TechSpot

Search engine results redirection hijack - how to clean?

By ricardo1979
Dec 4, 2010
  1. Hi there,

    I've run the recommended tools (MBAM, GMER and DDS), and some nasty stuff has turned up, but I don't know what to remove (logs pasted below)

    My regular tools are AVG, Zonealarm, SBS&D

    Any help very, very gratefully received!

    Cheers, R


    Malwarebytes' Anti-Malware 1.50
    www.malwarebytes.org

    Database version: 5243

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    12/4/2010 7:56:47 PM
    mbam-log-2010-12-04 (19-56-47).txt

    Scan type: Quick scan
    Objects scanned: 165328
    Time elapsed: 2 minute(s), 54 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 6
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 2

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\TBH (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0C7C23EF-A848-485B-873C-0ED954731014} (Trojan.Agent) -> Value: {0C7C23EF-A848-485B-873C-0ED954731014} -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0C7C23EF-A848-485B-873C-0ED954731014} (Trojan.Agent) -> Value: {0C7C23EF-A848-485B-873C-0ED954731014} -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Value: {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Value: {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Value: {A57E074F-56D8-4A33-8112-AAC9693AA909} -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Value: {A57E074F-56D8-4A33-8112-AAC9693AA909} -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Start (Disabled.Cryptsvc) -> Bad: (4) Good: (2) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\WINDOWS\system32\madCHook.dll (MadCodeHook) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\SSup.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2010-12-04 21:14:26
    Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\00000032 ST3802110AS_________________41N3273_LEN rev.3.AAH
    Running: w1ryenmw.exe; Driver: C:\DOCUME~1\PC\LOCALS~1\Temp\fxddapow.sys


    ---- System - GMER 1.0.15 ----

    SSDT spcq.sys ZwEnumerateKey [0xBA6C5CA4]
    SSDT spcq.sys ZwEnumerateValueKey [0xBA6C6032]

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A5451F8
    Device \Driver\atapi \Device\Ide\IdePort0 8A5451F8
    Device \Driver\atapi \Device\Ide\IdePort1 8A5451F8
    Device \Driver\aerp9gp3 \Device\Scsi\aerp9gp31Port3Path0Target0Lun0 8A087500
    Device \Driver\aerp9gp3 \Device\Scsi\aerp9gp31 8A087500
    Device \FileSystem\Fastfat \Fat 8A4FB1F8

    AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

    Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \Device\00000071 -> \??\IDE#DiskST3802110AS_________________41N3273_LEN_3.AAH___#2020202020202020202020204C39315243464246#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- EOF - GMER 1.0.15 ----

    DDS (Ver_10-11-27.01) - FAT32x86
    Run by PC at 21:17:10.95 on 12/04/2010 Sat
    Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_22
    Microsoft Windows XP Professional 5.1.2600.2.936.86.1033.18.1982.1000 [GMT 0:00]

    AV: AVG Anti-Virus Free Edition 2011 *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    SVCHOST.EXE
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    SVCHOST.EXE
    SVCHOST.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\AVG\AVG10\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CMBCHINA\WebProtect\WPService.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\VM303_STI.EXE
    C:\Program Files\AVG\AVG10\avgtray.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\WINDOWS\system32\conime.exe
    C:\Program Files\AVG\AVG10\avgrsx.exe
    C:\Program Files\AVG\AVG10\avgnsx.exe
    C:\Program Files\AVG\AVG10\avgemcx.exe
    C:\Program Files\AVG\AVG10\avgcsrvx.exe
    C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
    C:\Program Files\AVG\AVG10\avgchsvx.exe
    C:\Program Files\AVG\AVG10\avgui.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ZONELABS\vsmon.exe
    C:\Documents and Settings\PC\My Documents\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.co.uk/
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer =
    uInternet Settings,ProxyOverride = *.local
    mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
    uWindows: load=?粑? ?
    BHO: {00C6482D-C502-44C8-8409-FCE54AD9C208} - No File
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: {53707962-6F74-2D53-2644-206D7942484F} - No File
    BHO: {53763D1D-9CA8-4C7C-9756-A8E6B8FC063B} - No File
    BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
    BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
    BHO: EndNote Web: {82d2e569-25a7-4e4d-9fa3-c5025b4b7912} - c:\program files\endnote web\ENWIEPlug.dll
    BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - No File
    BHO: {90760F64-1931-4AAC-8E2E-AB39AAC071E1} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No File
    TB: EndNote Web: {945c8270-a848-11d5-a805-00b0d092f45b} - c:\program files\endnote web\ENWIEPlug.dll
    TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
    TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
    TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
    EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - e:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [BigDog303] c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
    mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
    mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
    IE: Add to QQ Customized Emoticons
    IE: Add to QQ Customized Panel
    IE: Add to QQ Emotions
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: Send picture by MMS
    IE: Send Picture with QQ MMS
    IE: Upload to QQ Network Hard Disk
    IE: ìí?óμ?QQ±í?é
    IE: ìí?óμ?QQ±í?é
    IE: 添加到QQ表情 - c:\program files\tencent\qq\AddEmotion.htm
    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
    IE: {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - c:\microgaming\poker\ladbrokesmpp\MPPoker.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - e:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F}
    Trusted Zone: com.cn\mybank.icbc
    Trusted Zone: com.cn\www.icbc
    Trusted Zone: shanghaiexpat.com\jobs
    DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715}
    DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} - hxxps://site.cmbchina.com/download/CMBEdit.cab
    DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844}
    DPF: {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}
    DPF: {5CB840B5-A94E-4AD9-B785-4866E3B04476}
    DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} - hxxps://mybank.icbc.com.cn/icbc/NetSign.dll
    DPF: {7AEA10C5-B38F-4D72-A8F0-ED2D43D2A59E}
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://vip.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
    DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
    DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29}
    TCP: {7AE70460-E422-4A20-968E-B73A31413B8E} = 8.8.8.8,8.8.4.4
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    Hosts: 127.0.0.1 www.spywareinfo.com

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\
    FF - prefs.js: browser.startup.homepage - www.google.co.uk
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: c:\documents and settings\pc\application data\mozilla\firefox\profiles\8o6anw1j.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
    FF - plugin: c:\documents and settings\pc\application data\mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\documents and settings\pc\application data\mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: c:\documents and settings\pc\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npaliedit.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
    FF - plugin: c:\program files\veetle\player\npvlc.dll
    FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Extension: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
    FF - Extension: EndNote Web: {322e833a-a7d4-4277-97c6-334fa1622d6a} - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\{322e833a-a7d4-4277-97c6-334fa1622d6a}
    FF - Extension: Zotero: zotero@chnm.gmu.edu - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\zotero@chnm.gmu.edu

    ============= SERVICES / DRIVERS ===============

    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 249424]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 298448]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-3-23 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 67656]
    R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2006-12-21 532224]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2010-10-11 6104656]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-9-10 265400]
    R2 CMBWPS;Cmb WebProtect Support;c:\program files\cmbchina\webprotect\WPService.exe [2008-12-25 232848]
    R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\postgresql\8.3\bin\pg_ctl.exe [2008-9-19 65536]
    R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
    S2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\icbcebanktools\icbcantiphishing\IcbcDaemon.exe [2009-10-14 397184]
    S3 Alidevice;Alidevice;c:\windows\system32\drivers\alidevice.sys [2008-4-29 6656]
    S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\drivers\cnxetp.sys --> c:\windows\system32\drivers\CnxEtP.sys [?]
    S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\cnxetu.sys --> c:\windows\system32\drivers\CnxEtU.sys [?]
    S3 CnxTgNW;Conexant AccessRunner ADSL WAN PPPoA Adapter Driver;c:\windows\system32\drivers\cnxtgnw.sys --> c:\windows\system32\drivers\CnxTgNW.sys [?]
    S3 GKeyUSB;GKeyUSB;c:\windows\system32\drivers\GKeyUSB.sys [2007-9-7 62096]
    S3 Irisp2ht;irisp2ht.sys bulk pen driver;c:\windows\system32\drivers\irisp2ht.sys [2009-1-12 16516]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.188\McCHSvc.exe [2010-10-5 237008]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\27.tmp --> c:\windows\system32\27.tmp [?]
    S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 12872]
    S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2006-12-24 428160]

    =============== File Associations ===============

    chm.file="hh.exe" %1
    txtfile=c:\windows\notepad.exe %1

    =============== Created Last 30 ================

    2010-12-04 19:48:22 -------- d-----w- c:\docume~1\pc\applic~1\Malwarebytes
    2010-12-04 19:47:53 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-04 19:47:52 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-12-04 19:47:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-04 19:47:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-04 18:01:28 -------- d-sh--w- C:\FOUND.001
    2010-12-04 17:47:30 -------- d-sh--w- C:\FOUND.000
    2010-12-04 15:53:42 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2010-12-04 15:50:21 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
    2010-12-04 15:50:00 -------- d-----w- c:\program files\McAfee Security Scan
    2010-12-04 15:31:37 -------- d-----w- c:\docume~1\alluse~1\applic~1\F-Secure
    2010-12-04 15:10:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-12-02 14:15:30 -------- d-----w- c:\program files\HandHistory
    2010-11-28 22:19:22 -------- d-----w- C:\spoolerlogs
    2010-11-28 06:23:37 -------- d-----w- c:\program files\Veetle
    2010-11-24 23:51:41 -------- d-----w- c:\docume~1\pc\applic~1\Pyti
    2010-11-24 23:51:41 -------- d-----w- c:\docume~1\pc\applic~1\Hohi
    2010-11-23 18:30:06 -------- d-----w- c:\program files\iPod
    2010-11-23 18:30:02 -------- d-----w- c:\program files\iTunes
    2010-11-23 18:30:02 -------- d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-11-23 18:24:33 -------- d-----w- c:\program files\Bonjour
    2010-11-23 17:47:42 -------- d-----w- c:\docume~1\pc\applic~1\OpenOffice.org
    2010-11-23 17:41:57 -------- d-----w- c:\program files\JRE
    2010-11-23 17:41:51 -------- d-----w- c:\program files\OpenOffice.org 3
    2010-11-22 03:48:57 -------- d-----w- c:\docume~1\pc\locals~1\applic~1\TruePoker
    2010-11-22 03:46:15 -------- d-----w- c:\program files\TruePoker
    2010-11-17 04:04:36 -------- d-----w- c:\windows\system32\drivers\AVG
    2010-11-07 19:49:03 -------- d-----w- c:\docume~1\pc\applic~1\XPTpoker

    ==================== Find3M ====================

    2010-12-04 15:09:54 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-10-07 12:23:02 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-10-07 12:23:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2010-09-08 11:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 11:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts

    =================== ROOTKIT ====================

    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: ST3802110AS_________________41N3273_LEN rev.3.AAH -> Harddisk0\DR0 -> \Device\0000008e

    device: opened successfully
    user: MBR read successfully

    Disk trace:
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A2FCEC5]<<
    _asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x8827c872; SUB DWORD [EBP-0x4], 0x8827c12e; PUSH EDI; CALL 0xffffffffffffdf33; }
    1 ntkrnlpa!IofCallDriver[0x804EDFEA] -> \Device\Harddisk0\DR0[0x8A45CAB8]
    3 CLASSPNP[0xBA8E905B] -> ntkrnlpa!IofCallDriver[0x804EDFEA] -> \Device\00000072[0x8A4BA908]
    5 ACPI[0xBA666620] -> ntkrnlpa!IofCallDriver[0x804EDFEA] -> [0x8A45C030]
    [0x8A465F38] -> IRP_MJ_CREATE -> 0x8A2FCEC5
    error: Read Incorrect function.
    kernel: MBR read successfully
    _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
    detected disk devices:
    \Device\00000071 -> \??\IDE#DiskST3802110AS_________________41N3273_LEN_3.AAH___#2020202020202020202020204C39315243464246#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
    detected hooks:
    \Driver\atapi -> 0x8a5451f8
    user & kernel MBR OK
    Warning: possible TDL3 rootkit infection !

