Jump to content

Persistent virus -- please help!


Recommended Posts

Hi! I have a friend who recently used these forums and got a lot of help from Gamma in eradicating the virus(es) from her computer. I am having similar problems with my computer and was wondering if you could please help! I periodically run Malwarebytes, AdAware, and AVG, but none of them are consistently finding an issue. I get periodic pop-up ads, and my computer seems to be running very slowly lately. It also sometimes locks up so that I can't even log in. Please help!

Thank you!

Link to post
Share on other sites

Hello aharvey

Welcome to Malwarebytes.

=====================

  • Download OTL to your desktop.
  • Double click on OTL to run it.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Please download Rootkit Unhooker and save it to your desktop.

  • Double-click RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan
  • Check Drivers, Stealth Code, Files, and Code Hooks
  • Uncheck the rest, then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished then go File > Save Report
  • Save the report somewhere you can find it, typically your desktop. Click Close
  • Copy the entire contents of the report and paste it in your next reply.

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Link to post
Share on other sites

Hi! Thank you so much for your help.

Every time I try to cut and paste all of the reports into one post, I get an "internet explorer cannot display this page" error message, so I'm going to try to paste them one (or maybe two) at a time and see if that works.

Here is the Rootkit Unhooker report:

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #1

==============================================

>Drivers

==============================================

0xB9A08000 C:\WINDOWS\system32\drivers\ALCXWDM.SYS 2281472 bytes (Realtek Semiconductor Corp., Realtek AC'97 Audio Driver (WDM))

0xBF08A000 C:\WINDOWS\System32\ati3duag.dll 2187264 bytes (ATI Technologies Inc. , ati3duag.dll)

0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2066816 bytes (Microsoft Corporation, NT Kernel & System)

0x804D7000 PnpManager 2066816 bytes

0x804D7000 RAW 2066816 bytes

0x804D7000 WMIxWDM 2066816 bytes

0xBF800000 Win32k 1851392 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1851392 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xB9CB1000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 1003520 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)

0xB9E35000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xB56D1000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xBF2A0000 C:\WINDOWS\System32\ativvaxx.dll 438272 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)

0xB57DC000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xB2C43000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)

0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)

0xB2CEA000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xBF04D000 C:\WINDOWS\System32\ati2cqag.dll 249856 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)

0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 241664 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)

0xB9978000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)

0xB9F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xB2FEE000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0xB9E08000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xB1C1C000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)

0xB5741000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xB578E000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xB5682000 C:\WINDOWS\System32\Drivers\aswSP.SYS 159744 bytes (AVAST Software, avast! self protection module)

0xB9F23000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)

0xB57B6000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)

0xB99E4000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xB9C58000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xB9C35000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xB576C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0xB9C7C000 C:\WINDOWS\system32\DRIVERS\b57xp32.sys 135168 bytes (Broadcom Corporation, Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver.)

0x806D0000 ACPI_HAL 131840 bytes

0x806D0000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xB9EEB000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xB9F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xB9DEE000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xB9F0B000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xB31D3000 C:\WINDOWS\System32\Drivers\aswMon2.SYS 94208 bytes (AVAST Software, avast! File System Filter Driver for Windows XP)

0xB9EC2000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xB99B9000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xB2FD9000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xB99D0000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xB9C9D000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xB5835000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xBF30B000 C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\RASDD.DLL 73728 bytes (Microsoft Corporation, Raster Common Printer Driver DLL)

0xB9ED9000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)

0xB9F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xB99A8000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xBA2A8000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xBA2E8000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xBA318000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)

0xBA308000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xBA0F8000 Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver)

0xBA2F8000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xB341A000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xBA1E8000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xBA2D8000 C:\WINDOWS\system32\DRIVERS\AmdK8.sys 57344 bytes (Advanced Micro Devices, AMD Processor Driver)

0xBA0E8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xBA138000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)

0xBA148000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xBA0C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xBA168000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xBA258000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xBA0B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xBA158000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xBA208000 C:\WINDOWS\System32\Drivers\aswTdi.SYS 40960 bytes (AVAST Software, avast! TDI Filter Driver)

0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xB2DBB000 C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 40960 bytes (LogMeIn, Inc., LogMeIn Rfs Drivemap Driver)

0xBA1A8000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xBA108000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0xBA188000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xBA0D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xBA298000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)

0xBA178000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xBA218000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xB22DB000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xBA288000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xBA4B0000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xBA3C0000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0xBA3E8000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)

0xBA480000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xBA360000 C:\WINDOWS\System32\Drivers\Aavmker4.SYS 24576 bytes (AVAST Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP)

0xBA400000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xBA3F8000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xBA490000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xBA448000 C:\WINDOWS\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver)

0xBA4A0000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xBA430000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xBA440000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xBA420000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xBA3B8000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)

0xBA418000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xBA560000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0xB9DB2000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xB3376000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xBA58C000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xB989C000 C:\WINDOWS\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver)

0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xBA590000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xBA540000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

0xB25E7000 C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys 12288 bytes

0xBA568000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0xBA59C000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xBA570000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xBA5EC000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)

0xBA5E8000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xBA5F0000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xBA63A000 C:\Program Files\LogMeIn\x86\RaInfo.sys 8192 bytes (LogMeIn, Inc., RemotelyAnywhere Kernel Information Provider)

0xBA5F4000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xBA5D8000 C:\WINDOWS\system32\DRIVERS\serscan.sys 8192 bytes (Microsoft Corporation, Serial Imaging Device Driver)

0xBA5DE000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xBA5E4000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xBA5AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xBA7DF000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xBA6BC000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xBA7DD000 C:\WINDOWS\system32\DRIVERS\lmimirr.sys 4096 bytes (LogMeIn, Inc., LogMeIn Mirror Miniport Driver)

0xBA693000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

!!!!!!!!!!!Hidden driver: 0x89495AEA ?_empty_? 1302 bytes

!!!!!!!!!!!Hidden driver: 0x895D2030 ?_empty_? 0 bytes

==============================================

>Stealth

==============================================

0xB9F0B000 WARNING: suspicious driver modification [atapi.sys::0x89495AEA]

0xBA2E8000 WARNING: Virus alike driver modification [cdrom.sys], 65536 bytes

==============================================

>Files

==============================================

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Cookies\administrator@forums.malwarebytes[2].txt

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6574E16A-E12B-11DF-ACF3-0013D3B1A229}.dat

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6FE7EFDE-E12B-11DF-ACF3-0013D3B1A229}.dat

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6FE7EFDF-E12B-11DF-ACF3-0013D3B1A229}.dat

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\2ILASX8B\blank[1].htm

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\2ILASX8B\expand_nor[1]

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\2ILASX8B\js[1].js

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\2ILASX8B\login-warning-icon[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\2ILASX8B\login_wbe_gd[1].jpg

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\2ILASX8B\setTheme[1].php

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\3GR7015H\collapse_nor[1]

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\3GR7015H\favicon_gd[1].ico

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\3GR7015H\gradients[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\3GR7015H\js[1].js

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\3GR7015H\print[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\BQ3L5SQ9\css[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\BQ3L5SQ9\favicon_gd[1].ico

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\BQ3L5SQ9\gradients[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\BQ3L5SQ9\index[2].htm

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\BQ3L5SQ9\login-bottom[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\BQ3L5SQ9\style.css[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\BQ3L5SQ9\theme.css[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\CY1NL1JT\base[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\CY1NL1JT\help_16[1]

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\CY1NL1JT\js[1].js

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\CY1NL1JT\NewTabPageScripts[1]

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\CY1NL1JT\style.css[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\CY1NL1JT\top[1]

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\EJL2VDN5\actionbar_large[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\EJL2VDN5\close_nor[1]

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\EJL2VDN5\js[1].js

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\EJL2VDN5\js[2].js

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\EJL2VDN5\login_secureserver_net[1].htm

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\EJL2VDN5\silver-button-background[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\EJL2VDN5\style.css[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\OZNSOI9K\js[1].js

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\OZNSOI9K\login-dots[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\OZNSOI9K\previews[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\OZNSOI9K\tabswelcome[1]

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\OZNSOI9K\themes_retro[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\T0HV2949\actionbar_large[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\T0HV2949\base[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\T0HV2949\js[1].php

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\T0HV2949\js[2].php

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\T0HV2949\tabs[1].gif

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temporary Internet Files\Content.IE5\T0HV2949\themes_retro[1].css

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temp\~DF10A9.tmp

!-->[Hidden] C:\Documents and Settings\administrator.BRAC\Local Settings\Temp\~DF5B61.tmp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4D7LR41P\1dnX5.m6Ee%2fSZ%3d160X600A%2fV%3d2.3S%2f%2fST%3d0QwS0h8g0_7a1B293VwOeq2_3S02va02va%2fREDIRURL%3d&_salt=3778083119&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htmm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4D7LR41P\1dnXx.IFAu%2fSZ%3d160X600A%2fV%3d2.3S%2f%2fST%3d0QwS0h8g0_7a1B293VwOeq2_3S02va02va%2fREDIRURL%3d&_salt=2884778019&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htmm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4D7LR41P\1dwB9.mptb%2fSZ%3d160X600A%2fV%3d0QwS%2f%2fST%3d0QwS0h8R0_741B1_3VwOeq0QwS02va02va%2fREDIRURL%3d&_salt=235397645&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htm0c

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4D7LR41P\24783%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386[1].htm0c

