OTL.txt log
OTL logfile created on: 12/10/2011 9:54:55 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\CHINA\Downloads
Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 0.94 Gb Available Physical Memory | 47.19% Memory free
3.98 Gb Paging File | 2.70 Gb Available in Paging File | 67.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 178.83 Gb Total Space | 75.67 Gb Free Space | 42.31% Space Free | Partition Type: NTFS
Drive D: | 4.06 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Computer Name: CHINA-PC | User Name: CHINA | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\CHINA\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe (Yahoo! Inc.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\CrossriderWebApps\Crossrider.exe (Crossrider)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version6\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
========== Modules (No Company Name) ==========
MOD - C:\Program Files\Yahoo!\Messenger\yui.dll ()
MOD - C:\Program Files\Yahoo!\Messenger\pcre.dll ()
MOD - C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll ()
MOD - C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\avutil-51.dll ()
MOD - C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\avformat-53.dll ()
MOD - C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\avcodec-53.dll ()
MOD - C:\Program Files\CrossriderWebApps\Crossrider.dll ()
MOD - C:\Program Files\DivX\DivX Plus Web Player\libxml2.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
========== Win32 Services (SafeList) ==========
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (VcmXmlIfHelper) -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe (Sony Corporation)
========== Driver Services (SafeList) ==========
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (taphss) -- C:\Windows\System32\drivers\taphss.sys (AnchorFree Inc)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (RTL8187) -- C:\Windows\System32\drivers\RTL8187.sys (Realtek Semiconductor Corporation )
DRV - (R5U870FLx86) -- C:\Windows\System32\drivers\R5U870FLx86.sys (Ricoh)
DRV - (R5U870FUx86) -- C:\Windows\System32\drivers\R5U870FUx86.sys (Ricoh)
DRV - (ti21sony) -- C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://search.conduit.com?SearchSource=10&ctid=CT1561552
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 06 D7 D7 40 C4 FA CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - No CLSID value found
IE - HKCU\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Creative Commons"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems:
toolbar@ask.com:3.9.1.14019
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems:
ffxtlbr@Facemoods.com:1.4.1
FF - prefs.js..extensions.enabledItems:
crossriderapp435@crossrider.com:0.72.17
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\CHINA\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\CHINA\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/06/15 19:55:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/06/15 19:55:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\crossriderapp435@crossrider.com: C:\ProgramData\CodecCheck\firefox [2011/11/16 00:07:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/28 22:46:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/16 23:57:30 | 000,000,000 | ---D | M]
[2011/01/26 18:27:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CHINA\AppData\Roaming\Mozilla\Extensions
[2011/12/07 19:56:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CHINA\AppData\Roaming\Mozilla\Firefox\Profiles\cwp3daqv.default\extensions
[2011/12/07 19:56:13 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\CHINA\AppData\Roaming\Mozilla\Firefox\Profiles\cwp3daqv.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/12/05 20:08:55 | 000,000,000 | ---D | M] (Hotspot Shield Community Toolbar) -- C:\Users\CHINA\AppData\Roaming\Mozilla\Firefox\Profiles\cwp3daqv.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
[2011/12/05 20:08:56 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\CHINA\AppData\Roaming\Mozilla\Firefox\Profiles\cwp3daqv.default\extensions\engine@conduit.com
[2011/12/07 21:43:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/01/25 20:36:24 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/01/25 20:35:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/06/15 19:55:34 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>
-- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011/06/15 19:55:34 | 000,000,000 | ---D | M] (DivX HiQ) -- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2011/11/16 00:07:30 | 000,000,000 | ---D | M] ("Premiumplay Codec-C") -- C:\PROGRAMDATA\CODECCHECK\FIREFOX
File not found (No name found) -- C:\USERS\CHINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CWP3DAQV.DEFAULT\EXTENSIONS\FFXTLBR@FACEMOODS.COM
File not found (No name found) -- C:\USERS\CHINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CWP3DAQV.DEFAULT\EXTENSIONS\TOOLBAR@ASK.COM
[2011/01/25 20:35:46 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google
riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\CHINA\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\CHINA\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: DivX HiQ = C:\Users\CHINA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
CHR - Extension: Premiumplay Codec-C = C:\Users\CHINA\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho\1.13.21_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\CHINA\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\
O1 HOSTS File: ([2011/11/29 20:36:32 | 000,000,860 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (no name) - {64182481-4F71-486b-A045-B233BD0DA8FC} - No CLSID value found.
