(OTL.TXT CONTINUED)
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.2
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2012.2.1.6
FF - user.js - File not found
FF:
64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files (x86)\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Nhat\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/07/01 18:10:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/07/01 18:10:45 | 000,000,000 | ---D | M]
[2010/11/26 20:56:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nhat\AppData\Roaming\Mozilla\Extensions
[2012/06/09 16:20:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nhat\AppData\Roaming\Mozilla\Firefox\Profiles\6hgeg244.default\extensions
[2010/11/26 20:57:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nhat\AppData\Roaming\Mozilla\Firefox\Profiles\6hgeg244.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/26 20:57:51 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\Nhat\AppData\Roaming\Mozilla\Firefox\Profiles\6hgeg244.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2012/06/09 16:20:08 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Nhat\AppData\Roaming\Mozilla\Firefox\Profiles\6hgeg244.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010/11/26 20:56:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.1.3\COFFPLGN
File not found (No name found) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.1.3\IPSFFPLGN
O1 HOSTS File: ([2012/06/21 22:09:04 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2:
64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Program Files (x86)\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_04\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O3:
64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Program Files (x86)\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O3:
64bit: - HKU\S-1-5-21-2993233120-983781078-826693988-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\..\Toolbar\WebBrowser: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Program Files (x86)\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O4:
64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4:
64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OsdMaestro] c:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD64.exe (OsdMaestro)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATITechnologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-2993233120-983781078-826693988-1000..\Run: [BTBFirstRun] C:\Program Files (x86)\Hewlett-Packard\SDP\HPRun.exe (Hewlett-Packard Company)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:
64bit: - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O8:
64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nhat\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files (x86)\Megaupload\Mega Manager\mm_file.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nhat\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_04\bin\ssv.dll (Sun Microsystems, Inc.)
O10:
64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\..Trusted Domains: sprintpcs.com ([sso] https in Trusted sites)
O15 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\..Trusted Domains: vt.edu ([learn] http in Trusted sites)
O15 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\..Trusted Domains: vt.edu ([learn] https in Trusted sites)
O15 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\..Trusted Domains: vt.edu ([scholar] http in Trusted sites)
O15 - HKU\S-1-5-21-2993233120-983781078-826693988-1000\..Trusted Domains: vt.edu ([scholar] https in Trusted sites)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258}
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034}
http://intel-drv-cdn.systemrequirementslab.com/multi/bin/sysreqlab_srlx.cab (System Requirements Lab Class)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab (Reg Error: Key error.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537}
http://gfx1.hotmail.com/mail/w3/pr01/resources/VistaMSNPUplden-us.cab (MSN Photo Upload Tool)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB}
http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE}
https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.53.2.cab (Battlefield Play4Free Updater)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.27.35.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DC14EAA4-1696-4BC4-8F06-26162A9C041C}: DhcpNameServer = 172.27.35.1
O18:
64bit: - Protocol\Handler\ms-itss - No CLSID value found
O20:
64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img18.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img18.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:
64bit: - HKLM\..comfile [open] -- "%1" %*
O35:
64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:
64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:
64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
Drivers32:
64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\AC3ACM.acm (fccHandler)
Drivers32: msacm.alf2cd - C:\Windows\SysWow64\alf2cd.acm (NCT Company)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.scg726 - C:\Windows\SysWow64\Scg726.acm (SHARP Corporation)
Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS
http://hp.vector.co.jp/authors/VA012897/)
Drivers32: msacm.voxacm160 - C:\Windows\SysWow64\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\divx.dll (DivXNetworks, Inc.)