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4YL5Z8JC\1cTxz.ka0C%2fSZ%3d300X250A%2fV%3d2.3S%2f%2fST%3d0QwS0h8R0_721B203VwOeq2_3S02vc02vc%2fREDIRURL%3d&_salt=568144277&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4YL5Z8JC\24523%2C23061%2C24783%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511[1].htmp]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4YL5Z8JC\SZ%3d468X60A%7c728X90A%2fV%3d0Qwf%2f%2fST%3d0Qwf0h8R0_731B213VwOeq0Qwf033A034T%2fREDIRURL%3d&_salt=628754188&B=10&u=http%3A%2F%2Fwww.celebrity-gossip[1].htm0c

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4YL5Z8JC\SZ%3d468X60A%7c728X90A%2fV%3d2.3S%2f%2fST%3d0Qwf0h8g0_7Z1B2C3VwOeq2_3S033A034T%2fREDIRURL%3d&_salt=1609888451&B=10&u=http%3A%2F%2Fwww.celebrity-gossip[1].htmc

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4YL5Z8JC\SZ%3d468X60A%7c728X90A%2fV%3d2.3S%2f%2fST%3d0Qwf0h8g0_7Z1B2C3VwOeq2_3S033A034T%2fREDIRURL%3d&_salt=872541887&B=10&u=http%3A%2F%2Fwww.celebrity-gossip[1].htmp]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4YL5Z8JC\XXX,cm-71244443_1287752891,11bf7cecff8c483,weath,cm.weath_l;;cmw=owl;sz=300x250;net=cm;

env=ifr;ord1=632641;contx=weath;dc=w;btg=cm[1].weath_l;ord=[timestamp]c

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\1991[1].swf

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\22560%2C24523%2C23061%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511[1].htm80

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\22560%2C24523%2C23061%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511[2].htm80

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\24973-2[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\24973-2[2].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\24974-15[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\24974-2[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\24974-2[2].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCA1F44F0.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCA2JGQO3.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCA8MXJ2S.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCA9OEVMH.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCA9PTUOT.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCABCC08V.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCABXSR8H.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAGZ6O0D.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAHTUG8W.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAJKA5NZ.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAJKHM20.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAO6CZWI.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAP81LPF.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAQ9L2FT.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAR3057W.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCASH01QT.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAYX2SMS.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\ajsCAZX2M3V.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\break_us[1]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\break_us[2]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\broker[1].pli

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\broker[2].pli

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\channels[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\comp[1].gif

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\crossdomain[4].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\crossdomain[7].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\distribconfig_mwm_pcw_default[2].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\impCAVVIN8X

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\index[1].gif

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\inter_2_249[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\inter_53[1].poll

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\j[1].ad

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCABHUU9C.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCABULRYB.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCADXA3OJ.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCAFMCZ3B.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCAJXCPNA.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCAL3D27B.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCAN0AL02.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCANP314R.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\targetedOfferCAPDVOWZ.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8APTOEY4\to=y%7Cp=1669%7Cvar=CN.ad.lotame[1].tags%7Cout=json

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\24973-2[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\24974-15[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCA34W4H2.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCA3V35IC.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCA7ARG8M.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCA8GVSYT.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCA9FZI1W.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAE4404A.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAFAFIZB.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAG14NV4.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAHO2Q32.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAHRKY8K.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAIKUR9J.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAKP65BM.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAL0RK5L.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAMMM170.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAN9ZVEJ.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCANSU4JM.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\ajsCAOZY62J.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\BRI_global_slideshow[1].jpg

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\crossdomain[2].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\crossdomain[5].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\distribconfig_mwm_pcw_default[2].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\inter_53[1].poll

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\pixel[1].swf

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\p[1].gif

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\targetedOfferCA7EDD1X.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\targetedOfferCAIW5DII.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\targetedOfferCAQQKJ0V.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\targetedOfferCAXH28KX.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\to=y%7Cp=1669%7Cvar=CN.ad.lotame[1].tags%7Cout=json

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AC80O9BG\to=y%7Cp=1669%7Cvar=CN.ad.lotame[2].tags%7Cout=json

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJX4TFJZ\1cTys.GUey%2fSZ%3d160X600A%2fV%3d0QwS%2f%2fST%3d0QwS0h8R0_741B1_3VwOeq0QwS02va02va%2fREDIRURL%3d&_salt=921213343&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJX4TFJZ\21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483%2C24482[1].htmm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJX4TFJZ\23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483[1].htmm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJX4TFJZ\23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483[2].htmm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJX4TFJZ\23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483[3].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\11bf7cecff8c483%2C%2CXXX,cm-57350716_1287752843,11bf7cecff8c483,weath,;;cmw=owl;sz=728x90;net=cm;env=ifr;ord

1=936165;contx=weath;dc=w;btg=;ord=[timestamp][1]m

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483%2C24482%2C24322%2C24162%2C24320%2C24500%2C21411[1].htmp]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\1cTum.7tRQ%2fSZ%3d300X250A%2fV%3d0QwS%2f%2fST%3d0QwS0h8R0_721B203VwOeq0QwS02vc02vc%2fREDIRURL%3d&_salt=1780364678&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htm]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\1cTwI.P5GS%2fSZ%3d300X250A%2fV%3d0QwS%2f%2fST%3d0QwS0h8R0_721B203VwOeq0QwS02vc02vc%2fREDIRURL%3d&_salt=1720697045&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htm]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\1dnUf.WvtJ%2fSZ%3d160X600A%2fV%3d0QwS%2f%2fST%3d0QwS0hBf0_Cr1BAx3VwOeq0QwS02va02va%2fREDIRURL%3d&_salt=1681268555&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htm]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\22560%2C24523%2C23061%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511[1].htm1]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483%2C24482%2C24322%2C24162%2C24320%2C24500[1].htm1]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\JZ3S81DL\24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483%2C24482%2C24322%2C19982%2C24162%2C24320%2C24500%2C21411%2C23394[1].htm1]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MTV9DXWZ\1cTw_.Wcho%2fSZ%3d160X600A%2fV%3d0QwS%2f%2fST%3d0QwS0h8R0_741B1_3VwOeq0QwS02va02va%2fREDIRURL%3d&_salt=1172200665&B=10&u=http%3A%2F%2Fwww.gossipcenter[1].htm]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MTV9DXWZ\21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483%2C24482%2C24322[1].htm0c

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MTV9DXWZ\24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000%2C24483%2C24482%2C24322%2C24162[1].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MTV9DXWZ\24523%2C23061%2C24783%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511[1].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MTV9DXWZ\SZ%3d468X60A%7c728X90A%2fV%3d0Qwf%2f%2fST%3d0Qwf0h8R0_731B213VwOeq0Qwf033A034T%2fREDIRURL%3d&_salt=3284463291&B=10&u=http%3A%2F%2Fwww.celebrity-gossip[1].htmm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MTV9DXWZ\SZ%3d468X60A%7c728X90A%2fV%3d2.3S%2f%2fST%3d0Qwf0h8R0_731B213VwOeq2_3S033A034T%2fREDIRURL%3d&_salt=2180281388&B=10&u=http%3A%2F%2Fwww.celebrity-gossip[1].htmm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MTV9DXWZ\XXX,cm-41732206_1287752891,11bf7cecff8c483,weath,cm.weath_l;;cmw=owl;sz=728x90;net=cm;e

nv=ifr;ord1=738124;contx=weath;dc=w;btg=cm[1].weath_l;ord=[timestamp]0c

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\3844638[1].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCA0EQH6W.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCA21IHGK.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCA3VDCL9.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCA4OGVIL.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCA7UPZZW.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAD61VVC.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAEJXU3G.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAHT7IDY.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAJWHD5Q.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAL1TQK9.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAM0WENV.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAM38DNN.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAM4TCWC.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAMFLSN5.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAMWBK5T.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCANMKN2X.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAQKNFKR.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCARAVX42.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCASRWJL1.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAVNN2IJ.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\ajsCAYBEEUA.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\break_us[1]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\crossdomain[4].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\crossdomain[5].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\distribconfig_mwm_pcw_default[1].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\distribconfig_mwm_pcw_default[2].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\index[1].gif

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\index[2].gif

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\inter_82[1].poll

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\j[2].ad

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\pixel[2]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\targetedOfferCA9BNINI.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\targetedOfferCA9RKL37.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\targetedOfferCANRG8ZT.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\targetedOfferCAXMDZRV.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\PEYMMN4B\techgrouch-251641-10-04-2010[1].flv

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QBJB0SD6\23061%2C24783%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329[1].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QBJB0SD6\23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386%2C23000[1].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QBJB0SD6\24783%2C23394%2C23395%2C21385%2C21389%2C24156%2C24833%2C24087%2C19982%2C23592%2C24396%2C23077%2C23304%2C24175%2C23929%2C22363%2C24511%2C22329%2C24386[1].htmtm

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\24973-2[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\24974-2[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCA7UR5ZS.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCA7VSQVJ.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAAZGS7U.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCACW6FGY.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAEJK6LA.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAERXUYZ.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAET8HJC.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAFD5PGA.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAIRTS75.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAJ7L3FB.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCALM4OLR.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAN8HEPR.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCANP3BOJ.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAOHICDZ.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAWX64NP.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\ajsCAXOWIXK.php

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\break_us[1]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\break_us[2]

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\crossdomain[1].xml

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\dref=http%253A%252F%252Fwww.mevio.com%252Fepisode%252F254515%252Freform-school-vs[1].-rochelle-diamante-u-smile

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\dref=http%253A%252F%252Fwww.mevio[1].com%252Fchannels%252F