    ============= FINISH: 21:21:55.04 ===============

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-11-27.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/21/2006 9:59:25 AM
    System Uptime: 12/4/2010 8:34:25 PM (1 hours ago)

    Motherboard: PCCHIPS | | A13G
    Processor: AMD Sempron(tm) Processor 3200+ | Socket M2 | 1808/201mhz

    ==== Disk Partitions =========================

    C: is FIXED (FAT32) - 16 GiB total, 2.702 GiB free.
    D: is FIXED (FAT32) - 29 GiB total, 1.368 GiB free.
    E: is FIXED (FAT32) - 29 GiB total, 2.929 GiB free.
    F: is CDROM ()
    H: is CDROM ()
    J: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID:
    Description:
    Device ID: ROOT\LEGACY_UDFS\SYSTEM
    Manufacturer:
    Name:
    PNP Device ID: ROOT\LEGACY_UDFS\SYSTEM
    Service:

    ==== System Restore Points ===================

    RP1: 12/4/2010 8:24:15 PM - System Checkpoint

    ==== Installed Programs ======================

    ?§??±|°2è????t 1,1,0,1
    32 Bit HP CIO Components Installer
    50 FREE MP3s +1 Free Audiobook!
    888poker.net
    Adobe Download Manager
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 9 ActiveX
    Adobe Flash Player ActiveX
    Adobe Reader 8.1.4
    Adobe Shockwave Player 11.5
    Adobe? Photoshop? Album Starter Edition 3.0
    Alipay security control 2,4,0,1
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AudibleManager
    AVG 2011
    B109a-m
    Bonjour
    BufferChm
    Chinese Simplified Fonts Support For Adobe Reader 8
    Creative Software AutoUpdate
    Creative System Information
    Creative ZEN
    CyberTweak Version 1.3 Final
    D1300_Help
    Dafa Poker
    Destinations
    DeviceDiscovery
    DoubleRing Pc Camera (Vimicro301 Neptune)
    EndNote Web
    Everest Poker (Remove Only)
    Flickr Uploadr 3.0.5
    Free Mp3 Wma Converter V 1.9
    FreshDiagnose
    GemSafe OEM Edition 5.0 for China
    Google Chrome
    Google Talk Plugin
    GPBaseService2
    High Definition Audio Driver Package - KB888111
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB926239)
    Hotfix for Windows XP (KB935448)
    HP Customer Participation Program 14.0
    HP Imaging Device Functions 14.0
    HP Photosmart B109a-m All-in-One Driver Software 14.0 Rel. 6
    HP Smart Web Printing 4.60
    HP Solution Center 14.0
    HP Update
    hph_readme
    hph_software_req
    HPProductAssistant
    HPSSupply
    ICBC install (goldpac personal version)
    ICBC Token CSP - Goldpac 2007
    icbc_netbank_client_controls
    InFlac 1.1.1
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 22
    LEAD MCMP_MJPEG Codec Eval
    Malwarebytes' Anti-Malware
    MarketResearch
    McAfee Security Scan Plus
    Microsoft .NET Framework 2.0
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Live Add-in 1.3
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    MobileMe Control Panel
    Mozilla Firefox (3.6.12)
    Mozilla Thunderbird (2.0.0.23)
    MSVCRT
    NVIDIA Drivers
    On-line Help Console
    OpenOffice.org 3.2
    PokerStove version 1.23
    PokerTracker 3 (remove only)
    PostgreSQL 8.3
    PowerDVD
    PS_AIO_06_B109a-m_SW_Min
    QuickTime
    QuickTransfer
    RealPlayer
    Realtek High Definition Audio Driver
    ResearchSoft Direct Export Helper
    Scan
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901190)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923694)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925454)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937894)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944338)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Segoe UI
    Shop for HP Supplies
    Skype web features
    Skype? 4.2
    SmartWebPrinting
    SnagIt 8
    SolutionCenter
    Sophos Anti-Rootkit 1.5.4
    SOSO AddressBar Search
    Spybot - Search & Destroy
    Status
    Storm Codec
    StormPlayer
    SUPERAntiSpyware Free Edition
    Toolbox
    TrayApp
    TruePoker (High Res)
    Update for Windows XP (KB894391)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB904942)
    Update for Windows XP (KB908531)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB911280)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    VC 9.0 Runtime
    Veetle TV 0.9.18
    VJOcx2.0
    WebFldrs XP
    WebReg
    Winamp
    Winamp Application Detect
    Winamp Toolbar
    Windows Imaging Component
    Windows Installer 3.1 (KB893803)
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB885884
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB891781
    WinRAR archiver
    XPTpoker
    ZEN Media Explorer
    ZENcast Organizer
    ZoneAlarm
    μTorrent
    中国工商银行防钓鱼软件
    工行IE浏览器安全插件
    招商银行一网通网盾
    支付宝插件 1.2.0.2

    ==== Event Viewer Messages From Past Week ========

    12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Workstation service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Wireless Zero Configuration service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The HID Input Service service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:46 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/4/2010 8:19:46 PM, error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 6000 milliseconds: Restart the service.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Windows Audio service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Logical Disk Manager service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Error Reporting Service service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The DHCP Client service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 8:19:45 PM, error: Service Control Manager [7031] - The Help and Support service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the NVIDIA Display Driver Service service to connect.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The System Event Notification service failed to start due to the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The NVIDIA Display Driver Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The pipe state is invalid.
    12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The pipe state is invalid.
    12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Cmb WebProtect Support service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
    12/4/2010 6:07:06 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
    11/30/2010 5:55:35 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
    11/30/2010 5:54:47 PM, error: Service Control Manager [7034] - The ICBC Daemon Service service terminated unexpectedly. It has done this 1 time(s).
    11/30/2010 5:53:10 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    11/30/2010 5:53:10 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
    11/30/2010 3:21:29 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'javacpl.cpl' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    11/30/2010 2:58:22 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    11/28/2010 3:22:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    11/28/2010 3:07:51 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    11/28/2010 12:46:54 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx86 Avgmfx86 Avgtdix Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss SASDIFSV SASKUTIL Tcpip vsdatant
    11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the vsdatant service which failed to start because of the following error: A device attached to the system is not functioning.
    11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    11/28/2010 11:59:55 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\mfc40.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 4.1.0.6140.
    11/28/2010 10:20:19 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    11/27/2010 2:32:16 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

    ==== End Of File ===========================
     
  2. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =========================================================================

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

    ======================================================================

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.
     
  3. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Hi Broni, thanks for the quick reply

    TDSSKiller ran fine:

    2010/12/05 06:57:38.0625 TDSS rootkit removing tool 2.4.10.1 Dec 2 2010 12:28:01
    2010/12/05 06:57:38.0625 ================================================================================
    2010/12/05 06:57:38.0625 SystemInfo:
    2010/12/05 06:57:38.0625
    2010/12/05 06:57:38.0625 OS Version: 5.1.2600 ServicePack: 2.0
    2010/12/05 06:57:38.0625 Product type: Workstation
    2010/12/05 06:57:38.0625 ComputerName: DESKTOP
    2010/12/05 06:57:38.0625 UserName: PC
    2010/12/05 06:57:38.0625 Windows directory: C:\WINDOWS
    2010/12/05 06:57:38.0625 System windows directory: C:\WINDOWS
    2010/12/05 06:57:38.0625 Processor architecture: Intel x86
    2010/12/05 06:57:38.0625 Number of processors: 1
    2010/12/05 06:57:38.0625 Page size: 0x1000
    2010/12/05 06:57:38.0625 Boot type: Normal boot
    2010/12/05 06:57:38.0625 ================================================================================
    2010/12/05 06:57:40.0000 Initialize success
    2010/12/05 06:57:53.0421 ================================================================================
    2010/12/05 06:57:53.0421 Scan started
    2010/12/05 06:57:53.0421 Mode: Manual;
    2010/12/05 06:57:53.0421 ================================================================================
    2010/12/05 06:57:53.0984 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2010/12/05 06:57:54.0078 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2010/12/05 06:57:54.0421 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
    2010/12/05 06:57:54.0546 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
    2010/12/05 06:57:55.0281 ALCXWDM (c881453898eec64027274ebb3c8cbc0f) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
    2010/12/05 06:57:55.0578 Alidevice (2f17c06cda54bfbe13c4046b19055f7b) C:\WINDOWS\system32\drivers\Alidevice.sys
    2010/12/05 06:57:56.0984 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2010/12/05 06:57:57.0140 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2010/12/05 06:57:57.0500 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2010/12/05 06:57:57.0640 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2010/12/05 06:57:57.0828 AVGIDSDriver (0c61f066f4d94bd67063dc6691935143) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
    2010/12/05 06:57:57.0953 AVGIDSEH (84853f800cd69252c3c764fe50d0346f) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
    2010/12/05 06:57:58.0140 AVGIDSFilter (28d6adcd03e10f3838488b9b5d407dd4) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
    2010/12/05 06:57:58.0328 AVGIDSShim (0eb16f4dbbb946360af30d2b13a52d1d) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
    2010/12/05 06:57:58.0437 Avgldx86 (1119e5bec6e749e0d292f0f84d48edba) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
    2010/12/05 06:57:58.0546 Avgmfx86 (54f1a9b4c9b540c2d8ac4baa171696b1) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
    2010/12/05 06:57:58.0671 Avgrkx86 (8da3b77993c5f354cc2977b7ea06d03a) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
    2010/12/05 06:57:58.0828 Avgtdix (2fd3e3a57fb90679a3a83eeed0360cfd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
    2010/12/05 06:57:58.0937 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2010/12/05 06:57:59.0078 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2010/12/05 06:57:59.0281 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2010/12/05 06:57:59.0406 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
    2010/12/05 06:57:59.0500 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2010/12/05 06:58:00.0859 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
    2010/12/05 06:58:01.0031 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
    2010/12/05 06:58:01.0250 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
    2010/12/05 06:58:01.0328 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2010/12/05 06:58:01.0484 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
    2010/12/05 06:58:01.0812 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
    2010/12/05 06:58:01.0953 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
    2010/12/05 06:58:02.0078 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2010/12/05 06:58:02.0156 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
    2010/12/05 06:58:02.0265 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2010/12/05 06:58:02.0406 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
    2010/12/05 06:58:02.0546 FreshIO (caac750e6d27866c28494e0de9fa802a) C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys
    2010/12/05 06:58:02.0625 FsVga (455f778ee14368468560bd7cb8c854d0) C:\WINDOWS\system32\DRIVERS\fsvga.sys
    2010/12/05 06:58:02.0703 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2010/12/05 06:58:02.0781 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2010/12/05 06:58:02.0984 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
    2010/12/05 06:58:03.0218 GKeyUSB (77fb124224c2eb99a411459af0e88c7d) C:\WINDOWS\system32\Drivers\GKeyUSB.sys
    2010/12/05 06:58:03.0328 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2010/12/05 06:58:03.0531 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    2010/12/05 06:58:03.0687 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2010/12/05 06:58:03.0984 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
    2010/12/05 06:58:04.0171 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
    2010/12/05 06:58:04.0328 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
    2010/12/05 06:58:04.0421 HTTP (cb77bb47e67e84deb17ba29632501730) C:\WINDOWS\system32\Drivers\HTTP.sys
    2010/12/05 06:58:04.0812 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2010/12/05 06:58:04.0937 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2010/12/05 06:58:05.0406 IntcAzAudAddService (001aaca6ed0e6b00fc5b8faf74977e81) C:\WINDOWS\system32\drivers\RtkHDAud.sys
    2010/12/05 06:58:05.0687 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
    2010/12/05 06:58:05.0765 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2010/12/05 06:58:05.0875 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2010/12/05 06:58:06.0000 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2010/12/05 06:58:06.0203 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2010/12/05 06:58:06.0312 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2010/12/05 06:58:06.0546 Irisp2ht (0f5361f9d0742820be856df605202716) C:\WINDOWS\system32\Drivers\IRISP2HT.sys
    2010/12/05 06:58:06.0640 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2010/12/05 06:58:06.0765 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2010/12/05 06:58:06.0937 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
    2010/12/05 06:58:07.0062 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
    2010/12/05 06:58:09.0218 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2010/12/05 06:58:09.0343 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
    2010/12/05 06:58:09.0468 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2010/12/05 06:58:09.0640 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2010/12/05 06:58:09.0734 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
    2010/12/05 06:58:10.0125 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2010/12/05 06:58:10.0250 MRxSmb (025af03ce51645c62f3b6907a7e2be5e) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2010/12/05 06:58:10.0390 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
    2010/12/05 06:58:10.0562 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2010/12/05 06:58:10.0703 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2010/12/05 06:58:10.0859 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
    2010/12/05 06:58:10.0984 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2010/12/05 06:58:11.0125 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
    2010/12/05 06:58:11.0234 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
    2010/12/05 06:58:11.0421 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2010/12/05 06:58:11.0515 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
    2010/12/05 06:58:11.0687 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2010/12/05 06:58:11.0765 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2010/12/05 06:58:11.0890 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2010/12/05 06:58:12.0000 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2010/12/05 06:58:12.0093 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
    2010/12/05 06:58:12.0203 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2010/12/05 06:58:12.0312 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2010/12/05 06:58:12.0453 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
    2010/12/05 06:58:12.0687 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
    2010/12/05 06:58:12.0859 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2010/12/05 06:58:13.0109 nv (15a6306a0b958bf60f09688d0ee70479) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2010/12/05 06:58:13.0453 nvata (9eccd189a9554c30a0d18a429778c7ba) C:\WINDOWS\system32\DRIVERS\nvata.sys
    2010/12/05 06:58:13.0578 NVENETFD (4d6f0d3fb17c1ba64942f415c73adcdb) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
    2010/12/05 06:58:13.0734 nvnetbus (921e63aa1e1a20302223d016acafb52b) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
    2010/12/05 06:58:13.0828 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2010/12/05 06:58:13.0906 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2010/12/05 06:58:14.0015 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
    2010/12/05 06:58:14.0093 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
    2010/12/05 06:58:14.0187 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2010/12/05 06:58:14.0328 PCI (f1c905282a80256793c0e3d0edcd1d5c) C:\WINDOWS\system32\DRIVERS\pci.sys
    2010/12/05 06:58:14.0328 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pci.sys. Real md5: f1c905282a80256793c0e3d0edcd1d5c, Fake md5: 8086d9979234b603ad5bc2f5d890b234
    2010/12/05 06:58:14.0328 PCI - detected Rootkit.Win32.TDSS.tdl3 (0)
    2010/12/05 06:58:14.0546 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2010/12/05 06:58:14.0703 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2010/12/05 06:58:15.0859 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2010/12/05 06:58:15.0984 Processor (0d97d88720a4087ec93af7dbb303b30a) C:\WINDOWS\system32\DRIVERS\processr.sys
    2010/12/05 06:58:16.0078 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
    2010/12/05 06:58:16.0187 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2010/12/05 06:58:16.0328 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    2010/12/05 06:58:17.0203 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2010/12/05 06:58:17.0296 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2010/12/05 06:58:17.0437 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2010/12/05 06:58:17.0515 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2010/12/05 06:58:17.0671 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2010/12/05 06:58:17.0765 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2010/12/05 06:58:17.0906 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2010/12/05 06:58:18.0078 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
    2010/12/05 06:58:18.0250 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2010/12/05 06:58:18.0468 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    2010/12/05 06:58:18.0625 SASENUM (7ce61c25c159f50f9eaf6d77fc83fa35) C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
    2010/12/05 06:58:18.0796 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
    2010/12/05 06:58:18.0984 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2010/12/05 06:58:19.0093 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2010/12/05 06:58:19.0203 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
    2010/12/05 06:58:19.0328 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2010/12/05 06:58:19.0656 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2010/12/05 06:58:19.0937 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
    2010/12/05 06:58:20.0156 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
    2010/12/05 06:58:20.0156 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
    2010/12/05 06:58:20.0156 sptd - detected Locked file (1)
    2010/12/05 06:58:20.0265 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
    2010/12/05 06:58:22.0093 Srv (ea554a3ffc3f536fe8320eb38f5e4843) C:\WINDOWS\system32\DRIVERS\srv.sys
    2010/12/05 06:58:22.0265 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2010/12/05 06:58:22.0375 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2010/12/05 06:58:22.0562 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
    2010/12/05 06:58:23.0671 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
    2010/12/05 06:58:23.0843 tap0901 (66cbe7e7ef1b23c71f9402285878b284) C:\WINDOWS\system32\DRIVERS\tap0901.sys
    2010/12/05 06:58:24.0015 Tcpip (90caff4b094573449a0872a0f919b178) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2010/12/05 06:58:24.0187 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2010/12/05 06:58:24.0312 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
    2010/12/05 06:58:24.0437 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2010/12/05 06:58:24.0765 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
    2010/12/05 06:58:25.0062 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
    2010/12/05 06:58:25.0218 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\WINDOWS\system32\Drivers\usbaapl.sys
    2010/12/05 06:58:25.0390 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
    2010/12/05 06:58:25.0546 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2010/12/05 06:58:25.0687 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2010/12/05 06:58:25.0812 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2010/12/05 06:58:25.0937 usbohci (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS\system32\DRIVERS\usbohci.sys
    2010/12/05 06:58:26.0078 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2010/12/05 06:58:26.0234 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2010/12/05 06:58:26.0375 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2010/12/05 06:58:26.0484 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
    2010/12/05 06:58:26.0875 vmfilter303 (233509e1ad024a3e451d8df6795eeed5) C:\WINDOWS\system32\drivers\vmfilter303.sys
    2010/12/05 06:58:27.0062 vncmirror (3b8f222b23917c041e4da29ccc57e7d0) C:\WINDOWS\system32\DRIVERS\vncmirror.sys
    2010/12/05 06:58:27.0156 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
    2010/12/05 06:58:27.0687 vsdatant (050c38ebb22512122e54b47dc278bccd) C:\WINDOWS\system32\vsdatant.sys
    2010/12/05 06:58:27.0859 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2010/12/05 06:58:28.0109 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
    2010/12/05 06:58:28.0343 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
    2010/12/05 06:58:28.0531 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2010/12/05 06:58:28.0703 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2010/12/05 06:58:28.0921 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    2010/12/05 06:58:29.0156 ZSMC303 (4ebe2b569ea7311a883f9d1bd79abcd3) C:\WINDOWS\system32\Drivers\usbVM303.sys
    2010/12/05 06:58:29.0296 ================================================================================
    2010/12/05 06:58:29.0296 Scan finished
    2010/12/05 06:58:29.0296 ================================================================================
    2010/12/05 06:58:29.0328 Detected object count: 2
    2010/12/05 06:59:37.0484 PCI (f1c905282a80256793c0e3d0edcd1d5c) C:\WINDOWS\system32\DRIVERS\pci.sys
    2010/12/05 06:59:37.0484 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pci.sys. Real md5: f1c905282a80256793c0e3d0edcd1d5c, Fake md5: 8086d9979234b603ad5bc2f5d890b234
    2010/12/05 06:59:37.0718 Backup copy found, using it..
    2010/12/05 06:59:37.0734 C:\WINDOWS\system32\DRIVERS\pci.sys - will be cured after reboot
    2010/12/05 06:59:37.0734 Rootkit.Win32.TDSS.tdl3(PCI) - User select action: Cure
    2010/12/05 06:59:37.0734 Locked file(sptd) - User select action: Skip
    2010/12/05 06:59:42.0312 Deinitialize success


    MBRCheck started ok but then froze up. Didn't respond to N, wouldn't close and wouldn't respond to ctrl/alt/delete so had to use reset button. Log (interrupted?) is:

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000023c

    Kernel Drivers (total 128):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806CE000 \WINDOWS\system32\hal.dll
    0xBADA8000 \WINDOWS\system32\KDCOM.DLL
    0xBACB8000 \WINDOWS\system32\BOOTVID.dll
    0xBA795000 klmdb.sys
    0xBA694000 spzo.sys
    0xBADAA000 \WINDOWS\System32\Drivers\WMILIB.SYS
    0xBA67C000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
    0xBA64E000 ACPI.sys
    0xBA63D000 tsk9.tmp
    0xBA8A8000 isapnp.sys
    0xBAE70000 pciide.sys
    0xBAB28000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xBA8B8000 MountMgr.sys
    0xBA61E000 ftdisk.sys
    0xBADAC000 dmload.sys
    0xBA5F8000 dmio.sys
    0xBAB30000 PartMgr.sys
    0xBA8C8000 VolSnap.sys
    0xBA5E0000 atapi.sys
    0xBA5C6000 nvata.sys
    0xBA8D8000 disk.sys
    0xBA8E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xBA5A6000 fltMgr.sys
    0xBA594000 sr.sys
    0xBA8F8000 PxHelp20.sys
    0xBA571000 Fastfat.sys
    0xBA55A000 KSecDD.sys
    0xBA547000 WudfPf.sys
    0xBA51A000 NDIS.sys
    0xBA4FF000 Mup.sys
    0xBAB38000 avgrkx86.sys
    0xBA908000 AVGIDSEH.Sys
    0xBA9C8000 \SystemRoot\system32\DRIVERS\processr.sys
    0xBAC08000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0xBA494000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xBAC10000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xBA46F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0xBA9D8000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xBA9E8000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xBA44C000 \SystemRoot\system32\DRIVERS\ks.sys
    0xBAC18000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0xBA9F8000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
    0xBA330000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
    0xB9F69000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
    0xB9F55000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xBAC20000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xBAA08000 \SystemRoot\system32\DRIVERS\serial.sys
    0xBAD50000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xB9F41000 \SystemRoot\system32\DRIVERS\parport.sys
    0xBAA18000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xBAC28000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xBAC30000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xBAD54000 \SystemRoot\system32\DRIVERS\fsvga.sys
    0xBAF92000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xBAA28000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xBAD58000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xB9F2A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xBAA38000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xBAA48000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xBAC38000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xB9F19000 \SystemRoot\system32\DRIVERS\psched.sys
    0xBAA58000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xBAC40000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xBAC48000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xB9EE8000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xBAA68000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xBADAE000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xB9E8C000 \SystemRoot\system32\DRIVERS\update.sys
    0xBAD70000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xBAA78000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xBAA88000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xBADB0000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xB993C000 \SystemRoot\system32\drivers\RtkHDAud.sys
    0xB991A000 \SystemRoot\system32\drivers\portcls.sys
    0xBAA98000 \SystemRoot\system32\drivers\drmk.sys
    0xBAAA8000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
    0xBAAD8000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
    0xBAC58000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xBADB4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xBAEC4000 \SystemRoot\System32\Drivers\Null.SYS
    0xBAC68000 \SystemRoot\System32\drivers\vga.sys
    0xBADB6000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xBADB8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xBAC70000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xBAC78000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xBA4B7000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xB730D000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xB72B5000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xB726D000 \SystemRoot\system32\DRIVERS\avgtdix.sys
    0xB7245000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xB71C4000 \SystemRoot\System32\vsdatant.sys
    0xB71A2000 \SystemRoot\System32\drivers\afd.sys
    0xBAAE8000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xB7180000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
    0xB7097000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xBA998000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xB9ED4000 \SystemRoot\system32\DRIVERS\usbscan.sys
    0xBAC80000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0xB706C000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xB6FFD000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xBA9B8000 \SystemRoot\System32\Drivers\Fips.SYS
    0xBAC88000 \SystemRoot\system32\DRIVERS\usbprint.sys
    0xBAC90000 \SystemRoot\system32\DRIVERS\HPZius12.sys
    0xBAC98000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0xB6FC1000 \SystemRoot\system32\DRIVERS\avgldx86.sys
    0xB9E5C000 \SystemRoot\system32\DRIVERS\HPZid412.sys
    0xB9DE8000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
    0xBAAF8000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xB6F2F000 \SystemRoot\System32\Drivers\dump_nvata.sys
    0xBAE1E000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xB6FAD000 \SystemRoot\System32\drivers\Dxapi.sys
    0xBAB68000 \SystemRoot\System32\watchdog.sys
    0xBF9C3000 \SystemRoot\System32\drivers\dxg.sys
    0xBAFFA000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF9D5000 \SystemRoot\System32\nv4_disp.dll
    0xB5EFE000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xB53B9000 \SystemRoot\system32\drivers\wdmaud.sys
    0xB5486000 \SystemRoot\system32\drivers\sysaudio.sys
    0xB5185000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xBADBA000 \SystemRoot\System32\Drivers\ParVdm.SYS
    0xB5DB6000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
    0xB4E13000 \SystemRoot\system32\DRIVERS\srv.sys
    0xB4EDD000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
    0xB4CFB000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
    0xB48A7000 \SystemRoot\System32\Drivers\HTTP.sys
    0x7C900000 \WINDOWS\System32\ntdll.dll