Drivers32: vidc.dvsd - C:\Windows\SysWow64\mcdvd_32.dll (MainConcept)
Drivers32: vidc.mp42 - C:\Windows\SysWow64\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mp43 - C:\Windows\SysWow64\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg4 - C:\Windows\SysWow64\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.xvid - C:\Windows\SysWow64\xvidvfw.dll ()
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2012/06/21 23:37:20 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Nhat\Desktop\OTL.exe
[2012/06/21 22:15:29 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/06/21 22:15:29 | 000,000,000 | ---D | C] -- C:\Users\Nhat\AppData\Local\temp
[2012/06/21 22:09:22 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/21 21:53:24 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/06/21 21:53:24 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/06/21 21:53:24 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/06/21 21:52:55 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/06/21 21:40:39 | 004,564,664 | R--- | C] (Swearware) -- C:\Users\Nhat\Desktop\ComboFix.exe
[2012/06/21 20:48:58 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Nhat\Desktop\aswMBR.exe
[2012/06/21 20:46:17 | 000,083,968 | ---- | C] (Esage Lab) -- C:\Users\Nhat\Desktop\boot_cleaner.exe
[2012/06/20 22:41:08 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Nhat\Desktop\dds.scr
[2012/06/19 20:25:06 | 000,000,000 | ---D | C] -- C:\Users\Nhat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/06/19 20:25:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HiJackThis
[2012/06/19 19:51:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/17 20:17:59 | 000,000,000 | ---D | C] -- C:\Users\Nhat\AppData\Local\Symantec
[2012/06/17 20:15:59 | 000,173,616 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2012/06/17 20:14:09 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2012/06/17 20:12:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection
[2012/06/17 20:12:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Symantec
[2012/06/17 19:50:11 | 000,000,000 | ---D | C] -- C:\VT-SEPVersion
[2012/06/17 19:46:09 | 000,000,000 | ---D | C] -- C:\VT-SecureTools
[2012/06/17 18:38:37 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012/06/17 16:13:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/09 16:20:07 | 000,000,000 | ---D | C] -- C:\Users\Nhat\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/06/09 16:20:00 | 000,405,176 | ---- | C] (Newtonsoft) -- C:\Windows\SysWow64\Newtonsoft.Json.Net20.dll
[2012/06/09 16:19:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2012/06/09 16:19:07 | 000,000,000 | ---D | C] -- C:\Users\Nhat\AppData\Roaming\DVDVideoSoft
[2012/06/03 22:06:07 | 000,000,000 | ---D | C] -- C:\Users\Nhat\AppData\Roaming\ts3overlay
[2012/05/27 12:58:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Six Projects
[2008/07/15 15:13:39 | 000,308,600 | ---- | C] (Symantec Corporation) -- C:\ProgramData\NortonProtectionMemo.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/06/21 23:37:22 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Nhat\Desktop\OTL.exe
[2012/06/21 23:33:07 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/21 23:32:20 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/21 23:32:20 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/21 23:32:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/21 23:01:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/21 22:09:04 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/06/21 21:42:53 | 004,564,664 | R--- | M] (Swearware) -- C:\Users\Nhat\Desktop\ComboFix.exe
[2012/06/21 21:25:13 | 000,000,512 | ---- | M] () -- C:\Users\Nhat\Desktop\MBR.dat
[2012/06/21 20:49:57 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Nhat\Desktop\aswMBR.exe
[2012/06/21 20:45:59 | 000,044,607 | ---- | M] () -- C:\Users\Nhat\Desktop\bootkit_remover.zip
[2012/06/20 22:41:11 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Nhat\Desktop\dds.scr
[2012/06/20 22:34:05 | 000,302,592 | ---- | M] () -- C:\Users\Nhat\Desktop\lq0i9ls0.exe
[2012/06/19 20:27:08 | 000,002,687 | ---- | M] () -- C:\Users\Nhat\Desktop\HiJackThis.lnk
[2012/06/19 19:59:47 | 000,312,904 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/19 19:55:53 | 000,783,422 | ---- | M] () -- C:\Users\Nhat\Documents\cc_20120619_195521.reg
[2012/06/18 19:57:59 | 000,718,136 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/18 19:57:59 | 000,604,264 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/06/18 19:57:59 | 000,103,964 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/06/17 20:16:19 | 000,173,616 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2012/06/17 20:16:19 | 000,007,440 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2012/06/17 20:16:19 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/06/17 19:53:51 | 003,143,662 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1302000.00A\Cat.DB