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\index[1].gif

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\inter_2_249[1].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\inter_2_249[2].js

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\jeep_728X90_static2[1].jpg

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\pixel[1].swf

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\targetedOfferCA00YLAD.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\targetedOfferCA2PZWGF.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\targetedOfferCA9SR3U4.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\targetedOfferCAII0KT9.jsp

!-->[Hidden] C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\YNEABUIK\targetedOfferCAOUIPLG.jsp

!-->[Hidden] C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\6EMZAP3L\!category-float%7C!category-spiketv%7Cpos-btf%7Cenvid-origin%7Curi-_full-episode_101010_39837%7Ctag-adj%7Cmtype-standard%7Csz-160x600%7Ctile-1%7Cdemo-D;[1]m

!-->[Hidden] C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\NXCJHEND\252F%25252Fg4tv.com%25252Fthefeed%25252Fblog%25252Fpost%25252F708153%25252FRon-Gilbert-and-Tim-Schafer-Indiecade-Interview---Developer-Dynamic-Duo[1].html1]

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\acshort.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\algo.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\ArPot.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswAR.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswBoot.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswCleanerDLL.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswCmnBS.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswCmnIS.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswCmnOS.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswEngin.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswRawFS.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\aswScan.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\certs.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_el.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_java.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_java.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_js.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_js.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_mx4.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_mx4.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_mx95.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_mx95.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_o7.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_o7.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_ob.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_pe2.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_swf.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_swf.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_tx.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_u.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_w6.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_w6.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_wh.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\db_xtn.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\def.ini

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\dllcc.dat

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\exts.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\fwAux.dll

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\list_d.txt

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\list_i.txt

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\lshe3.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\l_idx.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\l_nmp.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\Sf.bin

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\sl_idx.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\sl_nmp.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\s_idx.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\s_nmp.map

!-->[Hidden] C:\Program Files\Alwil Software\Avast5\defs\10102601\whitelist.db

!-->[Hidden] C:\Program Files\mSPA\temp\000052550006.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\000052550008.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000A.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000C.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000E.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000G.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000I.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000K.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000M.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000O.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000Q.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000S.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000U.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000W.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255000Y.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\000052550010.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\000052550012.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\000052550014.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\000052550018.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255001A.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255001G.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255001I.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255001K.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255001M.TMP

!-->[Hidden] C:\Program Files\mSPA\temp\00005255001P.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255001W.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\000052550026.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002A.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002C.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002D.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002E.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002F.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002G.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002H.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002I.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255002K.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\00005255008F.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\0000525500A2.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\0000525500AW.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\0000525500AX.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\0000525500C3.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\0000525500CE.CDX

!-->[Hidden] C:\Program Files\mSPA\temp\0000525500DY.CDX

==============================================

>Hooks

==============================================

ntkrnlpa.exe+0x0006AA8A, Type: Inline - RelativeJump 0x80541A8A-->80541A91 [ntkrnlpa.exe]

ntkrnlpa.exe-->NtCreateProcessEx, Type: Inline - RelativeJump 0x805C73EA-->B5697BB2 [aswSP.SYS]

ntkrnlpa.exe-->NtCreateSection, Type: Inline - RelativeJump 0x805A075C-->B56979D6 [aswSP.SYS]

ntkrnlpa.exe-->NtLoadDriver, Type: Inline - RelativeJump 0x805795FA-->B5697B10 [aswSP.SYS]

ntkrnlpa.exe-->ObInsertObject, Type: Inline - RelativeJump 0x805B8B58-->B5694FFA [aswSP.SYS]

ntkrnlpa.exe-->ObMakeTemporaryObject, Type: Inline - RelativeJump 0x805B1CE0-->B56935D4 [aswSP.SYS]

[1272]iexplore.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]

[1272]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77DD1214-->00000000 [aclayers.dll]

[1272]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77DD105C-->00000000 [aclayers.dll]

[1272]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77DD11E0-->00000000 [aclayers.dll]

[1272]iexplore.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]

[1272]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [aclayers.dll]

[1272]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [aclayers.dll]

[1272]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110B8-->00000000 [aclayers.dll]

[1272]iexplore.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0040106C-->00000000 [shimeng.dll]

[1272]iexplore.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x00401098-->00000000 [aclayers.dll]

[1272]iexplore.exe-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x004010E8-->00000000 [aclayers.dll]

[1272]iexplore.exe-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x004010C0-->00000000 [aclayers.dll]

[1272]iexplore.exe-->mswsock.dll+0x00004057, Type: Inline - RelativeJump 0x71A54057-->00000000 [unknown_code_page]

[1272]iexplore.exe-->mswsock.dll+0x0000433A, Type: Inline - RelativeJump 0x71A5433A-->00000000 [unknown_code_page]

[1272]iexplore.exe-->mswsock.dll+0x00005847, Type: Inline - RelativeJump 0x71A55847-->00000000 [unknown_code_page]

[1272]iexplore.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C-->00000000 [unknown_code_page]

[1272]iexplore.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7C90D6EE-->00000000 [unknown_code_page]

[1272]iexplore.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x7C90DFAE-->00000000 [unknown_code_page]

[1272]iexplore.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]

[1272]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13E8-->00000000 [aclayers.dll]

[1272]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C163C-->00000000 [aclayers.dll]

[1272]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C161C-->00000000 [aclayers.dll]

[1272]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C15A0-->00000000 [aclayers.dll]

[1272]iexplore.exe-->user32.dll-->CallNextHookEx, Type: Inline - RelativeJump 0x7E42B3C6-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]

[1272]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7E4112F4-->00000000 [aclayers.dll]

[1272]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7E411208-->00000000 [aclayers.dll]

[1272]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7E411340-->00000000 [aclayers.dll]

[1272]iexplore.exe-->user32.dll-->MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->MessageBoxExW, Type: Inline - RelativeJump 0x7E450838-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00000000 [ieframe.dll]

[1272]iexplore.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00000000 [ieframe.dll]

[1344]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]

[1344]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]

[1344]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]

[1344]explorer.exe-->mswsock.dll+0x00004057, Type: Inline - RelativeJump 0x71A54057-->00000000 [unknown_code_page]

[1344]explorer.exe-->mswsock.dll+0x0000433A, Type: Inline - RelativeJump 0x71A5433A-->00000000 [unknown_code_page]

[1344]explorer.exe-->mswsock.dll+0x00005847, Type: Inline - RelativeJump 0x71A55847-->00000000 [unknown_code_page]

[1344]explorer.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C-->00000000 [unknown_code_page]

[1344]explorer.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7C90D6EE-->00000000 [unknown_code_page]

[1344]explorer.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x7C90DFAE-->00000000 [unknown_code_page]

[1344]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]

[1344]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]

[1420]iexplore.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]

[1420]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77DD1214-->00000000 [aclayers.dll]

[1420]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77DD105C-->00000000 [aclayers.dll]

[1420]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77DD11E0-->00000000 [aclayers.dll]

[1420]iexplore.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]

[1420]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [aclayers.dll]

[1420]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [aclayers.dll]

[1420]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110B8-->00000000 [aclayers.dll]

[1420]iexplore.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0040106C-->00000000 [shimeng.dll]

[1420]iexplore.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x00401098-->00000000 [aclayers.dll]

[1420]iexplore.exe-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x004010E8-->00000000 [aclayers.dll]

[1420]iexplore.exe-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x004010C0-->00000000 [aclayers.dll]

[1420]iexplore.exe-->mswsock.dll+0x00004057, Type: Inline - RelativeJump 0x71A54057-->00000000 [unknown_code_page]

[1420]iexplore.exe-->mswsock.dll+0x0000433A, Type: Inline - RelativeJump 0x71A5433A-->00000000 [unknown_code_page]

[1420]iexplore.exe-->mswsock.dll+0x00005847, Type: Inline - RelativeJump 0x71A55847-->00000000 [unknown_code_page]

[1420]iexplore.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C-->00000000 [unknown_code_page]

[1420]iexplore.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7C90D6EE-->00000000 [unknown_code_page]

[1420]iexplore.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x7C90DFAE-->00000000 [unknown_code_page]

[1420]iexplore.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]

[1420]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13E8-->00000000 [aclayers.dll]

[1420]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C163C-->00000000 [aclayers.dll]

[1420]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C161C-->00000000 [aclayers.dll]

[1420]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C15A0-->00000000 [aclayers.dll]

[1420]iexplore.exe-->user32.dll-->CallNextHookEx, Type: Inline - RelativeJump 0x7E42B3C6-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]

[1420]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7E4112F4-->00000000 [aclayers.dll]

[1420]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7E411208-->00000000 [aclayers.dll]

[1420]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7E411340-->00000000 [aclayers.dll]

[1420]iexplore.exe-->user32.dll-->MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->MessageBoxExW, Type: Inline - RelativeJump 0x7E450838-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00000000 [ieframe.dll]

[1420]iexplore.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00000000 [ieframe.dll]

[1552]AvastSvc.exe-->kernel32.dll-->SetUnhandledExceptionFilter, Type: Inline - PushRet 0x7C84495D-->00000000 [unknown_code_page]

[2248]svchost.exe-->mswsock.dll+0x00004057, Type: Inline - RelativeJump 0x71A54057-->00000000 [unknown_code_page]

[2248]svchost.exe-->mswsock.dll+0x0000433A, Type: Inline - RelativeJump 0x71A5433A-->00000000 [unknown_code_page]