O2 - BHO: (CrossRider) - {A876E312-7D08-401a-B7A6-FAFC5DC2F292} - C:\Program Files\CrossriderWebApps\Crossrider.dll ()
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKCU..\Run: [CrossRiderPlugin] C:\Program Files\CrossriderWebApps\Crossrider.exe (Crossrider)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.42.20.20 195.229.241.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5C40D96B-3B8B-445A-970E-0BE2B8879BC0}: DhcpNameServer = 213.42.20.20 195.229.241.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C9C28D55-C72D-48EF-89B9-CB120C0777D3}: DhcpNameServer = 192.168.254.254
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 01:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{7fd9d173-2f85-11e0-9e54-001a8040a472}\Shell - "" = AutoRun
O33 - MountPoints2\{7fd9d173-2f85-11e0-9e54-001a8040a472}\Shell\AutoRun\command - "" = "E:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{f3197f3d-8621-11e0-ae3d-e0d8d184ce50}\Shell - "" = AutoRun
O33 - MountPoints2\{f3197f3d-8621-11e0-ae3d-e0d8d184ce50}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/12/10 19:08:56 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/12/07 23:05:06 | 000,000,000 | ---D | C] -- C:\Users\CHINA\Desktop\Sophie Kinsella (as Madeleine Wickham) - The Tennis Party (html)
[2011/12/07 21:35:05 | 000,000,000 | ---D | C] -- C:\Users\CHINA\AppData\Roaming\GetRightToGo
[2011/12/07 21:35:05 | 000,000,000 | ---D | C] -- C:\Users\CHINA\Documents\Downloads
[2011/12/07 19:55:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion
[2011/12/07 19:55:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
[2011/12/07 19:23:00 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/12/07 19:23:00 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/12/07 19:23:00 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/12/07 19:22:50 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/12/05 20:08:22 | 000,000,000 | ---D | C] -- C:\Hotspot Shield
[2011/12/04 21:00:38 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/12/04 21:00:24 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2011/12/04 21:00:20 | 004,331,784 | R--- | C] (Swearware) -- C:\Users\CHINA\Desktop\ComboFix.exe
[2011/12/04 03:09:38 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/12/04 02:55:48 | 000,000,000 | ---D | C] -- C:\Hijack This
[2011/12/03 23:51:31 | 001,566,512 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\CHINA\Desktop\TDSSKiller.exe
[2011/12/03 23:25:05 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\CHINA\Desktop\dds.scr
[2011/11/29 21:16:42 | 000,000,000 | ---D | C] -- C:\Users\CHINA\AppData\Roaming\Malwarebytes
[2011/11/29 21:16:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/11/29 21:16:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/11/29 21:16:25 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/11/29 21:16:24 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/11/29 21:10:12 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\CHINA\Desktop\mbam-setup-1.51.2.1300.exe
[2011/11/29 18:34:15 | 000,000,000 | ---D | C] -- C:\Program Files\Loaris
[2011/11/27 22:18:49 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2011/11/27 20:48:47 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2011/11/27 19:59:08 | 000,000,000 | ---D | C] -- C:\Users\CHINA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
[2011/11/26 23:44:43 | 000,000,000 | ---D | C] -- C:\microsoft
[2011/11/26 19:30:24 | 000,000,000 | ---D | C] -- C:\temp
[2011/11/21 19:10:45 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/11/20 19:00:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2011/11/16 23:59:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe Systems
[2011/11/16 23:59:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe Systems Shared
[2011/11/16 23:56:14 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe PDF
[2011/11/16 23:28:27 | 000,000,000 | ---D | C] -- C:\Users\CHINA\Calibre Library
[2011/11/16 23:28:22 | 000,000,000 | ---D | C] -- C:\Users\CHINA\AppData\Roaming\calibre
[2011/11/16 23:27:49 | 000,000,000 | ---D | C] -- C:\Program Files\Calibre2
