---- | M] (Xfire Inc.) -- C:\Program Files (x86)\Xfire\Xfire.exePRC - [2010/05/30 21:13:24 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exePRC - [2010/05/12 17:04:48 | 000,599,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exePRC - [2010/05/12 17:03:22 | 000,300,472 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exePRC - [2009/11/24 16:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exePRC - [2009/11/24 16:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exePRC - [2009/11/24 16:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exePRC - [2009/11/24 16:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exePRC - [2009/11/24 16:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exePRC - [2009/09/22 16:57:50 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razerhid.exePRC - [2009/06/17 04:44:11 | 000,085,160 | ---- | M] (Elaborate Bytes AG) -- C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exePRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exePRC - [2008/11/18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exePRC - [2008/06/11 22:43:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exePRC - [2007/12/19 12:58:24 | 000,163,840 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\DeathAdder\razerofa.exePRC - [2007/04/30 19:43:54 | 003,450,608 | ---- | M] (Stardock) -- C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exePRC - [2007/04/07 13:02:08 | 002,010,624 | ---- | M] (Samurize.com) -- C:\Program Files (x86)\Samurize\Client.exePRC - [2006/11/24 16:24:16 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[color=#E56717]========== Modules (SafeList) ==========[/color]MOD - [2010/10/25 00:08:29 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exeMOD - [2010/08/20 22:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dllMOD - [2010/07/09 12:04:44 | 000,970,640 | ---- | M] (Xfire Inc.) -- C:\Program Files (x86)\Xfire\xfire_toucan_43094.dllMOD - [2009/07/13 18:16:20 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wsock32.dllMOD - [2007/11/01 17:23:00 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msvcr71.dllMOD - [2007/04/30 19:18:50 | 000,112,400 | ---- | M] () -- C:\Program Files (x86)\Stardock\ObjectDock\DockShellHook.dll[color=#E56717]========== Win32 Services (SafeList) ==========[/color]SRV:[b]64bit:[/b] - File not found [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)SRV:[b]64bit:[/b] - [2010/05/12 21:16:09 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)SRV:[b]64bit:[/b] - [2009/11/24 16:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)SRV:[b]64bit:[/b] - [2009/11/24 16:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)SRV:[b]64bit:[/b] - [2009/11/24 16:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)SRV:[b]64bit:[/b] - [2009/11/24 16:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)SRV:[b]64bit:[/b] - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)SRV:[b]64bit:[/b] - [2009/07/13 18:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)SRV - [2010/09/03 12:25:50 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)SRV - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)SRV - [2010/07/09 16:09:52 | 000,248,936 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)SRV - [2010/05/30 21:13:24 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)SRV - [2010/05/12 21:13:57 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)SRV - [2010/05/12 20:41:09 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)SRV - [2009/10/09 01:05:14 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)SRV - [2008/11/18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)SRV - [2008/08/15 05:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4)[color=#E56717]========== Driver Services (SafeList) ==========[/color]DRV:[b]64bit:[/b] - [2010/06/21 15:07:36 | 000,131,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)DRV:[b]64bit:[/b] - [2010/04/19 20:47:42 | 000,050,688 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:[b]64bit:[/b] - [2009/12/17 15:25:17 | 000,034,472 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)DRV:[b]64bit:[/b] - [2009/11/24 16:50:05 | 000,022,096 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)DRV:[b]64bit:[/b] - [2009/11/24 16:49:56 | 000,065,616 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)DRV:[b]64bit:[/b] - [2009/10/16 06:44:56 | 001,309,696 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\P17.sys -- (P17)DRV:[b]64bit:[/b] - [2009/08/09 14:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)DRV:[b]64bit:[/b] - [2009/07/13 18:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:[b]64bit:[/b] - [2009/07/13 18:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:[b]64bit:[/b] - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:[b]64bit:[/b] - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:[b]64bit:[/b] - [2009/07/13 18:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:[b]64bit:[/b] - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:[b]64bit:[/b] - [2009/06/10 13:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)DRV:[b]64bit:[/b] - [2009/06/10 13:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)DRV:[b]64bit:[/b] - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:[b]64bit:[/b] - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:[b]64bit:[/b] - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:[b]64bit:[/b] - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:[b]64bit:[/b] - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:[b]64bit:[/b] - [2009/04/21 19:08:10 | 000,012,800 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\danew.sys -- (danewFltr)DRV:[b]64bit:[/b] - [2008/07/26 15:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)DRV:[b]64bit:[/b] - [2008/07/26 15:22:34 | 002,624,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)DRV:[b]64bit:[/b] - [2008/02/06 03:00:00 | 000,054,480 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)DRV:[b]64bit:[/b] - [2007/08/02 09:33:04 | 000,012,672 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dadder.sys -- (DAdderFltr)DRV:[b]64bit:[/b] - [2005/03/29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)DRV - [2010/10/22 21:21:47 | 000,034,560 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWow64\drivers\Normandy.sys -- (Normandy)DRV - [2008/08/14 07:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWow64\drivers\adfs.sys -- (adfs)[color=#E56717]========== Standard Registry (SafeList) ==========[/color][color=#E56717]========== Internet Explorer ==========[/color]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 80 E1 84 67 82 71 CB 01 [binary data]IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local[color=#E56717]========== FireFox ==========[/color]FF - prefs.js..browser.search.selectedEngine: "Google"FF - prefs.js..browser.search.useDBForOrder: trueFF - prefs.js..browser.startup.homepage: "google.com"FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1FF - prefs.js..extensions.enabledItems: YoutubeDownloader@PeterOlayev.com:1.5FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21FF - prefs.js..extensions.enabledItems: tabutils@ithinc.cn:0.9.9.8.3FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.41FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/10/21 05:39:31 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/10/07 21:20:06 | 000,000,000 | ---D | M][2010/05/23 20:44:18 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Extensions[2010/05/23 20:44:18 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org[2010/10/23 06:06:43 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions[2010/03/10 08:58:02 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}[2010/10/20 21:58:24 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}[2010/10/22 20:06:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}[2010/05/17 21:46:53 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\firebug@software.joehewitt.com[2010/10/21 17:45:06 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\tabutils@ithinc.cn[2010/08/20 04:27:11 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\extensions\YoutubeDownloader@PeterOlayev.com[2010/03/10 09:14:07 | 000,001,201 | ---- | M] () -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\583epq1e.default\searchplugins\winamp-search.xml[2010/10/23 06:06:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions[2010/05/12 21:58:39 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2010/05/30 20:33:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}[2010/08/20 03:56:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}[2010/05/12 16:42:04 | 000,124,344 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\CCMSDK.dll[2010/05/12 16:43:54 | 000,070,592 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\CgpCore.dll[2010/05/12 16:42:52 | 000,091,576 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\confmgr.dll[2010/05/12 16:42:32 | 000,022,464 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\ctxlogging.dll[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll[2010/05/12 17:22:36 | 000,423,328 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll[2010/07/12 09:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll[2010/05/12 16:43:56 | 000,024,000 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\TcpPServ.dllO1 HOSTS File: ([2010/10/23 18:03:54 | 000,343,547 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO1 - Hosts: 127.0.0.1 www.007guard.comO1 - Hosts: 127.0.0.1 007guard.comO1 - Hosts: 127.0.0.1 008i.comO1 - Hosts: 127.0.0.1 www.008k.comO1 - Hosts: 127.0.0.1 008k.comO1 - Hosts: 127.0.0.1 www.00hq.comO1 - Hosts: 127.0.0.1 00hq.comO1 - Hosts: 127.0.0.1 010402.comO1 - Hosts: 127.0.0.1 www.032439.comO1 - Hosts: 127.0.0.1 032439.comO1 - Hosts: 127.0.0.1 www.0scan.comO1 - Hosts: 127.0.0.1 0scan.comO1 - Hosts: 127.0.0.1 1000gratisproben.comO1 - Hosts: 127.0.0.1 www.1000gratisproben.comO1 - Hosts: 127.0.0.1 1001namen.comO1 - Hosts: 127.0.0.1 www.1001namen.comO1 - Hosts: 127.0.0.1 100888290cs.comO1 - Hosts: 127.0.0.1 www.100888290cs.comO1 - Hosts: 127.0.0.1 10sek.comO1 - Hosts: 127.0.0.1 www.10sek.comO1 - Hosts: 127.0.0.1 www.1-2005-search.comO1 - Hosts: 127.0.0.1 1-2005-search.comO1 - Hosts: 127.0.0.1 123haustiereundmehr.comO1 - Hosts: 127.0.0.1 www.123haustiereundmehr.comO1 - Hosts: 127.0.0.1 www.123moviedownload.comO1 - Hosts: 11773 more lines...O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()O2 - BHO: (no name) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - No CLSID value found.O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()O3 - HKLM\..