[2248]svchost.exe-->mswsock.dll+0x00005847, Type: Inline - RelativeJump 0x71A55847-->00000000 [unknown_code_page]

[2248]svchost.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C-->00000000 [unknown_code_page]

[2248]svchost.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7C90D6EE-->00000000 [unknown_code_page]

[2248]svchost.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x7C90DFAE-->00000000 [unknown_code_page]

[2248]svchost.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x7E42974E-->00000000 [unknown_code_page]

[332]ebhost.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [ebhost.exe]

[3424]iexplore.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]

[3424]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77DD1214-->00000000 [aclayers.dll]

[3424]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77DD105C-->00000000 [aclayers.dll]

[3424]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77DD11E0-->00000000 [aclayers.dll]

[3424]iexplore.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]

[3424]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [aclayers.dll]

[3424]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [aclayers.dll]

[3424]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110B8-->00000000 [aclayers.dll]

[3424]iexplore.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0040106C-->00000000 [shimeng.dll]

[3424]iexplore.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x00401098-->00000000 [aclayers.dll]

[3424]iexplore.exe-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x004010E8-->00000000 [aclayers.dll]

[3424]iexplore.exe-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x004010C0-->00000000 [aclayers.dll]

[3424]iexplore.exe-->mswsock.dll+0x00004057, Type: Inline - RelativeJump 0x71A54057-->00000000 [unknown_code_page]

[3424]iexplore.exe-->mswsock.dll+0x0000433A, Type: Inline - RelativeJump 0x71A5433A-->00000000 [unknown_code_page]

[3424]iexplore.exe-->mswsock.dll+0x00005847, Type: Inline - RelativeJump 0x71A55847-->00000000 [unknown_code_page]

[3424]iexplore.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E47C-->00000000 [unknown_code_page]

[3424]iexplore.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7C90D6EE-->00000000 [unknown_code_page]

[3424]iexplore.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x7C90DFAE-->00000000 [unknown_code_page]

[3424]iexplore.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]

[3424]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13E8-->00000000 [aclayers.dll]

[3424]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C163C-->00000000 [aclayers.dll]

[3424]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C161C-->00000000 [aclayers.dll]

[3424]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C15A0-->00000000 [aclayers.dll]

[3424]iexplore.exe-->user32.dll-->CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]

[3424]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7E4112F4-->00000000 [aclayers.dll]

[3424]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7E411208-->00000000 [aclayers.dll]

[3424]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7E411340-->00000000 [aclayers.dll]

[3424]iexplore.exe-->user32.dll-->MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->MessageBoxExW, Type: Inline - RelativeJump 0x7E450838-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082-->00000000 [ieframe.dll]

[3424]iexplore.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5-->00000000 [ieframe.dll]

[728]services.exe-->advapi32.dll-->CreateProcessAsUserW, Type: IAT modification 0x01001094-->00000000 [unknown_code_page]

[728]services.exe-->kernel32.dll-->CreateProcessW, Type: IAT modification 0x01001114-->00000000 [unknown_code_page]

Link to post
Share on other sites

Extras.txt

OTL Extras logfile created on: 10/26/2010 12:49:41 PM - Run 1

OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\administrator.BRAC\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 32.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 69.00% Paging File free

Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 37.27 Gb Total Space | 20.22 Gb Free Space | 54.26% Space Free | Partition Type: NTFS

Drive M: | 218.05 Gb Total Space | 213.31 Gb Free Space | 97.83% Space Free | Partition Type: NTFS

Drive P: | 218.05 Gb Total Space | 213.31 Gb Free Space | 97.83% Space Free | Partition Type: NTFS

Computer Name: LYNPC2 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\WINDOWS\TEMP\kthj.tmp\setup.exe" = C:\WINDOWS\TEMP\kthj.tmp\setup.exe:*:Enabled:setup -- File not found

"\??\C:\WINDOWS\system32\winlogon.exe" = \??\C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{058B32E2-6310-4359-B2D4-1988390C3B83}" = Broadcom Management Programs

"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel

"{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}" = Scan

"{14BEB6DF-A499-4A38-8E06-E173BCD5C087}" = ScannerCopy

"{17293791-C82E-476C-9997-9A0FF234A19B}" = HP Product Assistant

"{181821B7-82AA-44DA-9DAF-EF254CCB670A}" = Fax

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{1AD5F465-8282-4DAD-B957-E09C0B783D18}" = InstantShare

"{1B680FBA-E317-4E93-AF43-3B59798A4BE0}" = Copy

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20FBC0A0-3160-4F14-83ED-3A74BB6B8C31}" = TrayApp

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{272EC8BA-5A08-4ea1-A189-684466A06B02}" = cp_dwShrek2Albums1

"{2E8428AD-6CD2-4031-916A-3CF9BBF2DEC9}" = Unload

"{342C7C88-D335-4bc2-8CF1-281857629CE2}" = HP PSC & OfficeJet 4.7

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3762DB2D-71BD-421F-9E55-C74DA7DF4D07}" = CueTour

"{391E18CE-7D3B-45E9-A8F0-34E77F14F47A}" = ProductContext

"{442BE28B-782B-4DC0-B490-E70A403B1C69}" = Readme

"{471F7EDB-6C75-4195-B65D-800DCE4A9E1D}" = WDtransitionInstall_GD

"{49C08D37-71A2-442B-B439-662F276498E3}" = 2600

"{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics

"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade

"{5E8D588F-307C-4250-B622-26969027319A}" = PanoStandAlone

"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0

"{644D04A2-C682-4FD5-977D-03B804C4B9C5}" = CreativeProjects

"{646A65DD-23FC-418E-B9F0-E0500FB42CB1}" = PhotoGallery

"{655CB07D-C944-40BE-B93F-55957CAC7625}" = AiO_Scan

"{68963635-14A4-48D9-B431-DF3A74D1AAE1}" = Destinations

"{6F146A80-8B4D-4248-B9F3-A182D988231C}" = 2600Trb

"{700A6597-3CE6-49C1-AA75-846B24CDA66D}" = BufferChm

"{724517BD-1DE1-4986-BFCA-C1DFD379E3BC}" = cp_dwShrek2Cards1

"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update

"{7962FC39-62AF-4FFC-8F6A-7A01341C9659}" = LogMeIn

"{7AD25C9F-9957-4D1C-95EF-9BCD09F6D31B}" = HPSystemDiagnostics

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{84CDF5A8-1D57-4B69-BAB6-1F11D8923375}" = SkinsHP1

"{85CFD253-38AE-4DB1-ACB7-F0F4C791990D}" = AiOSoftware

"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder

"{87D946F1-3B51-401B-9AF1-BDB5CD84261A}" = PCCharge Payment Server

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8BC3B99B-A6BE-4A0B-8535-B1B94BA4B1B1}" = DocProc

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{967FEC46-7050-4416-853F-5F135A1F3538}" = Brilliant Distinctions® Consumer Loyalty Program Desktop Shortcut

"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 3.4

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A5B9D22C-755A-4AC6-9904-875E80838BB6}" = CP_AtenaShokunin1Config

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support

"{AAC4426A-42CD-4B4E-8057-9738C96F2C8F}" = HP Safety and Comfort Guide

"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0

"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0

"{B66B4E83-4DB8-4721-8C80-E0AFCE13B3A9}" = mSPA

Link to post
Share on other sites

I'm so sorry to do this to you, but I keep getting the error message every time I copy and paste the text from "OTL.exe" into this thread. I'm going to attach the file and see if it can get to you that way -- I know you'd rather have it cut and pasted, but for whatever reason, I'm unable to do that. I figure that this way, at least you'll get the information you need.

OTL.Txt

Link to post
Share on other sites

One or more of the identified infections is a backdoor trojan or rootkit.

This type of infection has the capabilities to allows hacker to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identity Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

If you still want to clean it please do the following

===================

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

========

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites

Oh, no -- I can't believe things are that bad! I've talked with a few friends who are computer savvy, and they have suggested that we try to go ahead with the cleaning. Obviously, if we have any problems after that, we will proceed with a full reformat/reinstall. I appreciate your working with us to (hopefully) prevent that.

I do have some questions. Do you have any way of guessing where these infections came from? Specifically, is there any way that one or more could have come from regular use of a facebook gaming app? If so, that activity can certainly be stopped. I know you probably can't tell exactly what happened here, but I was just wondering if you could give me some ideas.