    Processes (total 60):
    0 System Idle Process
    4 System
    644 C:\WINDOWS\system32\SMSS.EXE
    692 C:\Program Files\AVG\AVG10\AVGCHSVX.EXE
    868 CSRSS.EXE
    892 C:\WINDOWS\system32\WINLOGON.EXE
    940 C:\WINDOWS\system32\SERVICES.EXE
    952 C:\WINDOWS\system32\LSASS.EXE
    1108 C:\WINDOWS\system32\SVCHOST.EXE
    1156 SVCHOST.EXE
    1244 C:\WINDOWS\system32\SVCHOST.EXE
    1284 C:\WINDOWS\system32\SVCHOST.EXE
    1392 SVCHOST.EXE
    1472 SVCHOST.EXE
    1520 C:\WINDOWS\system32\ZoneLabs\VSMON.EXE
    1812 C:\WINDOWS\EXPLORER.EXE
    448 C:\WINDOWS\system32\SPOOLSV.EXE
    484 SCARDSVR.EXE
    852 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    856 C:\Program Files\AVG\AVG10\AVGWDSVC.EXE
    1020 C:\Program Files\Bonjour\mDNSResponder.exe
    1088 C:\Program Files\CMBCHINA\WebProtect\WPService.exe
    1220 C:\WINDOWS\system32\CTSVCCDA.EXE
    1428 C:\WINDOWS\system32\SVCHOST.EXE
    1924 C:\Program Files\Java\jre6\bin\jqs.exe
    1308 C:\Program Files\AVG\AVG10\AVGNSX.EXE
    1948 C:\Program Files\AVG\AVG10\AVGEMCX.EXE
    1140 C:\WINDOWS\system32\SVCHOST.EXE
    1460 C:\WINDOWS\system32\nvsvc32.exe
    2132 pg_ctl.exe
    2188 C:\WINDOWS\system32\SVCHOST.EXE
    2224 C:\WINDOWS\system32\SVCHOST.EXE
    2384 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    2508 postgres.exe
    2660 postgres.exe
    2748 postgres.exe
    2756 postgres.exe
    2764 postgres.exe
    2772 postgres.exe
    3252 C:\WINDOWS\system32\wscntfy.exe
    3520 alg.exe
    2012 C:\WINDOWS\system32\SVCHOST.EXE
    2856 C:\WINDOWS\system32\wuauclt.exe
    3928 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    3960 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    4040 C:\WINDOWS\RTHDCPL.EXE
    4080 C:\WINDOWS\VM303_STI.exe
    264 C:\Program Files\AVG\AVG10\avgtray.exe
    660 C:\WINDOWS\system32\rundll32.exe
    1404 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    1488 C:\WINDOWS\system32\ctfmon.exe
    2892 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
    1632 C:\WINDOWS\NOTEPAD.EXE
    2844 C:\Program Files\Mozilla Firefox\firefox.exe
    2296 C:\Program Files\Mozilla Firefox\plugin-container.exe
    3548 C:\Documents and Settings\PC\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
    1064 C:\Program Files\AVG\AVG10\AVGRSX.EXE
    3440 C:\Program Files\AVG\AVG10\avgcsrvx.exe
    3784 C:\Documents and Settings\PC\Desktop\MBRCheck.exe
    2960 C:\WINDOWS\system32\conime.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000003`fbc0be00 (FAT32)
    \\.\E: --> \\.\PhysicalDrive0 at offset 0x0000000b`4f042000 (FAT32)

    PhysicalDrive0 Model Number: ST3802110AS41N3273LEN, Rev: 3.AAH

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0
     
  4. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Forgot to mention that search engines seem to be working ok now (although I have thought that before and then they started redirecting again)
     
  5. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Spoke too soon, it's still redirecting a bit to other search pages (asktofriends) but not as much as before
     
  6. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
     
  7. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Not sure if I've posted this already or not. It's not appearing on the thread but keep getting a duplicated post message?!

    Anyway, here's the log...

    Bootkit Remover
    (c) 2009 eSage Lab
    www.esagelab.com

    Program version: 1.2.0.0
    OS Version: Microsoft Windows XP Professional Service Pack 2 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
    ATA_Read(): DeviceIoControl() ERROR 1
    Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


    Done;
    Press any key to quit...
     
  8. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    That looks good :)

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AVG Remover to uninstall it: http://www.avg.com/us-en/download-tools
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.pif
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  9. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    I got the combofix scan to run second time. First time it seemed to freeze.

    One slight problem is that it ran in chinese (I bought my computer in China with English Windows) I've tried to translate the bits that came through in chinese as you will see below. Let me know if the translations don't make sense.

    Thanks

    ComboFix 10-12-04.02 - PC 5/2010 Sun 19:19:54.2.1 - FAT32x86
    Microsoft Windows XP Professional 5.1.2600.2.936.86.1033.18.1982.1535 [GMT 0:00]
    执行位置#execution location#: c:\documents and settings\PC\Desktop\ComboFix.exe
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .

    ((((((((((((((((((((((((((((((((((((((( 被删除的档案 #deleted files/folders# )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- 早前运行的结果 #previous results#-------
    .
    c:\documents and settings\PC\Application Data\Dados
    c:\documents and settings\PC\Application Data\Dados\veudq.ivo
    c:\documents and settings\PC\Application Data\Hohi
    c:\documents and settings\PC\Application Data\Hohi\awenc.pim

    .
    ((((((((((((((((((((((((( #from# 2010-11-05 至#until# 2010-12-05 的新的档案 #new files# )))))))))))))))))))))))))))))))
    .

    2010-12-04 19:48 . 2010-12-04 19:48 -------- d-----w- c:\documents and settings\PC\Application Data\Malwarebytes
    2010-12-04 19:47 . 2010-11-29 17:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-04 19:47 . 2010-12-04 19:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-12-04 19:47 . 2010-11-29 17:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-04 19:47 . 2010-12-04 19:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-04 18:01 . 2010-12-04 18:01 -------- d-----w- C:\FOUND.001
    2010-12-04 17:47 . 2010-12-04 17:47 -------- d-----w- C:\FOUND.000
    2010-12-04 15:53 . 2010-09-06 09:26 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2010-12-04 15:50 . 2010-12-04 15:50 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
    2010-12-04 15:50 . 2010-12-04 15:50 -------- d-----w- c:\program files\McAfee Security Scan
    2010-12-04 15:31 . 2010-12-04 15:31 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure
    2010-12-04 15:19 . 2010-12-04 15:19 -------- d-----w- c:\program files\Common Files\Java
    2010-12-04 15:10 . 2010-12-04 15:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-12-02 14:15 . 2010-12-02 14:15 -------- d-----w- c:\program files\HandHistory
    2010-11-28 22:19 . 2010-11-28 22:19 -------- d-----w- C:\spoolerlogs
    2010-11-28 06:23 . 2010-11-28 06:23 -------- d-----w- c:\program files\Veetle
    2010-11-24 23:51 . 2010-11-24 23:51 -------- d-----w- c:\documents and settings\PC\Application Data\Pyti
    2010-11-23 18:30 . 2010-11-23 18:30 -------- d-----w- c:\program files\iPod
    2010-11-23 18:30 . 2010-11-23 18:30 -------- d-----w- c:\program files\iTunes
    2010-11-23 18:30 . 2010-11-23 18:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-11-23 18:24 . 2010-11-23 18:24 -------- d-----w- c:\program files\Bonjour
    2010-11-23 17:47 . 2010-11-23 17:47 -------- d-----w- c:\documents and settings\PC\Application Data\OpenOffice.org
    2010-11-23 17:41 . 2010-11-23 17:41 -------- d-----w- c:\program files\JRE
    2010-11-23 17:41 . 2010-11-23 17:41 -------- d-----w- c:\program files\OpenOffice.org 3
    2010-11-22 03:48 . 2010-11-22 03:48 -------- d-----w- c:\documents and settings\PC\Local Settings\Application Data\TruePoker
    2010-11-22 03:46 . 2010-11-22 03:46 -------- d-----w- c:\program files\TruePoker
    2010-11-07 19:49 . 2010-11-07 19:49 -------- d-----w- c:\documents and settings\PC\Application Data\XPTpoker

    .
    (((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 #Find 3M report# ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-05 07:00 . 2004-08-04 12:00 68224 ----a-w- c:\windows\system32\drivers\pci.sys
    2010-12-04 15:09 . 2010-05-31 19:00 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-10-07 12:23 . 2010-10-07 12:23 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-10-07 12:23 . 2010-10-07 12:23 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2010-09-08 11:17 . 2010-09-08 11:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 11:17 . 2010-09-08 11:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
    .

    ((((((((((((((((((((((((((((( SnapShot@2010-12-05_19.08.50 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2010-12-05 19:16 . 2010-12-05 19:16 16384 c:\windows\Temp\Perflib_Perfdata_728.dat
    .
    ((((((((((((((((((((((((((((((((((((( 重要登入点 #reg loading points# ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *注意* 空白与合法缺省登录将不会被显示 #attention: blank or legitimately default login cannot be displayed#
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-09-26 2356088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]
    "BigDog303"="c:\windows\VM303_STI.EXE" [2006-02-27 61440]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-18 08:38 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    [BU]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
    backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
    backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SnagIt 8.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SnagIt 8.lnk
    backup=c:\windows\pss\SnagIt 8.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^PC^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
    path=c:\documents and settings\PC\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
    backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^PC^Start Menu^Programs^Startup^腾讯QQ.lnk]
    path=c:\documents and settings\PC\Start Menu\Programs\Startup\腾讯QQ.lnk
    backup=c:\windows\pss\腾讯QQ.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
    ?粑?
    ? [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
    ?粑?
    ? [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CnxDslTaskBar]
    c:\program files\Conexant\AccessRunner ADSL USB\CnxDslTb.exe Conexant\AccessRunner ADSL USB [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
    2005-06-06 23:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    2005-05-03 18:43 69632 ------r- c:\windows\Alcmtr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
    2010-04-13 02:29 47392 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreativeTaskScheduler]
    2006-11-17 09:42 53341 ------w- c:\program files\Creative\Shared Files\CTSched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTCheck]
    2007-11-06 11:08 397312 ------w- e:\zen media explorer\CTCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
    2007-07-17 11:03 868352 ------w- c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    2007-04-04 06:29 165784 ----a-w- c:\program files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gemplus Reader Resource Manager]
    2007-10-08 16:17 77824 ----a-w- c:\program files\ICBCEbankTools\Gemplus\GemSafe Libraries\BIN\RRMSVR.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gemstrmw]
    2007-06-29 11:44 24576 ------w- c:\windows\system32\gemstrmw.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google IME Autoupdater]
    c:\program files\Google\Google Pinyin\GooglePinyinDaemon.exe [BU]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
    2008-09-06 10:07 133104 ----a-w- c:\documents and settings\PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2009-11-18 16:13 54576 ----a-w- e:\program files\HP\HP Software Update\hpwuschd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    2004-08-04 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-11-17 20:59 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    2004-08-04 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    2006-08-16 15:35 1617920 ----a-w- c:\windows\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-09-08 11:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regtool]
    2008-01-21 15:28 172032 ----a-w- c:\program files\ICBCEbankTools\Gemplus\GemSafe Libraries\BIN\RegTool.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
    2006-05-16 18:04 2879488 ------r- c:\windows\SkyTel.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    2009-03-05 16:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
    2006-11-26 10:30 97357 ----a-w- c:\program files\Ringz Studio\Storm Codec\StormSet.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stup.exe]
    c:\progra~1\TENCENT\SSPlus\SPlus1.dll [BU]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
    2010-12-04 12:14 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2006-12-24 20:28 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
    c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe [BU]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "usnjsvc"=3 (0x3)
    "aawservice"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Messenger\\MSMSGS.EXE"=
    "c:\\Program Files\\uTorrent\\utorrent.exe"=
    "c:\\Program Files\\ì?±|í?\\ì?±|íúíú\\WangWang.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Documents and Settings\\PC\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
    "c:\\WINDOWS\\System32\\ZoneLabs\\vsmon.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
    "e:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/3/2007 6:26 AM 721904]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [3/23/2009 2:07 PM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [3/23/2009 2:07 PM 67656]
    R2 CMBWPS;Cmb WebProtect Support;c:\program files\CMBCHINA\WebProtect\WPService.exe [12/25/2008 11:49 AM 232848]
    R2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\ICBCEbankTools\ICBCAntiPhishing\IcbcDaemon.exe [10/14/2009 9:40 AM 397184]
    R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [9/19/2008 3:03 AM 65536]
    S3 Alidevice;Alidevice;c:\windows\system32\drivers\alidevice.sys [4/29/2008 10:36 AM 6656]
    S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
    S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
    S3 CnxTgNW;Conexant AccessRunner ADSL WAN PPPoA Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNW.sys --> c:\windows\system32\DRIVERS\CnxTgNW.sys [?]
    S3 GKeyUSB;GKeyUSB;c:\windows\system32\drivers\GKeyUSB.sys [9/7/2007 12:31 PM 62096]
    S3 Irisp2ht;irisp2ht.sys bulk pen driver;c:\windows\system32\drivers\irisp2ht.sys [1/12/2009 4:04 PM 16516]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.188\McCHSvc.exe [10/5/2010 2:27 AM 237008]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\27.tmp --> c:\windows\system32\27.tmp [?]
    S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [8/4/2004 12:00 PM 14336]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [3/23/2009 2:07 PM 12872]
    S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [12/24/2006 8:34 PM 428160]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - BEEP