[2012/06/17 19:51:18 | 000,920,096 | ---- | M] () -- C:\Users\Nhat\Desktop\Norton_Removal_Tool.exe
[2012/06/17 18:19:28 | 000,000,512 | ---- | M] () -- C:\Users\Nhat\Documents\MBR.dat
[2012/06/11 20:51:02 | 000,949,808 | ---- | M] () -- C:\Users\Nhat\Documents\4.0_Student_Intern_brochure_OCt272011.pdf
[2012/06/10 00:37:55 | 000,298,280 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012/06/10 00:37:55 | 000,298,280 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012/06/09 11:45:03 | 000,002,479 | ---- | M] () -- C:\Users\Public\Desktop\Six Updater.lnk
[2012/06/08 22:27:07 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\Six Launcher.lnk
[2012/06/08 20:16:22 | 000,298,280 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012/06/03 00:51:25 | 000,002,074 | ---- | M] () -- C:\Users\Nhat\AppData\Roaming\wklnhst.dat
[2012/05/25 19:48:10 | 000,009,728 | ---- | M] () -- C:\Users\Nhat\Documents\WPA password - Copy.wps
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/06/21 21:53:24 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/06/21 21:53:24 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/06/21 21:53:24 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/06/21 21:53:24 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/06/21 21:53:24 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/06/21 21:25:13 | 000,000,512 | ---- | C] () -- C:\Users\Nhat\Desktop\MBR.dat
[2012/06/21 20:45:58 | 000,044,607 | ---- | C] () -- C:\Users\Nhat\Desktop\bootkit_remover.zip
[2012/06/20 22:34:04 | 000,302,592 | ---- | C] () -- C:\Users\Nhat\Desktop\lq0i9ls0.exe
[2012/06/19 20:25:06 | 000,002,687 | ---- | C] () -- C:\Users\Nhat\Desktop\HiJackThis.lnk
[2012/06/19 19:55:32 | 000,783,422 | ---- | C] () -- C:\Users\Nhat\Documents\cc_20120619_195521.reg
[2012/06/17 20:15:59 | 000,007,440 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2012/06/17 20:15:59 | 000,000,855 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/06/17 19:51:18 | 000,920,096 | ---- | C] () -- C:\Users\Nhat\Desktop\Norton_Removal_Tool.exe
[2012/06/17 18:19:28 | 000,000,512 | ---- | C] () -- C:\Users\Nhat\Documents\MBR.dat
[2012/06/11 20:51:02 | 000,949,808 | ---- | C] () -- C:\Users\Nhat\Documents\4.0_Student_Intern_brochure_OCt272011.pdf
[2012/05/27 12:58:17 | 000,002,479 | ---- | C] () -- C:\Users\Public\Desktop\Six Updater.lnk
[2012/05/27 12:58:17 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\Six Launcher.lnk
[2012/05/10 14:10:21 | 000,002,048 | -HS- | C] () -- C:\Users\Nhat\AppData\Local\{95d3c63e-2ab9-3336-9fbd-372aa0847d8a}\@
[2012/01/01 12:17:51 | 000,010,734 | -HS- | C] () -- C:\Users\Nhat\AppData\Local\381kr12hk05j54204368ddqtds7r668gwt2bw13577l
[2012/01/01 12:17:51 | 000,010,734 | -HS- | C] () -- C:\ProgramData\381kr12hk05j54204368ddqtds7r668gwt2bw13577l
[2011/11/25 15:42:34 | 000,000,680 | ---- | C] () -- C:\Users\Nhat\AppData\Local\d3d9caps.dat
[2010/11/26 20:56:20 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010/08/20 15:26:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010/03/28 17:26:32 | 000,000,732 | ---- | C] () -- C:\Users\Nhat\AppData\Local\d3d9caps64.dat
[2008/07/22 14:17:29 | 000,012,800 | ---- | C] () -- C:\Users\Nhat\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/13 23:03:56 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008/07/11 13:24:27 | 000,002,074 | ---- | C] () -- C:\Users\Nhat\AppData\Roaming\wklnhst.dat
========== LOP Check ==========
[2008/08/21 09:47:55 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\acccore
[2008/08/03 15:41:06 | 000,000,000 | ---D | M] -- C:\Users\Ngoc & Hoang Nguyen\AppData\Roaming\LimeWire
[2008/07/17 18:25:09 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\acccore
[2009/07/14 14:13:54 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Any Video Converter
[2008/07/31 14:27:34 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\AVSMedia
[2010/07/03 19:37:14 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Canon
[2008/07/20 23:56:20 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\DAEMON Tools
[2008/07/14 02:05:24 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\DisplayTune
[2012/06/09 16:20:28 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\DVDVideoSoft
[2012/06/09 16:20:07 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/08/16 21:24:53 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\GARMIN
[2008/07/30 12:15:01 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\ImgBurn