The logs are pasted here:

TDSSKiller:

2010/10/27 08:57:04.0187 TDSS rootkit removing tool 2.4.5.1 Oct 26 2010 11:28:49

2010/10/27 08:57:04.0187 ================================================================================

2010/10/27 08:57:04.0187 SystemInfo:

2010/10/27 08:57:04.0187

2010/10/27 08:57:04.0187 OS Version: 5.1.2600 ServicePack: 3.0

2010/10/27 08:57:04.0187 Product type: Workstation

2010/10/27 08:57:04.0187 ComputerName: LYNPC2

2010/10/27 08:57:04.0187 UserName: Administrator

2010/10/27 08:57:04.0187 Windows directory: C:\WINDOWS

2010/10/27 08:57:04.0187 System windows directory: C:\WINDOWS

2010/10/27 08:57:04.0187 Processor architecture: Intel x86

2010/10/27 08:57:04.0187 Number of processors: 1

2010/10/27 08:57:04.0187 Page size: 0x1000

2010/10/27 08:57:04.0187 Boot type: Normal boot

2010/10/27 08:57:04.0187 ================================================================================

2010/10/27 08:57:04.0546 Initialize success

2010/10/27 08:57:22.0515 ================================================================================

2010/10/27 08:57:22.0515 Scan started

2010/10/27 08:57:22.0515 Mode: Manual;

2010/10/27 08:57:22.0515 ================================================================================

2010/10/27 08:57:23.0203 Aavmker4 (8d488938e2f7048906f1fbd3af394887) C:\WINDOWS\system32\drivers\Aavmker4.sys

2010/10/27 08:57:23.0765 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys

2010/10/27 08:57:27.0375 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2010/10/27 08:57:27.0812 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2010/10/27 08:57:28.0171 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys

2010/10/27 08:57:28.0578 adpu320 (0ea9b1f0c6c90a509c8603775366adb7) C:\WINDOWS\system32\DRIVERS\adpu320.sys

2010/10/27 08:57:28.0625 adpu320 - detected Unsigned file (1)

2010/10/27 08:57:28.0812 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2010/10/27 08:57:29.0203 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

2010/10/27 08:57:29.0578 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys

2010/10/27 08:57:30.0062 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys

2010/10/27 08:57:30.0546 ALCXWDM (292ce6f164008e825d71c07fd0265943) C:\WINDOWS\system32\drivers\ALCXWDM.SYS

2010/10/27 08:57:31.0218 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys

2010/10/27 08:57:31.0859 aswFsBlk (a0d86b8ac93ef95620420c7a24ac5344) C:\WINDOWS\system32\drivers\aswFsBlk.sys

2010/10/27 08:57:32.0093 aswMon2 (7d880c76a285a41284d862e2d798ec0d) C:\WINDOWS\system32\drivers\aswMon2.sys

2010/10/27 08:57:32.0312 aswRdr (69823954bbd461a73d69774928c9737e) C:\WINDOWS\system32\drivers\aswRdr.sys

2010/10/27 08:57:32.0515 aswSP (7ecc2776638b04553f9a85bd684c3abf) C:\WINDOWS\system32\drivers\aswSP.sys

2010/10/27 08:57:32.0750 aswTdi (095ed820a926aa8189180b305e1bcfc9) C:\WINDOWS\system32\drivers\aswTdi.sys

2010/10/27 08:57:33.0000 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2010/10/27 08:57:33.0390 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2010/10/27 08:57:33.0859 ati2mtag (205a9e5c6d3b60659f0dc40542a8b29f) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2010/10/27 08:57:34.0218 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2010/10/27 08:57:34.0671 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2010/10/27 08:57:35.0078 b57w2k (241474d01380e9ed41d4c07f4f5fd401) C:\WINDOWS\system32\DRIVERS\b57xp32.sys

2010/10/27 08:57:35.0296 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2010/10/27 08:57:35.0687 Blfp (7f72473390feee312a66af045c8ef0f6) C:\WINDOWS\system32\DRIVERS\baspxp32.sys

2010/10/27 08:57:35.0984 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2010/10/27 08:57:36.0546 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2010/10/27 08:57:36.0921 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2010/10/27 08:57:37.0265 Cdrom (9aafbb44400d4ff283761839242f6865) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2010/10/27 08:57:37.0265 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\cdrom.sys. Real md5: 9aafbb44400d4ff283761839242f6865, Fake md5: 1f4260cc5b42272d71f79e570a27a4fe

2010/10/27 08:57:37.0281 Cdrom - detected Rootkit.Win32.TDSS.tdl3 (0)

2010/10/27 08:57:38.0015 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2010/10/27 08:57:38.0453 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2010/10/27 08:57:38.0828 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2010/10/27 08:57:39.0187 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2010/10/27 08:57:39.0578 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2010/10/27 08:57:39.0953 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys

2010/10/27 08:57:40.0312 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2010/10/27 08:57:40.0671 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys

2010/10/27 08:57:41.0062 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2010/10/27 08:57:41.0406 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

2010/10/27 08:57:41.0765 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2010/10/27 08:57:42.0093 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

2010/10/27 08:57:42.0437 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2010/10/27 08:57:42.0812 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2010/10/27 08:57:43.0296 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2010/10/27 08:57:43.0656 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2010/10/27 08:57:44.0000 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2010/10/27 08:57:44.0421 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2010/10/27 08:57:44.0875 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2010/10/27 08:57:45.0312 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys

2010/10/27 08:57:45.0687 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys

2010/10/27 08:57:46.0109 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys

2010/10/27 08:57:46.0468 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys

2010/10/27 08:57:46.0812 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys

2010/10/27 08:57:47.0234 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys

2010/10/27 08:57:47.0546 iAimFP5 (0308aef61941e4af478fa1a0f83812f5) C:\WINDOWS\system32\DRIVERS\wADV07nt.sys

2010/10/27 08:57:47.0968 iAimFP6 (714038a8aa5de08e12062202cd7eaeb5) C:\WINDOWS\system32\DRIVERS\wADV08nt.sys

2010/10/27 08:57:48.0296 iAimFP7 (7bb3aa595e4507a788de1cdc63f4c8c4) C:\WINDOWS\system32\DRIVERS\wADV09nt.sys

2010/10/27 08:57:48.0687 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys

2010/10/27 08:57:49.0015 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys

2010/10/27 08:57:49.0453 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys

2010/10/27 08:57:49.0796 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys

2010/10/27 08:57:50.0203 iAimTV5 (791cc45de6e50445be72e8ad6401ff45) C:\WINDOWS\system32\DRIVERS\wATV10nt.sys

2010/10/27 08:57:50.0546 iAimTV6 (352fa0e98bc461ce1ce5d41f64db558d) C:\WINDOWS\system32\DRIVERS\wATV06nt.sys

2010/10/27 08:57:50.0984 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2010/10/27 08:57:51.0406 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

2010/10/27 08:57:51.0750 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2010/10/27 08:57:52.0093 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2010/10/27 08:57:52.0453 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2010/10/27 08:57:52.0781 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2010/10/27 08:57:53.0109 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2010/10/27 08:57:53.0453 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2010/10/27 08:57:53.0812 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2010/10/27 08:57:54.0140 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2010/10/27 08:57:54.0468 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2010/10/27 08:57:54.0812 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2010/10/27 08:57:55.0171 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2010/10/27 08:57:55.0421 Lavasoft Kernexplorer (32da3fde01f1bb080c2e69521dd8881e) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys

2010/10/27 08:57:55.0640 Lbd (b7c19ec8b0dd7efa58ad41ffeb8b8cda) C:\WINDOWS\system32\DRIVERS\Lbd.sys

2010/10/27 08:57:56.0031 LMIInfo (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys

2010/10/27 08:57:56.0281 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys

2010/10/27 08:57:56.0609 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys

2010/10/27 08:57:56.0859 MagEpNt (cbc4148ee2c27803fa68a259426a19cd) C:\WINDOWS\system32\drivers\MagEpNt.sys

2010/10/27 08:57:56.0890 MagEpNt - detected Unsigned file (1)

2010/10/27 08:57:57.0093 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2010/10/27 08:57:57.0562 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2010/10/27 08:57:57.0875 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2010/10/27 08:57:58.0312 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2010/10/27 08:57:58.0656 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2010/10/27 08:57:59.0109 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2010/10/27 08:57:59.0500 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2010/10/27 08:57:59.0796 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2010/10/27 08:58:00.0187 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2010/10/27 08:58:00.0531 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2010/10/27 08:58:00.0859 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2010/10/27 08:58:01.0203 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2010/10/27 08:58:01.0546 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2010/10/27 08:58:01.0890 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2010/10/27 08:58:02.0250 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2010/10/27 08:58:02.0609 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2010/10/27 08:58:02.0953 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2010/10/27 08:58:03.0296 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2010/10/27 08:58:03.0625 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2010/10/27 08:58:04.0062 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2010/10/27 08:58:04.0484 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2010/10/27 08:58:04.0843 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2010/10/27 08:58:05.0234 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2010/10/27 08:58:05.0593 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2010/10/27 08:58:05.0968 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2010/10/27 08:58:06.0343 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys

2010/10/27 08:58:06.0687 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2010/10/27 08:58:07.0015 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2010/10/27 08:58:07.0437 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2010/10/27 08:58:07.0828 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2010/10/27 08:58:08.0265 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

2010/10/27 08:58:08.0640 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2010/10/27 08:58:09.0515 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2010/10/27 08:58:09.0921 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

2010/10/27 08:58:10.0265 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2010/10/27 08:58:10.0656 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2010/10/27 08:58:11.0031 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2010/10/27 08:58:11.0671 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2010/10/27 08:58:12.0125 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2010/10/27 08:58:12.0453 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2010/10/27 08:58:12.0781 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2010/10/27 08:58:13.0156 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2010/10/27 08:58:13.0531 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2010/10/27 08:58:13.0968 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2010/10/27 08:58:14.0312 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2010/10/27 08:58:14.0671 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2010/10/27 08:58:15.0078 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2010/10/27 08:58:15.0421 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2010/10/27 08:58:15.0781 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2010/10/27 08:58:16.0140 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2010/10/27 08:58:16.0656 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2010/10/27 08:58:17.0062 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2010/10/27 08:58:17.0515 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys

2010/10/27 08:58:17.0828 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys

2010/10/27 08:58:18.0281 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2010/10/27 08:58:18.0625 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2010/10/27 08:58:19.0000 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys

2010/10/27 08:58:19.0359 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys

2010/10/27 08:58:19.0750 Symmpi (f2b7e8416f508368ac6730e2ae1c614f) C:\WINDOWS\system32\DRIVERS\symmpi.sys