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    vvdsvc REG_MULTI_SZ vvdsvc
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
    .
    ‘计划任务’ 文件夹 里的内容 #the contents of the folder called 'planned tasks'

    2010-11-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 12:34]

    2010-12-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1844237615-682003330-1003Core1cb72ba90649cec.job
    - c:\documents and settings\PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-06 10:07]
    .
    .
    ------- 而外的扫描 #extra scan#-------
    .
    uStart Page = hxxp://www.google.co.uk/
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer =
    uInternet Settings,ProxyOverride = *.local
    IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    IE: Add to QQ Customized Emoticons
    IE: Add to QQ Customized Panel
    IE: Add to QQ Emotions
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Send picture by MMS
    IE: Send Picture with QQ MMS
    IE: Upload to QQ Network Hard Disk
    IE: ìí?óμ?QQ±í?é
    IE: ìí?óμ?QQ±í?é
    IE: 添加到QQ表情 #add to QQ expressions#- c:\program files\Tencent\QQ\AddEmotion.htm
    Trusted Zone: com.cn\mybank.icbc
    Trusted Zone: com.cn\www.icbc
    Trusted Zone: shanghaiexpat.com\jobs
    TCP: {7AE70460-E422-4A20-968E-B73A31413B8E} = 8.8.8.8,8.8.4.4
    DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} - hxxps://site.cmbchina.com/download/CMBEdit.cab
    DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844}
    DPF: {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}
    DPF: {5CB840B5-A94E-4AD9-B785-4866E3B04476}
    DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} - hxxps://mybank.icbc.com.cn/icbc/NetSign.dll
    DPF: {7AEA10C5-B38F-4D72-A8F0-ED2D43D2A59E}
    DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://vip.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
    FF - ProfilePath - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\
    FF - prefs.js: browser.startup.homepage - www.google.co.uk
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
    FF - plugin: c:\documents and settings\PC\Application Data\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\documents and settings\PC\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: c:\documents and settings\PC\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npaliedit.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
    FF - plugin: c:\program files\Veetle\Player\npvlc.dll
    FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
    FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Extension: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
    FF - Extension: EndNote Web: {322e833a-a7d4-4277-97c6-334fa1622d6a} - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{322e833a-a7d4-4277-97c6-334fa1622d6a}
    FF - Extension: Zotero: zotero@chnm.gmu.edu - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\zotero@chnm.gmu.edu
    .
    .
    ------- 文件类型 #file type#-------
    .
    txtfile=c:\windows\notepad.exe %1
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
    AddRemove-HijackThis - c:\program files\hijackthis\HijackThis.exe
    AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\FlashUtil9b.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-12-05 19:24
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    扫描被隐藏的进程 。。。 #scanning for hidden processes#

    扫描被隐藏的启动组 。。。 #scanning for hidden start-ups#

    扫描被隐藏的文件 。。。 #scanning for hidden files#

    扫描完成 #scan completed#
    被隐藏的档案: 0 #hidden archives#

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
    "ImagePath"="\??\c:\windows\system32\27.tmp"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-484763869-1844237615-682003330-1003\Software\Microsoft\Internet Explorer\MenuExt\鹠燫0RQ*Q*h埮`]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    @="c:\\Program Files\\Tencent\\QQ\\AddEmotion.htm"
    "contexts"=dword:00000002
    .
    --------------------- 运行进程下的动态链接库 #Dynamic Link Library under running processes#---------------------

    - - - - - - - > 'winlogon.exe'(744)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    - - - - - - - > 'explorer.exe'(3064)
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    完成时间#finish time#: 2010-12-05 19:36:16
    ComboFix-quarantined-files.txt 2010-12-05 19:36

    Pre-Run: 3,614,638,080 bytes free
    Post-Run: 3,580,583,936 bytes free

    - - End Of File - - E226B30E43F8101D4EDD9BFADF184EFC
     
  10. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Now, I have to learn Chinese, huh?
    Just kidding....LOL

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\windows\Alcmtr.exe
    
    
    Folder::
    c:\program files\Uniblue
    
    
    Driver::
    MEMSWEEP2
    
    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=-
    [-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  11. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Hi again,

    Had a crash when I ran combofix, followed by scandisk. No new logfile when it had reboot.

    Should I try again in safe mode?

    Cheers
     
  12. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Yes, you can.
     
  13. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Ok that worked, here's the report

    ComboFix 10-12-04.02 - PC 7/2010 Tue 7:13.3.1 - FAT32x86 MINIMAL
    Microsoft Windows XP Professional 5.1.2600.2.936.86.1033.18.1982.1709 [GMT 0:00]
    执行位置#execution location#: c:\documents and settings\PC\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\PC\Desktop\CFScript.txt
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    FILE ::
    "c:\windows\Alcmtr.exe"
    .

    ((((((((((((((((((((((((((((((((((((((( 被删除的档案 #deleted files/folders# )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Alcmtr.exe

    .
    ((((((((((((((((((((((((((((((((((((((( 驱动/服务 #drivers/services# )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_MEMSWEEP2
    -------\Service_MEMSWEEP2


    ((((((((((((((((((((((((( #from# 2010-11-07 至#until# 2010-12-07 的新的档案 #new files# )))))))))))))))))))))))))))))))
    .

    2010-12-06 20:22 . 2010-12-06 20:22 -------- d-----w- C:\FOUND.002
    2010-12-04 19:48 . 2010-12-04 19:48 -------- d-----w- c:\documents and settings\PC\Application Data\Malwarebytes
    2010-12-04 19:47 . 2010-11-29 17:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-04 19:47 . 2010-12-04 19:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-12-04 19:47 . 2010-11-29 17:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-04 19:47 . 2010-12-04 19:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-04 18:01 . 2010-12-04 18:01 -------- d-----w- C:\FOUND.001
    2010-12-04 17:47 . 2010-12-04 17:47 -------- d-----w- C:\FOUND.000
    2010-12-04 15:53 . 2010-09-06 09:26 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2010-12-04 15:50 . 2010-12-04 15:50 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
    2010-12-04 15:50 . 2010-12-04 15:50 -------- d-----w- c:\program files\McAfee Security Scan
    2010-12-04 15:31 . 2010-12-04 15:31 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure
    2010-12-04 15:19 . 2010-12-04 15:19 -------- d-----w- c:\program files\Common Files\Java
    2010-12-04 15:10 . 2010-12-04 15:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-12-02 14:15 . 2010-12-02 14:15 -------- d-----w- c:\program files\HandHistory
    2010-11-28 22:19 . 2010-11-28 22:19 -------- d-----w- C:\spoolerlogs
    2010-11-28 06:23 . 2010-11-28 06:23 -------- d-----w- c:\program files\Veetle
    2010-11-24 23:51 . 2010-11-24 23:51 -------- d-----w- c:\documents and settings\PC\Application Data\Pyti
    2010-11-23 18:30 . 2010-11-23 18:30 -------- d-----w- c:\program files\iPod
    2010-11-23 18:30 . 2010-11-23 18:30 -------- d-----w- c:\program files\iTunes
    2010-11-23 18:30 . 2010-11-23 18:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-11-23 18:24 . 2010-11-23 18:24 -------- d-----w- c:\program files\Bonjour
    2010-11-23 17:47 . 2010-11-23 17:47 -------- d-----w- c:\documents and settings\PC\Application Data\OpenOffice.org
    2010-11-23 17:41 . 2010-11-23 17:41 -------- d-----w- c:\program files\JRE
    2010-11-23 17:41 . 2010-11-23 17:41 -------- d-----w- c:\program files\OpenOffice.org 3
    2010-11-22 03:48 . 2010-11-22 03:48 -------- d-----w- c:\documents and settings\PC\Local Settings\Application Data\TruePoker
    2010-11-22 03:46 . 2010-11-22 03:46 -------- d-----w- c:\program files\TruePoker
    2010-11-07 19:49 . 2010-11-07 19:49 -------- d-----w- c:\documents and settings\PC\Application Data\XPTpoker

    .
    (((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 #Find 3M report# ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-05 07:00 . 2004-08-04 12:00 68224 ----a-w- c:\windows\system32\drivers\pci.sys
    2010-12-04 15:09 . 2010-05-31 19:00 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-10-07 12:23 . 2010-10-07 12:23 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-10-07 12:23 . 2010-10-07 12:23 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2010-09-08 11:17 . 2010-09-08 11:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 11:17 . 2010-09-08 11:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
    .

    ((((((((((((((((((((((((((((( SnapShot@2010-12-05_19.08.50 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2010-12-07 07:18 . 2010-12-07 07:18 16384 c:\windows\temp\Perflib_Perfdata_71c.dat
    .
    ((((((((((((((((((((((((((((((((((((( 重要登入点 #reg loading points# ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *注意* 空白与合法缺省登录将不会被显示 #attention: blank or legitimately default login cannot be displayed#
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-09-26 2356088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]
    "BigDog303"="c:\windows\VM303_STI.EXE" [2006-02-27 61440]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-12-24 185896]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-18 08:38 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    [BU]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
    backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
    backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SnagIt 8.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SnagIt 8.lnk
    backup=c:\windows\pss\SnagIt 8.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^PC^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
    path=c:\documents and settings\PC\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
    backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^PC^Start Menu^Programs^Startup^腾讯QQ.lnk]
    path=c:\documents and settings\PC\Start Menu\Programs\Startup\腾讯QQ.lnk
    backup=c:\windows\pss\腾讯QQ.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CnxDslTaskBar]
    c:\program files\Conexant\AccessRunner ADSL USB\CnxDslTb.exe Conexant\AccessRunner ADSL USB [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
    2005-06-06 23:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
    2010-04-13 02:29 47392 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreativeTaskScheduler]
    2006-11-17 09:42 53341 ------w- c:\program files\Creative\Shared Files\CTSched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTCheck]
    2007-11-06 11:08 397312 ------w- e:\zen media explorer\CTCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
    2007-07-17 11:03 868352 ------w- c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    2007-04-04 06:29 165784 ----a-w- c:\program files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gemplus Reader Resource Manager]
    2007-10-08 16:17 77824 ----a-w- c:\program files\ICBCEbankTools\Gemplus\GemSafe Libraries\BIN\RRMSVR.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gemstrmw]
    2007-06-29 11:44 24576 ------w- c:\windows\system32\gemstrmw.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google IME Autoupdater]
    c:\program files\Google\Google Pinyin\GooglePinyinDaemon.exe [BU]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
    2008-09-06 10:07 133104 ----a-w- c:\documents and settings\PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2009-11-18 16:13 54576 ----a-w- e:\program files\HP\HP Software Update\hpwuschd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    2004-08-04 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-11-17 20:59 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    2004-08-04 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    2006-08-16 15:35 1617920 ----a-w- c:\windows\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-09-08 11:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regtool]
    2008-01-21 15:28 172032 ----a-w- c:\program files\ICBCEbankTools\Gemplus\GemSafe Libraries\BIN\RegTool.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
    2006-05-16 18:04 2879488 ------r- c:\windows\SkyTel.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    2009-03-05 16:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
    2006-11-26 10:30 97357 ----a-w- c:\program files\Ringz Studio\Storm Codec\StormSet.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stup.exe]
    c:\progra~1\TENCENT\SSPlus\SPlus1.dll [BU]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
    2010-12-04 12:14 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2006-12-24 20:28 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "usnjsvc"=3 (0x3)
    "aawservice"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Messenger\\MSMSGS.EXE"=
    "c:\\Program Files\\uTorrent\\utorrent.exe"=
    "c:\\Program Files\\ì?±|í?\\ì?±|íúíú\\WangWang.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Documents and Settings\\PC\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
    "c:\\WINDOWS\\System32\\ZoneLabs\\vsmon.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
    "e:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
    "e:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/3/2007 6:26 AM 721904]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [3/23/2009 2:07 PM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [3/23/2009 2:07 PM 67656]
    R2 CMBWPS;Cmb WebProtect Support;c:\program files\CMBCHINA\WebProtect\WPService.exe [12/25/2008 11:49 AM 232848]
    R2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\ICBCEbankTools\ICBCAntiPhishing\IcbcDaemon.exe [10/14/2009 9:40 AM 397184]
    R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [9/19/2008 3:03 AM 65536]
    S3 Alidevice;Alidevice;c:\windows\system32\drivers\alidevice.sys [4/29/2008 10:36 AM 6656]
    S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
    S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
    S3 CnxTgNW;Conexant AccessRunner ADSL WAN PPPoA Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNW.sys --> c:\windows\system32\DRIVERS\CnxTgNW.sys [?]
    S3 GKeyUSB;GKeyUSB;c:\windows\system32\drivers\GKeyUSB.sys [9/7/2007 12:31 PM 62096]
    S3 Irisp2ht;irisp2ht.sys bulk pen driver;c:\windows\system32\drivers\irisp2ht.sys [1/12/2009 4:04 PM 16516]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.188\McCHSvc.exe [10/5/2010 2:27 AM 237008]
    S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [8/4/2004 12:00 PM 14336]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [3/23/2009 2:07 PM 12872]
    S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [12/24/2006 8:34 PM 428160]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    vvdsvc REG_MULTI_SZ vvdsvc
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
    .
    ‘计划任务’ 文件夹 里的内容 #the contents of the folder called 'planned tasks'#