[2011/11/16 23:26:02 | 000,000,000 | ---D | C] -- C:\Program Files\ABC Amber LIT Converter
[2011/11/16 00:07:44 | 000,000,000 | ---D | C] -- C:\Program Files\CrossriderWebApps
[2011/11/16 00:07:24 | 000,000,000 | ---D | C] -- C:\ProgramData\CodecCheck
[2011/11/16 00:07:21 | 000,000,000 | ---D | C] -- C:\codec-info
[2011/11/16 00:06:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2011/11/16 00:06:45 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2011/11/15 22:00:22 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/12/10 21:31:14 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2886469913-3916006163-435472159-1000UA.job
[2011/12/10 18:53:46 | 000,020,512 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/10 18:53:46 | 000,020,512 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/10 18:45:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/12/10 18:45:53 | 1603,084,288 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/08 00:31:36 | 000,042,093 | ---- | M] () -- C:\Users\CHINA\Desktop\wedding.jpg
[2011/12/07 23:59:00 | 000,207,285 | ---- | M] () -- C:\Users\CHINA\Desktop\mini.jpg
[2011/12/07 22:56:16 | 000,045,341 | ---- | M] () -- C:\Users\CHINA\Desktop\tennis.jpg
[2011/12/07 22:45:06 | 000,408,936 | ---- | M] () -- C:\Users\CHINA\Desktop\Sophie Kinsella (as Madeleine Wickham) - The Tennis Party (html) (1).rar
[2011/12/07 19:55:27 | 000,001,131 | ---- | M] () -- C:\Users\CHINA\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/12/07 19:55:27 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk
[2011/12/07 19:22:21 | 004,331,784 | R--- | M] (Swearware) -- C:\Users\CHINA\Desktop\ComboFix.exe
[2011/12/07 18:31:02 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2886469913-3916006163-435472159-1000Core.job
[2011/12/05 22:11:28 | 000,615,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/12/05 22:11:28 | 000,103,702 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/12/05 18:42:06 | 000,346,570 | ---- | M] () -- C:\Users\CHINA\Desktop\unhide_files.exe
[2011/12/04 02:56:43 | 000,305,771 | ---- | M] () -- C:\Users\CHINA\Desktop\HijackThis.zip
[2011/12/03 23:58:40 | 001,008,114 | ---- | M] () -- C:\Users\CHINA\Desktop\rkill.scr
[2011/12/03 23:25:19 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\CHINA\Desktop\dds.scr
[2011/12/03 22:32:19 | 001,547,774 | ---- | M] () -- C:\Users\CHINA\Desktop\tdsskiller.zip
[2011/11/29 21:43:31 | 000,302,592 | ---- | M] () -- C:\Users\CHINA\Desktop\rwr6icjr.exe
[2011/11/29 21:16:32 | 000,001,091 | ---- | M] () -- C:\Users\CHINA\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/11/29 21:16:32 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/29 21:15:34 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\CHINA\Desktop\mbam-setup-1.51.2.1300.exe
[2011/11/27 19:59:14 | 000,000,320 | ---- | M] () -- C:\ProgramData\~HSPrahzOqQdUyT
[2011/11/27 19:59:14 | 000,000,224 | ---- | M] () -- C:\ProgramData\~HSPrahzOqQdUyTr
[2011/11/27 19:59:08 | 000,000,673 | ---- | M] () -- C:\Users\CHINA\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
[2011/11/27 19:59:08 | 000,000,649 | ---- | M] () -- C:\Users\CHINA\Desktop\System Fix.lnk
[2011/11/27 19:57:59 | 000,000,336 | ---- | M] () -- C:\ProgramData\HSPrahzOqQdUyT
[2011/11/24 12:33:42 | 001,566,512 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\CHINA\Desktop\TDSSKiller.exe
[2011/11/22 22:17:48 | 000,000,000 | ---- | M] () -- C:\Windows\System32\cd.dat
[2011/11/19 18:32:05 | 000,002,359 | ---- | M] () -- C:\Users\CHINA\Desktop\Google Chrome.lnk
[2011/11/18 22:01:04 | 000,412,464 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/11/17 00:33:55 | 000,064,570 | ---- | M] () -- C:\Users\CHINA\Documents\rememberme.jpg
[2011/11/17 00:33:02 | 000,033,686 | ---- | M] () -- C:\Users\CHINA\Documents\Twenties Girl.jpg
[2011/11/17 00:16:20 | 000,007,464 | ---- | M] () -- C:\Users\CHINA\Documents\beauty's release.jpg
[2011/11/17 00:14:21 | 000,043,959 | ---- | M] () -- C:\Users\CHINA\Documents\confessions-of-a-shopaholic-book-review-sophie-kinsella-the-idea-girl-says.jpg