2010/10/27 08:58:19.0781 Symmpi - detected Unsigned file (1)

2010/10/27 08:58:20.0015 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys

2010/10/27 08:58:20.0390 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys

2010/10/27 08:58:20.0859 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2010/10/27 08:58:21.0250 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2010/10/27 08:58:21.0593 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2010/10/27 08:58:22.0031 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2010/10/27 08:58:22.0359 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2010/10/27 08:58:22.0812 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2010/10/27 08:58:23.0281 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2010/10/27 08:58:23.0671 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2010/10/27 08:58:24.0062 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

2010/10/27 08:58:24.0515 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2010/10/27 08:58:24.0875 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2010/10/27 08:58:25.0375 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2010/10/27 08:58:25.0750 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2010/10/27 08:58:26.0187 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys

2010/10/27 08:58:26.0531 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2010/10/27 08:58:26.0968 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2010/10/27 08:58:27.0437 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2010/10/27 08:58:27.0937 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2010/10/27 08:58:28.0171 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2010/10/27 08:58:28.0812 ================================================================================

2010/10/27 08:58:28.0812 Scan finished

2010/10/27 08:58:28.0812 ================================================================================

2010/10/27 08:58:28.0953 Detected object count: 4

2010/10/27 08:59:03.0500 Unsigned file(adpu320) - User select action: Skip

2010/10/27 08:59:03.0671 Cdrom (9aafbb44400d4ff283761839242f6865) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2010/10/27 08:59:03.0671 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\cdrom.sys. Real md5: 9aafbb44400d4ff283761839242f6865, Fake md5: 1f4260cc5b42272d71f79e570a27a4fe

2010/10/27 08:59:03.0921 Backup copy found, using it..

2010/10/27 08:59:03.0937 C:\WINDOWS\system32\DRIVERS\cdrom.sys - will be cured after reboot

2010/10/27 08:59:03.0937 Rootkit.Win32.TDSS.tdl3(Cdrom) - User select action: Cure

2010/10/27 08:59:03.0937 Unsigned file(MagEpNt) - User select action: Skip

2010/10/27 08:59:03.0953 Unsigned file(Symmpi) - User select action: Skip

2010/10/27 08:59:12.0484 Deinitialize success

ComboFix:

ComboFix 10-10-26.03 - Administrator 10/27/2010 9:17.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1214.625 [GMT -4:00]

Running from: c:\documents and settings\administrator.BRAC\Desktop\ComboFix.exe

AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\administrator.BRAC\Application Data\Bitrix Security

c:\documents and settings\administrator.BRAC\Application Data\Bitrix Security\xaukvmm60_shrd

c:\documents and settings\administrator.BRAC\Application Data\PriceGong

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\1.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\a.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\b.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\c.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\d.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\e.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\f.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\g.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\h.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\i.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\J.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\k.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\l.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\m.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\n.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\o.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\p.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\q.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\r.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\s.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\t.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\u.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\v.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\w.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\x.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\y.xml

c:\documents and settings\administrator.BRAC\Application Data\PriceGong\Data\z.xml

c:\documents and settings\administrator.BRAC\Local Settings\Temporary Internet Files\temp.dmf

c:\documents and settings\Jenweb\Local Settings\Temporary Internet Files\temp.dmf

c:\documents and settings\Marpil\Application Data\Bitrix Security

c:\documents and settings\Marpil\Application Data\Bitrix Security\fnrd

c:\documents and settings\Marpil\Application Data\Bitrix Security\jje.txt

c:\documents and settings\Marpil\Application Data\Bitrix Security\ljgh.txt

c:\documents and settings\Marpil\Application Data\Bitrix Security\lop.txt

c:\documents and settings\Marpil\Application Data\Bitrix Security\mxd1.txt

c:\documents and settings\Marpil\Application Data\Bitrix Security\plk.txt

c:\documents and settings\Marpil\Application Data\Bitrix Security\qnf.txt

c:\documents and settings\Marpil\Application Data\Bitrix Security\xaukvmm60_shrd

c:\documents and settings\Marpil\Application Data\InstallProxy.exe

c:\documents and settings\Marpil\Application Data\PriceGong

c:\documents and settings\Marpil\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Marpil\Application Data\PriceGong\Data\z.xml

c:\documents and settings\Marpil\Local Settings\Temporary Internet Files\temp.dmf

c:\windows\Downloaded Program Files\f3initialsetup1.0.0.15-3.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Service_6to4

((((((((((((((((((((((((( Files Created from 2010-09-27 to 2010-10-27 )))))))))))))))))))))))))))))))

.

2010-10-15 13:56 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-10-15 13:56 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-10-15 13:56 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-10-15 13:56 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-10-15 13:56 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2010-10-15 13:56 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys

2010-10-15 13:56 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2010-10-15 13:56 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr

2010-10-15 13:56 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe

2010-10-15 13:56 . 2010-10-15 13:56 -------- d-----w- c:\program files\Alwil Software

2010-10-15 13:56 . 2010-10-15 13:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

2010-10-15 13:55 . 2010-10-15 13:55 -------- d-----w- c:\documents and settings\Marpil\Application Data\Sammsoft

2010-10-15 13:54 . 2010-10-15 13:54 -------- d-----w- c:\program files\Advanced Registry Optimizer

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-27 12:59 . 2004-08-04 08:00 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys

2010-09-23 20:45 . 2010-09-22 18:23 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2010-09-23 20:44 . 2010-09-22 18:23 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll

2010-09-23 20:44 . 2010-09-22 18:23 29568 ----a-w- c:\windows\system32\LMIport.dll

2010-09-23 20:44 . 2010-09-22 18:23 87424 ----a-w- c:\windows\system32\LMIinit.dll

2010-09-16 22:49 . 2010-09-22 18:23 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak

2010-09-16 22:49 . 2010-09-22 18:23 87424 ----a-w- c:\windows\system32\LMIinit.dll.000.bak

2010-09-15 08:50 . 2010-05-05 15:47 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-08-02 18:42 . 2010-08-02 18:42 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2006-03-12 23:18 . 2006-03-12 23:18 60518 ----a-w- c:\program files\mozilla firefox\components\jar50.dll

2006-03-12 23:18 . 2006-03-12 23:18 49248 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll

2006-03-12 23:18 . 2006-03-12 23:18 165992 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]

2010-06-13 23:10 2734688 ----a-w- c:\program files\Zynga\tbZyn0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files\Zynga\tbZyn0.dll" [2010-06-13 2734688]

[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-22 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]

"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-09 339968]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2010-05-31 63048]

"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

PCCharge Payment Server.lnk - c:\program files\Active-Charge\Active-Charge.Exe [2010-3-2 17047552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]

HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2010-09-23 20:44 87424 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/2/2010 2:42 PM 64288]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10/15/2010 9:56 AM 165584]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10/15/2010 9:56 AM 17744]

R2 eBLVD;eBLVD;c:\program files\eBLVD\ebhost.exe [3/2/2010 10:41 AM 462296]

R2 File Backup;File Backup Service;c:\program files\Starfield\offSyncService.exe [7/16/2010 1:47 PM 1310960]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 4:55 AM 1357464]

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [9/16/2010 6:49 PM 374152]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [5/31/2010 11:31 AM 12856]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/12/2010 3:03 PM 15008]

S3 MagEpNt;MagEpNt;c:\windows\system32\drivers\magepnt.sys [3/2/2010 11:04 AM 26304]

S3 PCAlertDriver;PCAlertDriver;\??\c:\biostools\NTGLM7X.sys --> c:\biostools\NTGLM7X.sys [?]

S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/19/2010 12:21 PM 135664]

.

Contents of the 'Scheduled Tasks' folder

2010-10-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 13:29]

2010-08-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-19 16:21]

2010-08-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-19 16:21]

.

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyServer = http=127.0.0.1:5577

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB

FF - ProfilePath - c:\documents and settings\administrator.BRAC\Application Data\Mozilla\Firefox\Profiles\xce9b6u5.default\

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");

.

- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{3EE8D0BE-F450-4EF2-97B9-AC2222D14DB3} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

Notify-egypack - egypack.dll

SafeBoot-klmdb.sys

ActiveSetup-{8CD620CB-E463-446F-A79C-F2DA6C90C382} - c:\documents and settings\Marpil\Application Data\Bitrix Security\xaukvmm60.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-10-27 09:35

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2009175955-1873913950-2423451055-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b6,a4,82,91,fd,1f,fa,4a,b5,f4,8c,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b6,a4,82,91,fd,1f,fa,4a,b5,f4,8c,\

[HKEY_USERS\S-1-5-21-2009175955-1873913950-2423451055-500\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@DACL=(02 0011)

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10j_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

@DACL=(02 0011)

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@DACL=(02 0011)

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10j_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@DACL=(02 0011)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@DACL=(02 0011)

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@DACL=(02 0011)

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@DACL=(02 0011)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\LMIinit.dll

c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(2180)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\program files\LogMeIn\x86\RaMaint.exe

c:\program files\LogMeIn\x86\LogMeIn.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\HPZipm12.exe

c:\program files\Windows Media Player\WMPNetwk.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\PDF Complete\pdfsaver.exe

c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

.

**************************************************************************

.

Completion time: 2010-10-27 09:42:10 - machine was rebooted

ComboFix-quarantined-files.txt 2010-10-27 13:42

Pre-Run: 21,550,530,560 bytes free

Post-Run: 23,219,888,128 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - B86F87F384ADBE685551CB97F7D51EAB

Link to post
Share on other sites

Typically this is installed via drive-by-download.