    2010-11-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 12:34]

    2010-12-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1844237615-682003330-1003Core1cb72ba90649cec.job
    - c:\documents and settings\PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-06 10:07]
    .
    .
    ------- 而外的扫描 #extra scan#-------
    .
    uStart Page = hxxp://www.google.co.uk/
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer =
    uInternet Settings,ProxyOverride = *.local
    IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    IE: Add to QQ Customized Emoticons
    IE: Add to QQ Customized Panel
    IE: Add to QQ Emotions
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Send picture by MMS
    IE: Send Picture with QQ MMS
    IE: Upload to QQ Network Hard Disk
    IE: ìí?óμ?QQ±í?é
    IE: ìí?óμ?QQ±í?é
    IE: 添加到QQ表情 #add to QQ expressions# - c:\program files\Tencent\QQ\AddEmotion.htm
    Trusted Zone: com.cn\mybank.icbc
    Trusted Zone: com.cn\www.icbc
    Trusted Zone: shanghaiexpat.com\jobs
    TCP: {7AE70460-E422-4A20-968E-B73A31413B8E} = 8.8.8.8,8.8.4.4
    DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} - hxxps://site.cmbchina.com/download/CMBEdit.cab
    DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844}
    DPF: {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}
    DPF: {5CB840B5-A94E-4AD9-B785-4866E3B04476}
    DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} - hxxps://mybank.icbc.com.cn/icbc/NetSign.dll
    DPF: {7AEA10C5-B38F-4D72-A8F0-ED2D43D2A59E}
    DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://vip.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
    FF - ProfilePath - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\
    FF - prefs.js: browser.startup.homepage - www.google.co.uk
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
    FF - plugin: c:\documents and settings\PC\Application Data\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\documents and settings\PC\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: c:\documents and settings\PC\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npaliedit.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
    FF - plugin: c:\program files\Veetle\Player\npvlc.dll
    FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
    FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Extension: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
    FF - Extension: EndNote Web: {322e833a-a7d4-4277-97c6-334fa1622d6a} - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{322e833a-a7d4-4277-97c6-334fa1622d6a}
    FF - Extension: Zotero: zotero@chnm.gmu.edu - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\zotero@chnm.gmu.edu
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-12-07 07:20
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    扫描被隐藏的进程 。。。 #scanning for hidden processes#

    扫描被隐藏的启动组 。。。 #scanning for hidden startups#

    扫描被隐藏的文件 。。。 #scanning for hidden files#

    扫描完成 #scan completed#
    被隐藏的档案: 0 #hidden archives#

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-484763869-1844237615-682003330-1003\Software\Microsoft\Internet Explorer\MenuExt\鹠燫0RQ*Q*h埮`]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    @="c:\\Program Files\\Tencent\\QQ\\AddEmotion.htm"
    "contexts"=dword:00000002
    .
    --------------------- 运行进程下的动态链接库 #Dynamic Link Library under running processes#---------------------

    - - - - - - - > 'winlogon.exe'(740)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    - - - - - - - > 'explorer.exe'(236)
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ 其他运行进程 #other running programmes# ------------------------
    .
    c:\windows\System32\SCardSvr.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\CTsvcCDA.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\nvsvc32.exe
    c:\program files\PostgreSQL\8.3\bin\postgres.exe
    c:\program files\PostgreSQL\8.3\bin\postgres.exe
    c:\program files\PostgreSQL\8.3\bin\postgres.exe
    c:\program files\PostgreSQL\8.3\bin\postgres.exe
    c:\program files\PostgreSQL\8.3\bin\postgres.exe
    c:\program files\PostgreSQL\8.3\bin\postgres.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\conime.exe
    c:\windows\RTHDCPL.EXE
    c:\windows\system32\RUNDLL32.EXE
    .
    **************************************************************************
    .
    完成时间 #finish time#: 2010-12-07 07:32:30 - 电脑已重新启动 #computer to restart#
    ComboFix-quarantined-files.txt 2010-12-07 07:32
    ComboFix2.txt 2010-12-05 19:36

    Pre-Run: 3,297,206,272 bytes free
    Post-Run: 3,152,412,672 bytes free

    - - End Of File - - 7D21CB45A91238A42C0507040ACBC93E
     
  14. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Looks good :)

    How is redirection?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  15. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Haven't noticed the redirecting for a while now thanks :)

    Here's the Extras log:

    OTL Extras logfile created on: 12/8/2010 8:36:22 AM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\PC\Desktop
    Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.2180)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 76.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
    Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 15.92 Gb Total Space | 2.71 Gb Free Space | 17.01% Space Free | Partition Type: FAT32
    Drive D: | 29.29 Gb Total Space | 1.37 Gb Free Space | 4.67% Space Free | Partition Type: FAT32
    Drive E: | 29.29 Gb Total Space | 2.87 Gb Free Space | 9.79% Space Free | Partition Type: FAT32

    Computer Name: DESKTOP | User Name: PC | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring" = 1

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:*:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:*:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:*:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:*:Enabled:mad:xpsp2res.dll,-22002

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 0
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22002

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found
    "E:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = E:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = E:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = E:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = E:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = E:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = E:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = E:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\HP Software Update\hpwucli.exe" = E:\Program Files\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
    "E:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = E:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\uTorrent\utorrent.exe" = C:\Program Files\uTorrent\utorrent.exe:*:Enabled:|?§?Torrent -- (BitTorrent, Inc.)
    "C:\Program Files\ÌÔ±¦Íø\ÌÔ±¦ÍúÍú\WangWang.exe" = C:\Program Files\ì?±|í?\ì?±|íúíú\WangWang.exe:*:Enabled:淘宝旺旺 -- File not found
    "C:\Documents and Settings\PC\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\PC\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)
    "C:\WINDOWS\System32\ZoneLabs\vsmon.exe" = C:\WINDOWS\System32\ZoneLabs\vsmon.exe:*:Enabled:vsmon -- (Check Point Software Technologies LTD)
    "E:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = E:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = E:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = E:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = E:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = E:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = E:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = E:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
    "E:\Program Files\HP\HP Software Update\hpwucli.exe" = E:\Program Files\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
    "E:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = E:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
    "{05BA6FCD-1701-4AB9-8A1B-59008261695E}" = PS_AIO_06_B109a-m_SW_Min
    "{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
    "{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
    "{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
    "{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
    "{1B2DBF55-05D4-4072-87D8-689141E262BD}" = Creative ZEN
    "{1DFE388B-6FD3-4230-A47B-393AEA68C01D}" = EndNote Web
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
    "{2238A301-6A20-4bdb-A655-C84AB629F6B6}" = hph_readme
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
    "{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
    "{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
    "{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
    "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{38B122B2-3257-4E43-BD51-327599ECBA46}" = 中国工商银行防钓鱼软件
    "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
    "{4DE314EE-A46A-4EAA-AD08-4F05C4BD48D7}" = 工行IE浏览器安全插件
    "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
    "{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
    "{58F58158-8DFE-31DA-AC1F-7E5D89A0F74F}" = Google Talk Plugin
    "{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
    "{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter
    "{60101C13-2C13-48FB-855D-33D9F3013133}" = B109a-m
    "{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
    "{6283826F-59A2-11D9-BB04-000AE6BE6EE7}" = On-line Help Console
    "{65744D5B-1EBF-4B97-8130-001F319D693E}" = ICBC install (goldpac personal version)
    "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{6D0C6BE4-F674-43D2-96BC-3509345108C9}_is1" = PokerStove version 1.23
    "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
    "{73E62AE7-6636-4E57-9ACA-5A3E352BF2AB}" = GemSafe OEM Edition 5.0 for China
    "{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
    "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
    "{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
    "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
    "{93156467-FD99-4A30-9CA5-8563F4BB8DB3}" = icbc_netbank_client_controls
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A253A57F-4319-49B5-B405-64587FFBCFE2}" = HP Photosmart B109a-m All-in-One Driver Software 14.0 Rel. 6
    "{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
    "{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
    "{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
    "{AC76BA86-7AD7-2447-0000-800000000003}" = Chinese Simplified Fonts Support For Adobe Reader 8
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
    "{BA165460-FCF7-4D6C-A7A2-F2321700720F}" = MobileMe Control Panel
    "{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
    "{BBEB5679-6E2C-47C6-A9B5-3C6D4CD19B60}" = hph_software_req
    "{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
    "{C44A1657-3998-4B6E-8BB6-40071222EF5D}" = D1300_Help
    "{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
    "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
    "{CE3B8E96-B0AF-4871-9178-1519B58E3A93}" = DoubleRing Pc Camera (Vimicro301 Neptune)
    "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
    "{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
    "{DA0BF7AB-88EB-4675-8FA1-531EAD938821}" = SnagIt 8
    "{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
    "{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
    "{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
    "{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
    "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
    "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
    "{F6C6303B-F56F-11D5-B90B-005004892044}" = LEAD MCMP_MJPEG Codec Eval
    "{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
    "{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
    "888poker.net" = 888poker.net
    "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "Alipay security control_is1" = Alipay security control 2,4,0,1
    "AudibleManager" = AudibleManager
    "CMBWebProtect" = 招商银行一网通网盾
    "Creative Software AutoUpdate" = Creative Software AutoUpdate
    "CyberTweak_is1" = CyberTweak Version 1.3 Final
    "Dafa Poker" = Dafa Poker
    "eMusic Promotion" = 50 FREE MP3s +1 Free Audiobook!
    "Everest Poker" = Everest Poker (Remove Only)
    "Flickr Uploadr" = Flickr Uploadr 3.0.5
    "Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 1.9
    "FreshDevices - FreshDiagnose_is1" = FreshDiagnose
    "HP Imaging Device Functions" = HP Imaging Device Functions 14.0
    "HP Smart Web Printing" = HP Smart Web Printing 4.60
    "HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
    "HPExtendedCapabilities" = HP Customer Participation Program 14.0
    "ICBC Token CSP - Goldpac 2007_is1" = ICBC Token CSP - Goldpac 2007
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "InFlac" = InFlac 1.1.1
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "McAfee Security Scan" = McAfee Security Scan Plus
    "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
    "Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
    "Mozilla Thunderbird (2.0.0.23)" = Mozilla Thunderbird (2.0.0.23)
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "NVIDIA Drivers" = NVIDIA Drivers
    "Ö§¸¶±¦°²È«¿Ø¼þ_is1" = Ö§¸¶±¦°²È«¿Ø¼þ 1,1,0,1
    "PokerTracker3" = PokerTracker 3 (remove only)
    "RealPlayer 6.0" = RealPlayer
    "ResearchSoft Direct Export Helper" = ResearchSoft Direct Export Helper
    "Shop for HP Supplies" = Shop for HP Supplies
    "Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.5.4
    "Storm Codec 5" = Storm Codec
    "StormPlayer" = StormPlayer
    "SysInfo" = Creative System Information
    "TruePoker (High Res)" = TruePoker (High Res)
    "uTorrent" = µTorrent
    "Veetle TV" = Veetle TV 0.9.18
    "VJOcx2.0" = VJOcx2.0
    "WIC" = Windows Imaging Component
    "Winamp" = Winamp
    "Winamp Toolbar" = Winamp Toolbar
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "WinLiveSuite_Wave3" = Windows Live Essentials
    "WinRAR archiver" = WinRAR archiver
    "WMFDist11" = Windows Media Format 11 runtime
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "ZEN (MTP) Media Explorer" = ZEN Media Explorer
    "ZENcast Organizer" = ZENcast Organizer
    "ZoneAlarm" = ZoneAlarm
    "支付宝插件_is1" = 支付宝插件 1.2.0.2

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Google Chrome" = Google Chrome
    "uTorrent" = µTorrent
    "Winamp Detect" = Winamp Application Detect
    "XPTpoker_197_0" = XPTpoker

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 11/30/2010 10:54:44 AM | Computer Name = DESKTOP | Source = MsiInstaller | ID = 11704
    Description = Product: OpenOffice.org 3.2 -- Error 1704.An installation for AVG
    2011 is currently suspended. You must undo the changes made by that installation
    to continue. Do you want to undo those changes?