[2011/11/17 00:06:18 | 000,092,906 | ---- | M] () -- C:\Users\CHINA\Documents\secret.jpg
[2011/11/17 00:01:31 | 000,527,403 | ---- | M] () -- C:\Users\CHINA\Documents\Sophie Kinsella - Shopaholic Abroad 0552999407.pdf
[2011/11/17 00:00:58 | 000,492,083 | ---- | M] () -- C:\Users\CHINA\Documents\Sophie Kinsella - Secret Dreamworld of a Shopaholic 0552998877.pdf
[2011/11/16 23:59:03 | 000,032,402 | ---- | M] () -- C:\Users\CHINA\Documents\abroad.jpg
[2011/11/16 23:55:42 | 000,010,139 | ---- | M] () -- C:\Users\CHINA\Documents\secret world.jpg
[2011/11/16 23:41:59 | 000,037,438 | ---- | M] () -- C:\Users\CHINA\Documents\shopaholic_and_baby.jpg
[2011/11/16 23:40:10 | 000,037,483 | ---- | M] () -- C:\Users\CHINA\Documents\shopaholic_sister.jpg
[2011/11/16 23:39:34 | 000,055,599 | ---- | M] () -- C:\Users\CHINA\Documents\shopaholic takes manhattan.jpg
[2011/11/16 23:37:51 | 000,062,863 | ---- | M] () -- C:\Users\CHINA\Documents\ties the knot.jpg
[2011/11/16 23:33:06 | 000,155,949 | ---- | M] () -- C:\Users\CHINA\Documents\Undomestic-Goddess.jpg
[2011/11/16 23:26:05 | 000,001,018 | ---- | M] () -- C:\Users\CHINA\Desktop\ABC Amber LIT Converter.lnk
[2011/11/16 23:08:03 | 000,020,655 | ---- | M] () -- C:\Users\CHINA\Documents\shopaholic ties the knot.jpg
[2011/11/16 19:10:23 | 000,003,584 | ---- | M] () -- C:\Users\CHINA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/12 22:43:00 | 000,000,436 | ---- | M] () -- C:\Windows\tasks\Norton Security Scan for CHINA.job
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/12/08 00:31:43 | 000,042,093 | ---- | C] () -- C:\Users\CHINA\Desktop\wedding.jpg
[2011/12/07 23:59:05 | 000,207,285 | ---- | C] () -- C:\Users\CHINA\Desktop\mini.jpg
[2011/12/07 22:56:21 | 000,045,341 | ---- | C] () -- C:\Users\CHINA\Desktop\tennis.jpg
[2011/12/07 22:45:01 | 000,408,936 | ---- | C] () -- C:\Users\CHINA\Desktop\Sophie Kinsella (as Madeleine Wickham) - The Tennis Party (html) (1).rar
[2011/12/07 19:55:27 | 000,001,131 | ---- | C] () -- C:\Users\CHINA\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/12/07 19:55:27 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk
[2011/12/07 19:23:00 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/12/05 18:42:02 | 000,346,570 | ---- | C] () -- C:\Users\CHINA\Desktop\unhide_files.exe
[2011/12/04 21:02:48 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/12/04 21:02:48 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/12/04 21:02:48 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/12/04 21:02:48 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/12/04 02:56:42 | 000,305,771 | ---- | C] () -- C:\Users\CHINA\Desktop\HijackThis.zip
[2011/12/03 23:58:30 | 001,008,114 | ---- | C] () -- C:\Users\CHINA\Desktop\rkill.scr
[2011/12/03 22:32:20 | 001,547,774 | ---- | C] () -- C:\Users\CHINA\Desktop\tdsskiller.zip
[2011/11/29 21:43:29 | 000,302,592 | ---- | C] () -- C:\Users\CHINA\Desktop\rwr6icjr.exe
[2011/11/29 21:16:32 | 000,001,091 | ---- | C] () -- C:\Users\CHINA\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/11/29 21:16:32 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/27 19:59:14 | 000,000,224 | ---- | C] () -- C:\ProgramData\~HSPrahzOqQdUyTr
[2011/11/27 19:59:13 | 000,000,320 | ---- | C] () -- C:\ProgramData\~HSPrahzOqQdUyT
[2011/11/27 19:59:08 | 000,000,673 | ---- | C] () -- C:\Users\CHINA\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
[2011/11/27 19:59:08 | 000,000,649 | ---- | C] () -- C:\Users\CHINA\Desktop\System Fix.lnk
[2011/11/27 19:57:59 | 000,000,336 | ---- | C] () -- C:\ProgramData\HSPrahzOqQdUyT
[2011/11/22 22:17:48 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat
[2011/11/17 00:33:57 | 000,064,570 | ---- | C] () -- C:\Users\CHINA\Documents\rememberme.jpg
[2011/11/17 00:33:05 | 000,033,686 | ---- | C] () -- C:\Users\CHINA\Documents\Twenties Girl.jpg
[2011/11/17 00:16:23 | 000,007,464 | ---- | C] () -- C:\Users\CHINA\Documents\beauty's release.jpg
[2011/11/17 00:14:24 | 000,043,959 | ---- | C] () -- C:\Users\CHINA\Documents\confessions-of-a-shopaholic-book-review-sophie-kinsella-the-idea-girl-says.jpg