Meaning you only have to visit a site to get infected even with protection.

Update Run Malwarebytes

Please update\run Malwarebytes' Anti-Malware.

Double Click the Malwarebytes Anti-Malware icon to run the application.

  • Click on the update tab then click on Check for updates.
  • If an update is found, it will download and install the latest version.
  • Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

=====

* Go here to run an online scannner from ESET.

  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Check next options: Remove found threats and Scan unwanted applications.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic

Link to post
Share on other sites

Hi again!

Here are the results. Again, I really appreciate all of your help -- just like my friend said, you guys are great!

Malwarebytes log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4967

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

10/27/2010 3:08:27 PM

mbam-log-2010-10-27 (15-08-27).txt

Scan type: Quick scan

Objects scanned: 229535

Time elapsed: 11 minute(s), 38 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{8cd620cb-e463-446f-a79c-f2da6c90c382} (Password.Stealer) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

ESET:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=bbd4632e83a05b49a6532ce0213eca24

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-09-21 06:08:35

# local_time=2010-09-21 02:08:35 (-0500, Eastern Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1024 16777215 100 0 6251546 6251546 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=125405

# found=5

# cleaned=5

# scan_time=14961

C:\Documents and Settings\Marpil\Application Data\Sun\Java\Deployment\cache\6.0\56\358527f8-55a2bdfc multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\36\386e6064-441e0e8b a variant of Java/Rowindal.A trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\4\76d90244-62aec6de probably a variant of Java/Rowindal.A trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\47\61d4602f-79b47de0 a variant of Java/Rowindal.A trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\58\6acfc7ba-7acb8460 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=bbd4632e83a05b49a6532ce0213eca24

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=false

# utc_time=2010-10-27 07:51:37

# local_time=2010-10-27 03:51:37 (-0500, Eastern Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=768 16777215 100 0 134080 134080 0 0

# compatibility_mode=8192 67108863 100 0 2207724 2207724 0 0

# scanned=68189

# found=0

# cleaned=0

# scan_time=2442

Link to post
Share on other sites

This scan only produced one log this time (there were two last time) -- is that what should have happened? Results are below. Are we okay now?

OTL.txt:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=bbd4632e83a05b49a6532ce0213eca24

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-09-21 06:08:35

# local_time=2010-09-21 02:08:35 (-0500, Eastern Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1024 16777215 100 0 6251546 6251546 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=125405

# found=5

# cleaned=5

# scan_time=14961

C:\Documents and Settings\Marpil\Application Data\Sun\Java\Deployment\cache\6.0\56\358527f8-55a2bdfc multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\36\386e6064-441e0e8b a variant of Java/Rowindal.A trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\4\76d90244-62aec6de probably a variant of Java/Rowindal.A trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\47\61d4602f-79b47de0 a variant of Java/Rowindal.A trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\58\6acfc7ba-7acb8460 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=bbd4632e83a05b49a6532ce0213eca24

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=false

# utc_time=2010-10-27 07:51:37

# local_time=2010-10-27 03:51:37 (-0500, Eastern Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=768 16777215 100 0 134080 134080 0 0

# compatibility_mode=8192 67108863 100 0 2207724 2207724 0 0

# scanned=68189

# found=0

# cleaned=0

# scan_time=2442

Link to post
Share on other sites

Oops -- sorry! I don't know how that happened. Here it is!

OTL logfile created on: 10/28/2010 8:40:33 AM - Run 2

OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\administrator.BRAC\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 40.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 75.00% Paging File free

Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 37.27 Gb Total Space | 21.71 Gb Free Space | 58.26% Space Free | Partition Type: NTFS

Drive M: | 218.05 Gb Total Space | 213.31 Gb Free Space | 97.83% Space Free | Partition Type: NTFS

Drive P: | 218.05 Gb Total Space | 213.31 Gb Free Space | 97.83% Space Free | Partition Type: NTFS

Computer Name: LYNPC2 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\administrator.BRAC\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)

PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)

PRC - M:\mspa.EXE ()

PRC - M:\mchart.EXE ()

PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)

PRC - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)

PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)

PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

PRC - C:\Program Files\Starfield\offSyncService.exe (Starfield Technologies, Inc.)

PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)

PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)

PRC - C:\Program Files\eBLVD\ebhost.exe (ENC)

PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Active-Charge\Active-Charge.Exe (VeriFone, Inc.)

PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)

PRC - C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)

PRC - C:\Program Files\PDF Complete\pdfsaver.exe (Tracker Software Products)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\administrator.BRAC\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\system32\LMIRfsClientNP.dll (LogMeIn, Inc.)

MOD - C:\WINDOWS\system32\netui1.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\netui0.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\ntlanman.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\netrap.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\drprov.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\davclnt.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found

SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)

SRV - (LMIMaint) -- C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)

SRV - (LMIGuardianSvc) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)

SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV - (File Backup) -- C:\Program Files\Starfield\offSyncService.exe (Starfield Technologies, Inc.)

SRV - (LogMeIn) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)

SRV - (eBLVD) -- C:\Program Files\eBLVD\ebhost.exe (ENC)

SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)

SRV - (SSScsiSV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe (Sony Corporation)

SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)

SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)

SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)

========== Driver Services (SafeList) ==========

DRV - (PCAlertDriver) -- C:\BIOSTOOLS\NTGLM7X.sys File not found

DRV - (catchme) -- C:\ComboFix\catchme.sys File not found

DRV - (LMIRfsClientNP) -- C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)

DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)

DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)

DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)

DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)

DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)

DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)

DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()

DRV - (Lbd) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)

DRV - (LMIInfo) -- C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)

DRV - (LMIRfsDriver) -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)

DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)

DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)

DRV - (Blfp) -- C:\WINDOWS\system32\drivers\baspxp32.sys (Broadcom Corporation)

DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)

DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)

DRV - (iAimFP4) -- C:\WINDOWS\system32\drivers\wVchNTxx.sys (Intel® Corporation)

DRV - (iAimFP3) -- C:\WINDOWS\system32\drivers\wSiINTxx.sys (Intel® Corporation)

DRV - (iAimTV5) -- C:\WINDOWS\system32\drivers\wATV10nt.sys (Intel® Corporation)

DRV - (iAimTV4) -- C:\WINDOWS\system32\drivers\wCh7xxNT.sys (Intel® Corporation)

DRV - (iAimTV6) -- C:\WINDOWS\system32\drivers\wATV06nt.sys (Intel® Corporation)

DRV - (iAimTV3) -- C:\WINDOWS\system32\drivers\wATV04nt.sys (Intel® Corporation)

DRV - (iAimTV1) -- C:\WINDOWS\system32\drivers\wATV02NT.sys (Intel® Corporation)

DRV - (iAimTV0) -- C:\WINDOWS\system32\drivers\wATV01nt.sys (Intel® Corporation)

DRV - (iAimFP7) -- C:\WINDOWS\system32\drivers\wADV09NT.sys (Intel® Corporation)

DRV - (iAimFP5) -- C:\WINDOWS\system32\drivers\wADV07nt.sys (Intel® Corporation)

DRV - (iAimFP6) -- C:\WINDOWS\system32\drivers\wADV08NT.sys (Intel® Corporation)

DRV - (i81x) -- C:\WINDOWS\system32\drivers\i81xnt5.sys (Intel® Corporation)

DRV - (iAimFP0) -- C:\WINDOWS\system32\drivers\wADV01nt.sys (Intel® Corporation)

DRV - (iAimFP1) -- C:\WINDOWS\system32\drivers\wADV02NT.sys (Intel® Corporation)

DRV - (iAimFP2) -- C:\WINDOWS\system32\drivers\wADV05NT.sys (Intel® Corporation)

DRV - (adpu320) -- C:\WINDOWS\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)

DRV - (Symmpi) -- C:\WINDOWS\system32\DRIVERS\symmpi.sys (LSI Logic)

DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)

DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)

DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)

DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)

DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) -- C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)

DRV - (MagEpNt) -- C:\WINDOWS\System32\drivers\magepnt.sys (MagTek)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577

========== FireFox ==========

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/28 11:45:41 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 1.5\Extensions\\Components: C:\Program Files\Mozilla Firefox\Components [2010/10/27 12:58:46 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 1.5\Extensions\\Plugins: C:\Program Files\Mozilla Firefox\Plugins [2010/10/27 12:58:46 | 000,000,000 | ---D | M]

[2006/03/12 19:18:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator.BRAC\Application Data\Mozilla\Firefox\Profiles\xce9b6u5.default\extensions

[2010/10/15 09:49:00 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2006/03/12 19:18:14 | 000,000,000 | ---D | M] (Firefox (default)) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2010/03/03 16:36:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

[2010/05/05 11:47:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010/08/05 11:23:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2006/03/12 19:18:13 | 000,060,518 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll

[2006/03/12 19:18:14 | 000,049,248 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll

[2006/03/12 19:18:13 | 000,165,992 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll

[2010/09/15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2006/03/12 19:18:14 | 000,017,024 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll

[2007/03/22 20:23:30 | 000,017,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL

[2010/09/22 18:10:52 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll

[2010/07/12 12:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

[2006/03/12 19:18:17 | 000,000,680 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.png

[2006/03/12 19:18:17 | 000,000,741 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.src

[2006/03/12 19:18:17 | 000,001,150 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.png

[2006/03/12 19:18:17 | 000,000,539 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.src