\Toolbar: (no name) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - No CLSID value found.O3 - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-1495976551-2759534863-3276432394-1001..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Default.lnk = C:\Program Files (x86)\Samurize\Client.exe (Samurize.com)O4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files (x86)\LimeWire\LimeWire.exe (Lime Wire, LLC)O4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe (Stardock)O4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0O8:[b]64bit:[/b] - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()O8:[b]64bit:[/b] - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8:[b]64bit:[/b] - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8:[b]64bit:[/b] - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8:[b]64bit:[/b] - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O13 - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab (Creative Software AutoUpdate Support Package)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.238.64.12O18:[b]64bit:[/b] - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not foundO18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not foundO18:[b]64bit:[/b] - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not foundO18:[b]64bit:[/b] - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not foundO18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]O32 - AutoRun File - [2007/08/17 14:48:16 | 000,000,040 | ---- | M] () - G:\autorun.inf -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*NetSvcs:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)Drivers32:[b]64bit:[/b] msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32:[b]64bit:[/b] VIDC.FFDS - ff_vfw.dll ()Drivers32:[b]64bit:[/b] vidc.i420 - lvcod64.dll (Logitech Inc.)Drivers32:[b]64bit:[/b] VIDC.XFR1 - xfcodec64.dll ()Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)Drivers32: VIDC.XFR1 - C:\Windows\SysWow64\xfcodec.dll ()CREATERESTOREPOINTRestore point Set: OTL Restore Point[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color][2010/10/25 00:08:26 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe[2010/10/23 19:38:19 | 000,000,000 | --SD | C] -- C:\Program Files (x86)\HLSW[2010/10/23 19:38:19 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\HLSW[2010/10/22 21:19:07 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\ElevatedDiagnostics[2010/10/22 20:07:04 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\QuickScan[2010/10/22 05:17:30 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee[2010/10/22 05:13:27 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live[2010/10/22 05:12:09 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Windows Live[2010/10/22 05:08:22 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%[2010/10/21 05:39:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect[2010/10/21 05:38:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp[2010/10/20 21:44:24 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Activision[2010/10/20 21:26:04 | 000,000,000 | -HSD | C] -- C:\Windows\ftpcache[2010/10/20 20:01:18 | 001,017,545 | ---- | C] (CPUID) -- C:\Windows\SysWow64\cpuz.exe[2010/10/20 19:59:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CEVO[2010/10/20 18:57:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samurize[2010/10/20 18:37:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER[2010/10/20 18:35:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office[2010/10/20 18:35:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services[2010/10/20 18:34:52 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Microsoft Help[2010/10/20 18:34:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office[2010/10/20 18:34:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help[2010/10/20 18:34:36 | 000,000,000 | RH-D | C] -- C:\MSOCache[2010/10/07 21:22:42 | 000,000,000 | ---D | C] -- C:\Users\James\Documents\Stardock[2010/10/07 21:22:41 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Stardock[2010/10/07 21:22:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Stardock[2010/10/07 21:22:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Stardock[2010/10/07 21:20:10 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\ICAClient[2010/10/07 21:20:10 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\Citrix[2010/10/07 