[2008/08/16 16:19:07 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Leadertech
[2012/06/17 20:07:22 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\LimeWire
[2010/12/24 15:20:23 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\LolClient
[2009/11/15 22:23:46 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Magic Academy
[2008/07/17 13:19:24 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Megaupload
[2008/07/17 13:10:56 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\MegauploadToolbar
[2008/07/17 14:27:38 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\muvee Technologies
[2010/07/07 21:14:35 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Neofle
[2011/12/27 20:18:10 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Origin
[2011/07/30 18:25:04 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Screaming Bee
[2012/05/27 13:00:32 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\six-updater
[2012/05/10 14:44:18 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\six-zsync
[2011/07/13 18:26:34 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Spirited Machine
[2010/11/27 12:48:55 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Template
[2012/06/17 18:51:41 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\TS3Client
[2012/06/03 22:06:16 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\ts3overlay
[2010/09/19 09:38:19 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\Ulbixa
[2012/06/19 19:54:08 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\uTorrent
[2010/01/16 10:13:47 | 000,000,000 | ---D | M] -- C:\Users\Nhat\AppData\Roaming\WinBatch
[2012/06/21 23:30:57 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2008/04/14 07:33:59 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2012/06/21 22:15:27 | 000,016,253 | ---- | M] () -- C:\ComboFix.txt
[2010/05/29 10:54:10 | 000,000,250 | ---- | M] () -- C:\FINIS_IT.TXT
[2009/11/01 22:13:27 | 000,000,730 | -H-- | M] () -- C:\IPH.PH
[2010/07/08 11:31:07 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2006/12/02 02:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll
[2012/06/21 23:32:04 | 312,885,247 | -HS- | M] () -- C:\pagefile.sys
[2008/07/14 02:06:07 | 000,000,173 | ---- | M] () -- C:\pdisdk.log
[2008/07/14 02:06:48 | 000,000,184 | ---- | M] () -- C:\pivot.log
[2009/11/03 10:38:59 | 000,000,150 | ---- | M] () -- C:\YServer.txt
< %systemroot%\Fonts\*.com >
[2006/11/02 11:06:41 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 11:06:41 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 11:06:41 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/10/31 20:22:23 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2006/09/18 17:35:48 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2008/01/20 23:21:59 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/11/20 15:25:23 | 000,000,286 | -HS- | M] () -- C:\Users\Nhat\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
[2012/06/21 20:49:57 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Nhat\Desktop\aswMBR.exe
[2011/09/20 03:02:40 | 000,083,968 | ---- | M] (Esage Lab) -- C:\Users\Nhat\Desktop\boot_cleaner.exe
[2012/06/21 21:42:53 | 004,564,664 | R--- | M] (Swearware) -- C:\Users\Nhat\Desktop\ComboFix.exe
[2012/06/20 22:34:05 | 000,302,592 | ---- | M] () -- C:\Users\Nhat\Desktop\lq0i9ls0.exe
[2012/06/17 19:51:18 | 000,920,096 | ---- | M] () -- C:\Users\Nhat\Desktop\Norton_Removal_Tool.exe
[2012/06/21 23:37:22 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Nhat\Desktop\OTL.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\tasks\*.* >
[2012/06/21 23:33:07 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/21 23:01:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/21 23:32:23 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2012/06/21 23:30:57 | 000,032,620 | ---- | M] () -- C:\Windows\tasks\SCHEDLGU.TXT
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
< %USERPROFILE%\*.exe >
< %systemroot%\ADDINS\*.* >
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
[2008/07/10 14:11:53 | 000,000,402 | -HS- | M] () -- C:\Users\Nhat\Favorites\desktop.ini
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
[2012/01/01 12:19:53 | 000,010,734 | -HS- | M] () -- C:\ProgramData\381kr12hk05j54204368ddqtds7r668gwt2bw13577l
[2008/04/14 06:49:29 | 000,000,342 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2008/07/14 10:55:00 | 000,308,600 | ---- | M] (Symantec Corporation) -- C:\ProgramData\NortonProtectionMemo.exe
[2009/08/25 09:48:08 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /I " " /c >
< dir /b "%systemroot%\*.exe" | find /I " " /c >
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.* >
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime /rs >
< >
< End of report >