[2010/04/19 01:03:46 | 000,001,375 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\avg_igeared.xml

[2006/03/12 19:18:17 | 000,000,356 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.png

[2006/03/12 19:18:17 | 000,001,007 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.src

[2006/03/12 19:18:17 | 000,000,210 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.gif

[2006/03/12 19:18:17 | 000,001,056 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.src

[2006/03/12 19:18:17 | 000,001,076 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.gif

[2006/03/12 19:18:17 | 000,000,718 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.src

[2006/03/12 19:18:17 | 000,000,088 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.gif

[2006/03/12 19:18:17 | 000,001,122 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.src

O1 HOSTS File: ([2010/10/27 09:34:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found

O2 - BHO: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn0.dll (Conduit Ltd.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found

O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)

O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)

O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)

O4 - HKLM..\Run: [synchronization Manager] C:\WINDOWS\System32\mobsync.exe (Microsoft Corporation)

O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)

O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled [2010/08/26 15:25:56 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PCCharge Payment Server.lnk = C:\Program Files\Active-Charge\Active-Charge.Exe (VeriFone, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)

O16 - DPF: {5852F5ED-8BF4-11D4-A245-0080C6F74284} http://javadl-esd.sun.com/update/1.6.0/jin...indows-i586.cab (Reg Error: Key error.)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1140107461640 (WUWebControl Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/instal...nosticsxp2k.cab (DDRevision Class)

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab (MSN Games - Installer)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} http://download.abacast.com/download/files/abasetup161.cab (Reg Error: Key error.)

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)

O16 - DPF: Web-Based Email Tools http://email.secureserver.net/Download.CAB (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.11.11

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = BRAC.local

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)

O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)

O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)

O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O24 - Desktop Components:0 (My Current Home Page) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\HPQ1280h.BMP

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/10/27 13:51:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood

[2010/10/27 13:00:46 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010/10/27 09:13:57 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010/10/27 09:07:13 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010/10/27 09:07:13 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010/10/27 09:07:13 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010/10/27 09:07:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010/10/27 09:07:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/10/27 09:06:48 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/10/27 08:56:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator.BRAC\Desktop\tdsskiller

[2010/10/26 12:48:45 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\administrator.BRAC\Desktop\OTL.exe

[2010/10/15 09:56:47 | 000,165,584 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys

[2010/10/15 09:56:47 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys

[2010/10/15 09:56:45 | 000,023,376 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys

[2010/10/15 09:56:43 | 000,046,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys

[2010/10/15 09:56:41 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys

[2010/10/15 09:56:41 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys

[2010/10/15 09:56:40 | 000,028,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys

[2010/10/15 09:56:24 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr

[2010/10/15 09:56:23 | 000,167,592 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe

[2010/10/15 09:56:14 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software

[2010/10/15 09:56:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software

[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/27 13:00:15 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/10/27 12:50:26 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2010/10/27 12:47:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/10/27 12:41:02 | 000,000,098 | ---- | M] () -- C:\WINDOWS\autosettle.ini

[2010/10/27 09:34:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/10/27 09:14:02 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2010/10/27 09:05:56 | 003,887,256 | R--- | M] () -- C:\Documents and Settings\administrator.BRAC\Desktop\ComboFix.exe

[2010/10/27 08:56:29 | 001,207,026 | ---- | M] () -- C:\Documents and Settings\administrator.BRAC\Desktop\tdsskiller.zip

[2010/10/27 00:40:26 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/10/26 15:42:38 | 000,034,019 | ---- | M] () -- C:\Documents and Settings\administrator.BRAC\Desktop\PHY Product Reaction Form 2010 CRS.pdf

[2010/10/26 12:53:22 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\administrator.BRAC\Desktop\RKUnhookerLE.EXE

[2010/10/26 12:48:45 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\administrator.BRAC\Desktop\OTL.exe

[2010/10/25 22:16:10 | 000,079,872 | ---- | M] () -- C:\WINDOWS\MBR.exe

[2010/10/22 08:56:05 | 000,000,498 | ---- | M] () -- C:\Documents and Settings\administrator.BRAC\Desktop\Web-Based Email Mail Index Inbox.url

[2010/10/21 17:46:25 | 000,000,052 | ---- | M] () -- C:\WINDOWS\BatchManager.ini

[2010/10/21 09:20:32 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk

[2010/10/15 09:56:48 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk

[2010/10/15 09:56:42 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT

[2010/10/14 08:59:53 | 000,218,448 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/27 12:41:02 | 000,000,098 | ---- | C] () -- C:\WINDOWS\autosettle.ini

[2010/10/27 09:14:02 | 000,000,210 | ---- | C] () -- C:\Boot.bak

[2010/10/27 09:14:00 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2010/10/27 09:07:13 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010/10/27 09:07:13 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010/10/27 09:07:13 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010/10/27 09:07:13 | 000,079,872 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010/10/27 09:07:13 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010/10/27 09:05:43 | 003,887,256 | R--- | C] () -- C:\Documents and Settings\administrator.BRAC\Desktop\ComboFix.exe

[2010/10/27 08:56:22 | 001,207,026 | ---- | C] () -- C:\Documents and Settings\administrator.BRAC\Desktop\tdsskiller.zip

[2010/10/26 15:42:38 | 000,034,019 | ---- | C] () -- C:\Documents and Settings\administrator.BRAC\Desktop\PHY Product Reaction Form 2010 CRS.pdf

[2010/10/26 12:53:22 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\administrator.BRAC\Desktop\RKUnhookerLE.EXE

[2010/10/22 08:56:05 | 000,000,498 | ---- | C] () -- C:\Documents and Settings\administrator.BRAC\Desktop\Web-Based Email Mail Index Inbox.url

[2010/10/21 17:46:25 | 000,000,052 | ---- | C] () -- C:\WINDOWS\BatchManager.ini

[2010/10/21 09:20:32 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk

[2010/10/15 09:56:48 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk

[2010/07/22 15:38:00 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2010/05/17 16:12:51 | 000,000,658 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini

[2010/03/02 11:04:12 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\TECK.dll

[2010/03/02 11:04:10 | 000,438,272 | ---- | C] () -- C:\WINDOWS\System32\tls704d.dll

[2010/03/02 11:04:10 | 000,409,600 | ---- | C] () -- C:\WINDOWS\System32\NOVA_API.dll

[2010/03/02 11:04:10 | 000,080,896 | ---- | C] () -- C:\WINDOWS\System32\cmeparse.dll

[2010/03/02 11:04:10 | 000,006,656 | ---- | C] () -- C:\WINDOWS\System32\ipinplus32.dll

[2010/03/02 11:04:09 | 000,843,776 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll

[2010/03/02 11:04:09 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll

[2010/01/25 12:58:06 | 000,462,848 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll

[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2007/07/02 09:55:48 | 000,000,392 | ---- | C] () -- C:\WINDOWS\SIERRA.INI

[2006/06/13 08:36:00 | 000,000,206 | ---- | C] () -- C:\WINDOWS\HPGdiPlus.ini

[2006/06/09 12:43:52 | 000,000,141 | ---- | C] () -- C:\Documents and Settings\administrator.BRAC\Local Settings\Application Data\fusioncache.dat

[2006/03/23 15:50:40 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI

[2006/03/20 14:00:52 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2006/03/13 16:22:56 | 000,003,399 | R--- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

[2006/03/13 16:22:56 | 000,000,422 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini

[2006/03/12 17:14:50 | 000,008,218 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log

[2005/11/22 10:34:29 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2005/11/22 10:13:02 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll

[2004/10/28 10:20:46 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\PadHid.dll

[2004/08/09 09:33:30 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2002/05/08 05:12:22 | 000,001,058 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

========== LOP Check ==========

[2010/10/15 09:56:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software

[2008/01/15 16:34:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Flood Light Games

[2010/09/22 14:23:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn

[2010/06/30 09:05:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sophos

[2008/01/16 10:16:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/08/02 13:45:27 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}

[2010/10/27 12:50:26 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F65733F1

< End of report >

Link to post
Share on other sites

Please open up Notepad and copy all of the items in the code box below.

Change the "Save As Type" to "All Files". Save it as fix.reg on your Desktop.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"=-

Now double-click fix.reg.

A window will come up asking if you want to let it merge with the registry.

Click yes.

You can delete that file after it merges.

=======Cleanup=======

  • Click START then RUN
  • Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the Uninstall, it needs to be there.

======Next======

  • Double click on OTL to run it.
  • Click on the Cleanup button at the top.
  • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.
  • This will remove itself and other tools we may have used.

Delete\uninstall anything else that we have used that is leftover.

After that your all set.

===The following are some articles and a Windows Update link that I like to suggest to people to prevent malware and general PC maintenance===

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Prevention article Some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.

"How did I get infected in the first place?" Also this one by Tony Klein.

If your computer is slow Is a tutorial on what you can do if your computer is slow.

File sharing program dangers Reasons to stay away from File sharing programs for ex: BitTorrent,Limewire,Kazaa,emule,Utorrent etc...

===Free antimalware tools used for on demand scanning and cleaning no real time unless purchased===

Malwarebytes Antimalware

superantispyware

===Free antivirus links===

This is antivirus and antispyware.

Microsoft Security Essentials

This is free antispyware protection and Antivirus protection.

AVG free 9.0

This is just antivirus protection.

Antivir

This is antivirus and antispyware protection.

Avast

Link to post
Share on other sites

  • 3 weeks later...
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.