21:20:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Citrix[2010/09/25 05:23:12 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes[2010/09/25 05:23:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes[2010/09/25 05:23:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod[color=#E56717]========== Files - Modified Within 30 Days ==========[/color][2010/10/25 00:12:16 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2010/10/25 00:12:16 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2010/10/25 00:08:29 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe[2010/10/25 00:05:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/10/25 00:05:00 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys[2010/10/25 00:03:06 | 000,080,071 | ---- | M] () -- C:\Users\James\Desktop\Diamond_13k_lecture.rtf[2010/10/24 01:23:01 | 000,007,607 | ---- | M] () -- C:\Users\James\AppData\Local\Resmon.ResmonCfg[2010/10/23 22:58:19 | 000,233,960 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr[2010/10/23 22:58:19 | 000,233,960 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe[2010/10/23 19:49:55 | 000,000,004 | -H-- | M] () -- C:\Windows\SysWow64\__iw3mp[2010/10/22 21:21:47 | 000,034,560 | ---- | M] () -- C:\Windows\SysWow64\drivers\Normandy.sys[2010/10/22 17:56:17 | 345,905,788 | ---- | M] () -- C:\Windows\MEMORY.DMP[2010/10/22 12:04:18 | 000,000,293 | ---- | M] () -- C:\Windows\game.ini[2010/10/22 11:52:57 | 000,028,910 | ---- | M] () -- C:\Users\James\Documents\cc_20101022_115249.reg[2010/10/22 05:19:27 | 000,743,066 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2010/10/22 05:19:27 | 000,626,844 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2010/10/22 05:19:27 | 000,107,160 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2010/10/21 05:39:31 | 000,001,016 | ---- | M] () -- C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk[2010/10/21 04:52:56 | 000,001,940 | ---- | M] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Default.lnk[2010/10/21 04:42:26 | 003,018,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT[2010/10/20 22:07:08 | 000,737,238 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2010/10/07 21:22:42 | 000,002,069 | ---- | M] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk[2010/10/04 17:55:21 | 002,601,752 | ---- | M] () -- C:\Windows\SysWow64\pbsvc_moh.exe[color=#E56717]========== Files Created - No Company Name ==========[/color][2010/10/25 00:03:05 | 000,080,071 | ---- | C] () -- C:\Users\James\Desktop\Diamond_13k_lecture.rtf[2010/10/24 01:23:01 | 000,007,607 | ---- | C] () -- C:\Users\James\AppData\Local\Resmon.ResmonCfg[2010/10/23 19:49:55 | 000,000,004 | -H-- | C] () -- C:\Windows\SysWow64\__iw3mp[2010/10/22 13:25:02 | 345,905,788 | ---- | C] () -- C:\Windows\MEMORY.DMP[2010/10/22 12:38:44 | 000,034,560 | ---- | C] () -- C:\Windows\SysWow64\drivers\Normandy.sys[2010/10/22 11:52:53 | 000,028,910 | ---- | C] () -- C:\Users\James\Documents\cc_20101022_115249.reg[2010/10/22 05:19:27 | 000,743,066 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2010/10/21 04:52:56 | 000,001,940 | ---- | C] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Default.lnk[2010/10/20 20:01:18 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\pv_c3.exe[2010/10/07 21:22:41 | 000,002,069 | ---- | C] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk[2010/10/04 18:07:35 | 002,601,752 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_moh.exe[2010/07/09 12:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll[2010/05/31 17:00:58 | 000,000,580 | ---- | C] () -- C:\Program Files (x86)\KalOnlineEng - Shortcut.lnk[2010/05/13 12:10:05 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll[2010/05/12 21:52:38 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\nvTextureToolsUtil.dll[2010/05/12 21:52:38 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\nvISWOW64.dll[2010/05/12 20:33:00 | 000,000,029 | ---- | C] () -- C:\Windows\sfbm.INI[2010/03/10 08:25:14 | 000,000,293 | ---- | C] () -- C:\Windows\game.ini[2009/10/09 00:48:57 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini[2009/10/09 00:30:05 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL[2009/10/09 00:30:05 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL[2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll[2009/07/13 14:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll[2008/11/13 14:07:24 | 000,002,177 | ---- | C] () -- C:\Windows\P17EP.ini[2007/12/04 13:20:30 | 000,001,489 | ---- | C] () -- C:\Windows\P17EP51.ini[2007/06/07 13:25:42 | 000,001,578 | ---- | C] () -- C:\Windows\P17EPLS.ini[2006/10/10 20:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS[color=#E56717]========== LOP Check ==========[/color][2010/05/30 22:15:39 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\FileZilla[2010/10/23 19:51:20 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\HLSW[2010/10/21 07:39:06 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\ICAClient[2010/10/25 