[2011/11/17 00:06:24 | 000,092,906 | ---- | C] () -- C:\Users\CHINA\Documents\secret.jpg
[2011/11/17 00:01:31 | 000,527,403 | ---- | C] () -- C:\Users\CHINA\Documents\Sophie Kinsella - Shopaholic Abroad 0552999407.pdf
[2011/11/17 00:00:58 | 000,492,083 | ---- | C] () -- C:\Users\CHINA\Documents\Sophie Kinsella - Secret Dreamworld of a Shopaholic 0552998877.pdf
[2011/11/16 23:59:08 | 000,032,402 | ---- | C] () -- C:\Users\CHINA\Documents\abroad.jpg
[2011/11/16 23:55:54 | 000,010,139 | ---- | C] () -- C:\Users\CHINA\Documents\secret world.jpg
[2011/11/16 23:42:02 | 000,037,438 | ---- | C] () -- C:\Users\CHINA\Documents\shopaholic_and_baby.jpg
[2011/11/16 23:40:13 | 000,037,483 | ---- | C] () -- C:\Users\CHINA\Documents\shopaholic_sister.jpg
[2011/11/16 23:39:37 | 000,055,599 | ---- | C] () -- C:\Users\CHINA\Documents\shopaholic takes manhattan.jpg
[2011/11/16 23:38:01 | 000,062,863 | ---- | C] () -- C:\Users\CHINA\Documents\ties the knot.jpg
[2011/11/16 23:33:12 | 000,155,949 | ---- | C] () -- C:\Users\CHINA\Documents\Undomestic-Goddess.jpg
[2011/11/16 23:26:05 | 000,001,018 | ---- | C] () -- C:\Users\CHINA\Desktop\ABC Amber LIT Converter.lnk
[2011/11/16 23:08:22 | 000,020,655 | ---- | C] () -- C:\Users\CHINA\Documents\shopaholic ties the knot.jpg
[2011/02/11 21:09:16 | 000,000,056 | ---- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011/02/10 22:54:22 | 000,003,584 | ---- | C] () -- C:\Users\CHINA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/26 18:27:31 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/01/25 20:17:02 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2011/01/25 20:17:02 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011/01/25 20:17:01 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011/01/25 20:17:01 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011/01/25 20:17:01 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011/01/25 20:09:23 | 000,000,268 | ---- | C] () -- C:\Windows\_delis32.ini
[2009/07/14 08:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 08:33:53 | 000,412,464 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 06:05:48 | 000,615,360 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/14 06:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/14 06:05:48 | 000,103,702 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/14 06:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/14 06:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/14 06:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/14 04:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009/07/14 03:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 03:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 03:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/07/14 02:09:19 | 001,498,564 | ---- | C] () -- C:\Windows\System32\igkrng400.bin
[2009/06/11 01:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
========== LOP Check ==========
[2011/12/08 00:50:18 | 000,000,000 | ---D | M] -- C:\Users\CHINA\AppData\Roaming\calibre
[2011/12/07 21:44:51 | 000,000,000 | ---D | M] -- C:\Users\CHINA\AppData\Roaming\GetRightToGo
[2011/09/27 19:44:00 | 000,000,000 | ---D | M] -- C:\Users\CHINA\AppData\Roaming\Gygan
[2011/06/15 20:09:29 | 000,000,000 | ---D | M] -- C:\Users\CHINA\AppData\Roaming\LimeWireTurbo
[2011/04/22 16:51:59 | 000,000,000 | ---D | M] -- C:\Users\CHINA\AppData\Roaming\TeamViewer
[2011/05/29 19:09:58 | 000,032,568 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
< MD5 for: EXPLORER.EXE >
[2009/07/14 05:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\explorer.exe
[2009/07/14 05:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
< MD5 for: USERINIT.EXE >
[2009/07/14 05:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009/07/14 05:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
< MD5 for: WINLOGON.EXE >
[2009/07/14 05:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\System32\winlogon.exe
[2009/07/14 05:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
< %systemroot%\*. /mp /s >
< End of report >