00:06:11 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\LimeWire[2010/03/12 14:50:16 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Notepad++[2010/03/10 09:26:08 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Planetside Software[2010/10/22 20:07:18 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\QuickScan[2010/03/10 08:12:18 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\Razer[2010/09/19 20:59:08 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\SystemRequirementsLab[2010/03/10 09:26:08 | 000,000,000 | ---D | M] -- C:\Users\James\AppData\Roaming\uk.co.planetside[2009/07/13 22:08:49 | 000,022,172 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT[color=#E56717]========== Purity Check ==========[/color][color=#E56717]========== Custom Scans ==========[/color][color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color][2009/06/10 14:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat[2009/06/10 14:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini[2010/10/25 00:05:00 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll[2006/12/02 00:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll[2010/10/25 00:05:01 | 4293,386,240 | -HS- | M] () -- C:\pagefile.sys[2010/07/16 14:39:33 | 000,016,733 | ---- | M] () -- C:\tstamps.log[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI[2010/03/19 16:55:52 | 002,073,703 | ---- | M] () -- C:\VS_EXPBSLN_x64_enu.CAB[2010/03/19 16:58:20 | 000,551,424 | ---- | M] () -- C:\VS_EXPBSLN_x64_enu.MSI[2010/09/21 22:36:24 | 000,000,487 | ---- | M] () -- C:\WorkerOutput.bin[color=#A23BEC]< %systemroot%\*. /mp /s >[/color][color=#A23BEC]< %systemroot%\System32\config\*.sav >[/color][color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >[/color][color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >[/color][color=#E56717]========== Alternate Data Streams ==========[/color]@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:CE2C623F< End of report > Link to post Share on other sites More sharing options...
mord3ca1 Posted October 25, 2010 Author ID:333376 Share Posted October 25, 2010 *EDIT* Extras.txt file was not found I mean. Link to post Share on other sites More sharing options...
Gammo Posted October 25, 2010 ID:333520 Share Posted October 25, 2010 Hi,I'd like us to scan your machine with ESET OnlineScanHold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScanClick the button.For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on to download the ESET Smart Installer. Save it to your desktop.Double click on the icon on your desktop.Check Click the button.Accept any security warnings from your browser.Check Push the Start button.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.When the scan completes, push Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.Push the button.Push Link to post Share on other sites More sharing options...
mord3ca1 Posted October 26, 2010 Author ID:333852 Share Posted October 26, 2010 No threats found. Link to post Share on other sites More sharing options...
Gammo Posted October 26, 2010 ID:333991 Share Posted October 26, 2010 Hi,Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. Download OTC to your desktop and run itA list of tool components used in the Cleanup of malware will be downloaded.If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.Click Yes to begin the Cleanup process and remove these components, including this application.You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Please download JavaRa to your desktop and unzip it to its own folderRun JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.Accept any prompts.Open JavaRa.exe again and select Search For Updates.Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep a backup of your important filesNow, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Make proper use of your anti-virus and firewallYou should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep all your software updatedIt is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Use a safer web browserInternet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Some other security programsIt is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.SpywareBlaster to help prevent spyware from installing in the first place.MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Be carefulHaving security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Slow computer?If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!Cheers,Gammo Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 30, 2010 ID:336880 Share Posted October 30, 2010 This case is resolved, and the topic now Closed.The procedures used here were only for -this system- and no other.If you are a casual viewer and are having issues, please create your own New Topic and follow forum procedures.See http://www.malwarebytes.org/forums/index.php?showtopic=9573 Link to post Share on other sites More sharing options...
Recommended Posts