    Error - 11/30/2010 1:34:38 PM | Computer Name = DESKTOP | Source = Application Error | ID = 1000
    Description = Faulting application poker.exe, version 6.2.1.8, faulting module ntdll.dll,
    version 5.1.2600.2180, fault address 0x00002abb.

    Error - 12/4/2010 10:57:18 AM | Computer Name = DESKTOP | Source = MsiInstaller | ID = 11704
    Description = Product: Java(TM) 6 Update 22 -- Error 1704.An installation for AVG
    2011 is currently suspended. You must undo the changes made by that installation
    to continue. Do you want to undo those changes?

    Error - 12/4/2010 4:24:47 PM | Computer Name = DESKTOP | Source = Application Error | ID = 1000
    Description = Faulting application svchost.exe, version 5.1.2600.2180, faulting
    module unknown, version 0.0.0.0, fault address 0x001a624b.

    Error - 12/5/2010 3:44:39 AM | Computer Name = DESKTOP | Source = Application Error | ID = 1000
    Description = Faulting application pokertracker.exe, version 3.8.0.0, faulting module
    chartdir50.dll, version 5.0.1.0, fault address 0x0016bc73.

    Error - 12/5/2010 2:37:29 PM | Computer Name = DESKTOP | Source = MsiInstaller | ID = 11704
    Description = Product: AVG 2011 -- Error 1704. An installation for AVG 2011 is currently
    suspended. You must undo the changes made by that installation to continue. Do
    you want to undo those changes?

    Error - 12/5/2010 2:38:26 PM | Computer Name = DESKTOP | Source = MsiInstaller | ID = 11921
    Description = Product: AVG 2011 -- Error 1921. Service 'AVG WatchDog' (avgwd) could
    not be stopped. Verify that you have sufficient privileges to stop system services.

    Error - 12/5/2010 2:39:13 PM | Computer Name = DESKTOP | Source = MsiInstaller | ID = 11921
    Description = Product: AVG 2011 -- Error 1921. Service 'AVG WatchDog' (avgwd) could
    not be stopped. Verify that you have sufficient privileges to stop system services.

    Error - 12/6/2010 2:21:22 PM | Computer Name = DESKTOP | Source = Application Error | ID = 1000
    Description = Faulting application mplayerc.exe, version 6.4.9.1, faulting module
    shntrans.ax, version 0.0.0.0, fault address 0x0000bb9b.

    Error - 12/6/2010 2:23:44 PM | Computer Name = DESKTOP | Source = Application Error | ID = 1000
    Description = Faulting application mplayerc.exe, version 6.4.9.1, faulting module
    shntrans.ax, version 0.0.0.0, fault address 0x0000bb9b.

    [ System Events ]
    Error - 12/7/2010 3:19:58 AM | Computer Name = DESKTOP | Source = Disk | ID = 262155
    Description = The driver detected a controller error on \Device\Harddisk0\D.

    Error - 12/7/2010 3:19:59 AM | Computer Name = DESKTOP | Source = Disk | ID = 262155
    Description = The driver detected a controller error on \Device\Harddisk0\D.

    Error - 12/7/2010 3:19:59 AM | Computer Name = DESKTOP | Source = Disk | ID = 262155
    Description = The driver detected a controller error on \Device\Harddisk0\D.

    Error - 12/7/2010 3:19:59 AM | Computer Name = DESKTOP | Source = Disk | ID = 262155
    Description = The driver detected a controller error on \Device\Harddisk0\D.

    Error - 12/7/2010 3:19:59 AM | Computer Name = DESKTOP | Source = Disk | ID = 262155
    Description = The driver detected a controller error on \Device\Harddisk0\D.

    Error - 12/7/2010 3:19:59 AM | Computer Name = DESKTOP | Source = Disk | ID = 262155
    Description = The driver detected a controller error on \Device\Harddisk0\D.

    Error - 12/7/2010 3:19:59 AM | Computer Name = DESKTOP | Source = Disk | ID = 262155
    Description = The driver detected a controller error on \Device\Harddisk0\D.

    Error - 12/7/2010 3:39:28 AM | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7034
    Description = The ICBC Daemon Service service terminated unexpectedly. It has done
    this 1 time(s).

    Error - 12/7/2010 2:36:09 PM | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7034
    Description = The ICBC Daemon Service service terminated unexpectedly. It has done
    this 1 time(s).

    Error - 12/8/2010 3:56:08 AM | Computer Name = DESKTOP | Source = Service Control Manager | ID = 7034
    Description = The ICBC Daemon Service service terminated unexpectedly. It has done
    this 1 time(s).


    < End of report >
     
  16. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Here's OTL scan pt 1:

    OTL logfile created on: 12/8/2010 8:36:22 AM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\PC\Desktop
    Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.2180)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 76.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
    Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 15.92 Gb Total Space | 2.71 Gb Free Space | 17.01% Space Free | Partition Type: FAT32
    Drive D: | 29.29 Gb Total Space | 1.37 Gb Free Space | 4.67% Space Free | Partition Type: FAT32
    Drive E: | 29.29 Gb Total Space | 2.87 Gb Free Space | 9.79% Space Free | Partition Type: FAT32

    Computer Name: DESKTOP | User Name: PC | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/12/08 08:34:56 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC\Desktop\OTL.exe
    PRC - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    PRC - [2010/06/23 13:52:56 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    PRC - [2010/06/23 13:51:30 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    PRC - [2008/09/19 07:30:34 | 003,674,112 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
    PRC - [2008/09/19 03:03:58 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
    PRC - [2007/08/27 16:35:42 | 000,232,848 | ---- | M] (China Merchants Bank) -- C:\Program Files\CMBCHINA\WebProtect\WPService.exe
    PRC - [2007/06/13 18:23:08 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2006/02/27 11:25:12 | 000,061,440 | ---- | M] (Vimicro) -- C:\WINDOWS\VM303_STI.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/12/08 08:34:56 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC\Desktop\OTL.exe
    MOD - [2006/08/25 07:45:56 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2010/10/05 02:27:16 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.0.188\McCHSvc.exe -- (McComponentHostService)
    SRV - [2010/09/01 15:52:56 | 000,066,112 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R)
    SRV - [2010/06/23 13:52:56 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZONELABS\vsmon.exe -- (vsmon)
    SRV - [2009/10/14 09:40:32 | 000,397,184 | ---- | M] () [Auto | Stopped] -- C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\IcbcDaemon.exe -- (ICBC Daemon Service)
    SRV - [2009/09/24 10:59:26 | 001,695,368 | ---- | M] (NanJing Nagasoft Co, LTD.) [Auto | Stopped] -- C:\WINDOWS\system32\nagasoft\vjocx.dll -- (vvdsvc)
    SRV - [2008/09/19 03:03:58 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) [Auto | Running] -- C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe -- (pgsql-8.3)
    SRV - [2007/08/27 16:35:42 | 000,232,848 | ---- | M] (China Merchants Bank) [Auto | Running] -- C:\Program Files\CMBCHINA\WebProtect\WPService.exe -- (CMBWPS)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\SymIM.sys -- (SymIMMP)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\SymIM.sys -- (SymIM)
    DRV - File not found [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\ZoneLabs\srescan.sys -- (srescan)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\CnxTgNW.sys -- (CnxTgNW)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\CnxEtU.sys -- (CnxEtU)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\CnxEtP.sys -- (CnxEtP)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2010/07/27 22:50:02 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
    DRV - [2010/07/27 22:50:02 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
    DRV - [2010/07/27 22:50:02 | 000,012,872 | ---- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
    DRV - [2010/05/13 10:02:32 | 000,532,224 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
    DRV - [2010/01/08 16:28:38 | 000,006,656 | ---- | M] (alipay.com) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\alidevice.sys -- (Alidevice)
    DRV - [2009/11/09 21:16:26 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
    DRV - [2009/03/17 00:04:50 | 000,004,608 | ---- | M] (RealVNC Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vncmirror.sys -- (vncmirror)
    DRV - [2008/02/02 02:35:04 | 000,025,216 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
    DRV - [2006/12/21 16:26:00 | 004,405,248 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
    DRV - [2006/08/16 15:35:00 | 003,959,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2006/07/11 21:38:30 | 000,020,480 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
    DRV - [2006/07/11 21:38:28 | 000,057,856 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
    DRV - [2006/06/28 17:38:56 | 000,105,088 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
    DRV - [2006/04/25 10:57:42 | 000,428,160 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vmfilter303.sys -- (vmfilter303)
    DRV - [2006/04/11 13:21:18 | 000,391,970 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbVM303.sys -- (ZSMC303) DoubleRing Pc Camera (Vimicro301 Neptune)
    DRV - [2005/10/26 00:08:26 | 003,786,944 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
    DRV - [2005/01/07 17:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus)
    DRV - [2004/10/26 11:22:50 | 000,002,410 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys -- (FreshIO)
    DRV - [2004/08/04 12:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
    DRV - [2004/08/03 23:07:56 | 000,059,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
    DRV - [2002/12/11 16:38:50 | 000,062,096 | ---- | M] (Gemplus) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\GKeyUSB.sys -- (GKeyUSB)
    DRV - [2002/08/27 22:21:40 | 000,016,516 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\irisp2ht.sys -- (Irisp2ht)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll File not found

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "www.google.co.uk"
    FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.91
    FF - prefs.js..extensions.enabledItems: {322e833a-a7d4-4277-97c6-334fa1622d6a}:2.10
    FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..network.proxy.type: 0


    FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: E:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/10/22 22:18:08 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006/12/21 02:53:58 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006/12/21 02:53:58 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/11/19 13:30:10 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

    [2008/09/14 14:29:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Mozilla\Extensions
    [2008/09/14 14:29:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions
    [2010/10/28 14:43:42 | 000,000,000 | ---D | M] (EndNote Web) -- C:\Documents and Settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{322e833a-a7d4-4277-97c6-334fa1622d6a}
    [2010/10/24 09:52:26 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
    [2010/10/29 11:35:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\extensions\zotero@chnm.gmu.edu
    [2010/01/04 22:45:32 | 000,001,250 | ---- | M] () -- C:\Documents and Settings\PC\Application Data\Mozilla\Firefox\Profiles\8o6anw1j.default\searchplugins\winamp-search.xml
    [2006/12/21 02:53:58 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/12/04 15:10:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    [2008/12/15 15:05:50 | 000,234,496 | ---- | M] (Alipay.com co.,ltd) -- C:\Program Files\Mozilla Firefox\plugins\npaliedit.dll
    [2009/12/21 13:47:02 | 000,063,488 | ---- | M] (Nullsoft) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
    [2010/12/04 15:09:54 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
    [2006/01/18 12:50:00 | 000,319,488 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll

    O1 HOSTS File: ([2010/12/07 07:19:40 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - No CLSID value found.
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll File not found
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - No CLSID value found.
    O2 - BHO: (no name) - {53763D1D-9CA8-4C7C-9756-A8E6B8FC063B} - No CLSID value found.
    O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
    O2 - BHO: (EndNote Web) - {82D2E569-25A7-4E4D-9FA3-C5025B4B7912} - C:\Program Files\EndNote Web\ENWIEPlug.dll (Thomson Reuters)
    O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - No CLSID value found.
    O2 - BHO: (no name) - {90760F64-1931-4AAC-8E2E-AB39AAC071E1} - No CLSID value found.
    O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (EndNote Web) - {945C8270-A848-11D5-A805-00B0D092F45B} - C:\Program Files\EndNote Web\ENWIEPlug.dll (Thomson Reuters)
    O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll File not found
    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE (Vimicro)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
    O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
    O4 - HKCU..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
    O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
    O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
    O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
    O9 - Extra Button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Microgaming\Poker\ladbrokesMPP\MPPoker.exe File not found
    O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - E:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File not found
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - Reg Error: Key error. File not found
    O9 - Extra Button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe File not found
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O15 - HKCU\..Trusted Domains: com.cn ([mybank.icbc] https in Trusted sites)
    O15 - HKCU\..Trusted Domains: com.cn ([www.icbc] http in Trusted sites)
    O15 - HKCU\..Trusted Domains: shanghaiexpat.com ([jobs] http in Trusted sites)
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} https://site.cmbchina.com/download/CMBEdit.cab (Edit Class)
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
    O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {5CB840B5-A94E-4AD9-B785-4866E3B04476} Reg Error: Value error. (InfoSecNetSign Class)
    O16 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} https://mybank.icbc.com.cn/icbc/NetSign.dll (InfoSecNetSign Class)
    O16 - DPF: {7AEA10C5-B38F-4D72-A8F0-ED2D43D2A59E} Reg Error: Value error. (ICBCOCX Public Key Check)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} https://vip.icbc.com.cn/icbc/newperbank/AxSafeControls.cab (AxSubmitControl Class)
    O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} http://www.vexcast.com/download/vexcast.cab (VodClient Control Class)
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} Reg Error: Value error. (Creative Software AutoUpdate Support Package)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
    O20 - Winlogon\Notify\avgrsstarter: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
    O24 - Desktop WallPaper: C:\Documents and Settings\PC\Desktop\ctrl.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\PC\Desktop\ctrl.bmp
    O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/12/21 01:55:22 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: msacm.vorbis - C:\WINDOWS\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
    Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
    Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.ffds - C:\WINDOWS\System32\ff_vfw.dll ()
    Drivers32: vidc.FLV4 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMPe.dll (LEAD Technologies, Inc.)
    Drivers32: vidc.VP60 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
    Drivers32: vidc.VP61 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
    Drivers32: vidc.VP62 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
    Drivers32: vidc.VP6F - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
    Drivers32: vidc.vp70 - C:\WINDOWS\System32\vp7vfw.dll (On2.com)
    Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
    Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (56590081070202880)

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/12/08 08:34:55 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\PC\Desktop\OTL.exe
    [2010/12/07 07:53:41 | 000,000,000 | -HSD | C] -- C:\Recycled
    [2010/12/07 07:17:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
    [2010/12/06 20:22:28 | 000,000,000 | ---D | C] -- C:\FOUND.002
    [2010/12/05 19:01:49 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/12/05 18:55:08 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/12/05 18:55:08 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/12/05 18:55:08 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/12/05 18:55:08 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2010/12/05 18:55:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/12/05 18:48:33 | 001,086,304 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Documents and Settings\PC\My Documents\avg_remover_stf_x86_2011_1165.exe
    [2010/12/05 18:32:52 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/12/05 18:05:03 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Documents and Settings\PC\Desktop\remover.exe
    [2010/12/05 06:56:53 | 001,344,600 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\PC\Desktop\TDSSKiller.exe
    [2010/12/04 19:48:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC\Application Data\Malwarebytes
    [2010/12/04 19:47:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/12/04 19:47:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/12/04 19:47:49 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/12/04 19:47:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/12/04 19:40:04 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\PC\My Documents\TFC.exe
    [2010/12/04 18:02:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC\Desktop\log
    [2010/12/04 18:01:28 | 000,000,000 | ---D | C] -- C:\FOUND.001
    [2010/12/04 17:54:22 | 002,457,600 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\PC\Desktop\RootkitBuster.exe
    [2010/12/04 17:47:30 | 000,000,000 | ---D | C] -- C:\FOUND.000
    [2010/12/04 15:53:42 | 000,189,520 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
    [2010/12/04 15:51:57 | 001,912,872 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\PC\My Documents\HousecallLauncher.exe
    [2010/12/04 15:50:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
    [2010/12/04 15:50:00 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
    [2010/12/04 15:49:22 | 003,349,000 | ---- | C] (McAfee, Inc.) -- C:\Documents and Settings\PC\My Documents\SecurityScan_Release.exe
    [2010/12/04 15:31:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\F-Secure
    [2010/12/04 15:19:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
    [2010/12/02 14:15:30 | 000,000,000 | ---D | C] -- C:\Program Files\HandHistory
    [2010/12/01 17:17:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC\Desktop\HostsXpert
    [2010/12/01 16:31:26 | 007,622,112 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\PC\My Documents\mbam-setup-1.50.0.0.exe
    [2010/12/01 16:30:44 | 007,622,112 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\PC\My Documents\mbam-setup-1.50.0.0.exe.part
    [2010/11/28 22:19:22 | 000,000,000 | ---D | C] -- C:\spoolerlogs
    [2010/11/28 06:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\Veetle
    [2010/11/24 23:51:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC\Application Data\Pyti
    [2010/11/23 18:30:06 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
    [2010/11/23 18:30:02 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
    [2010/11/23 18:30:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2010/11/23 18:24:33 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
    [2010/11/23 17:47:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC\Application Data\OpenOffice.org
    [2010/11/23 17:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\JRE
    [2010/11/23 17:41:51 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
    [2010/11/22 03:48:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC\Local Settings\Application Data\TruePoker
    [2010/11/22 03:46:15 | 000,000,000 | ---D | C] -- C:\Program Files\TruePoker

    ========== Files - Modified Within 30 Days ==========

    [2010/12/08 08:34:56 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC\Desktop\OTL.exe
    [2010/12/08 07:56:50 | 000,080,494 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
    [2010/12/08 07:55:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/12/07 23:24:24 | 000,000,914 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1844237615-682003330-1003Core1cb72ba90649cec.job
    [2010/12/07 21:43:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/12/06 17:15:40 | 000,000,000 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
    [2010/12/05 21:56:12 | 000,023,291 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\ComboFix2.exe
    [2010/12/05 19:01:52 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2010/12/05 18:52:28 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2010/12/05 18:48:44 | 001,086,304 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Documents and Settings\PC\My Documents\avg_remover_stf_x86_2011_1165.exe
    [2010/12/05 18:26:22 | 003,984,562 | R--- | M] () -- C:\Documents and Settings\PC\Desktop\ComboFix.exe
    [2010/12/05 18:02:30 | 000,039,605 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\bootkit_remover.rar
    [2010/12/05 07:06:54 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\MBRCheck.exe
    [2010/12/05 06:56:00 | 001,230,433 | R--- | M] () -- C:\Documents and Settings\PC\Desktop\tdsskiller.zip
    [2010/12/04 20:40:00 | 000,630,272 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\dds.scr
    [2010/12/04 20:02:50 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\w1ryenmw.exe
    [2010/12/04 19:47:54 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/12/04 19:40:14 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC\My Documents\TFC.exe
    [2010/12/04 19:38:06 | 000,147,456 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\catchme(2).exe
    [2010/12/04 18:33:26 | 000,147,456 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\catchme.exe
    [2010/12/04 18:14:54 | 001,376,832 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\sar_15_sfx.exe
    [2010/12/04 17:54:36 | 002,457,600 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\PC\Desktop\RootkitBuster.exe
    [2010/12/04 15:52:12 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\PC\Local Settings\Application Data\housecall.guid.cache
    [2010/12/04 15:52:00 | 001,912,872 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\PC\My Documents\HousecallLauncher.exe
    [2010/12/04 15:50:18 | 000,001,711 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
    [2010/12/04 15:49:28 | 003,349,000 | ---- | M] (McAfee, Inc.) -- C:\Documents and Settings\PC\My Documents\SecurityScan_Release.exe
    [2010/12/04 09:03:54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/12/04 01:35:40 | 000,039,424 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\Presentation Structure.doc
    [2010/12/04 01:35:18 | 000,445,952 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\Presentation1.ppt
    [2010/12/03 15:02:30 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\888log.xls
    [2010/12/02 12:29:14 | 001,344,600 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\PC\Desktop\TDSSKiller.exe
    [2010/12/01 20:28:40 | 000,061,440 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\Invitation_to_SML_staff_1201 (2).doc
    [2010/12/01 16:31:26 | 007,622,112 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\PC\My Documents\mbam-setup-1.50.0.0.exe
    [2010/12/01 16:31:00 | 007,622,112 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\PC\My Documents\mbam-setup-1.50.0.0.exe.part
    [2010/11/29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/11/29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/11/28 08:55:38 | 000,037,888 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\Win32.doc
    [2010/11/28 08:55:30 | 000,617,984 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\Search result list.doc
    [2010/11/27 11:40:40 | 000,103,936 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\essay with suggestions.doc
    [2010/11/25 22:05:20 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\investigation.xls
    [2010/11/25 15:46:30 | 000,000,648 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\PokerTracker 3.lnk
    [2010/11/24 08:33:50 | 000,154,768 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/11/23 18:51:40 | 000,001,458 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\iTunes.lnk
    [2010/11/23 18:31:12 | 000,001,446 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/11/18 06:28:48 | 000,013,505 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\Teacher final interview s.o.t first.docx
     
  17. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    And OTL pt. 2

    ========== Files Created - No Company Name ==========

    [2010/12/07 07:08:09 | 000,001,182 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_12_07.log
    [2010/12/06 20:23:33 | 000,002,230 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_12_06.log
    [2010/12/05 21:56:11 | 000,023,291 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\ComboFix2.exe
    [2010/12/05 19:01:51 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2010/12/05 19:01:50 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2010/12/05 18:55:08 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/12/05 18:55:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/12/05 18:55:08 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/12/05 18:55:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/12/05 18:55:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/12/05 18:51:11 | 000,001,494 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_12_05.log
    [2010/12/05 18:26:12 | 003,984,562 | R--- | C] () -- C:\Documents and Settings\PC\Desktop\ComboFix.exe
    [2010/12/05 18:02:37 | 000,039,605 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\bootkit_remover.rar
    [2010/12/05 07:06:52 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\MBRCheck.exe
    [2010/12/05 06:55:58 | 001,230,433 | R--- | C] () -- C:\Documents and Settings\PC\Desktop\tdsskiller.zip
    [2010/12/04 20:39:54 | 000,630,272 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\dds.scr
    [2010/12/04 20:16:19 | 000,000,646 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_12_04.log
    [2010/12/04 20:02:48 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\w1ryenmw.exe
    [2010/12/04 19:47:53 | 000,000,688 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/12/04 19:38:01 | 000,147,456 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\catchme(2).exe
    [2010/12/04 18:33:27 | 000,147,456 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\catchme.exe
    [2010/12/04 18:14:48 | 001,376,832 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\sar_15_sfx.exe
    [2010/12/04 15:52:10 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\PC\Local Settings\Application Data\housecall.guid.cache
    [2010/12/04 15:50:17 | 000,001,711 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
    [2010/12/04 01:35:37 | 000,039,424 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\Presentation Structure.doc
    [2010/12/04 01:35:16 | 000,445,952 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\Presentation1.ppt
    [2010/12/01 20:28:38 | 000,061,440 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\Invitation_to_SML_staff_1201 (2).doc
    [2010/11/28 19:06:20 | 000,000,322 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_11_28.log
    [2010/11/28 08:55:37 | 000,037,888 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\Win32.doc
    [2010/11/28 08:55:29 | 000,617,984 | ---- | C] () -- C:\Documents and Settings\PC\My Documents\Search result list.doc
    [2010/11/27 11:40:38 | 000,103,936 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\essay with suggestions.doc
    [2010/11/23 18:51:39 | 000,001,458 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\iTunes.lnk
    [2010/11/23 18:31:10 | 000,001,446 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/11/20 03:30:14 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\investigation.xls
    [2010/11/18 06:28:50 | 000,013,505 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\Teacher final interview s.o.t first.docx
    [2010/11/17 01:20:05 | 000,000,846 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_11_17.log
    [2010/11/13 00:58:53 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\PC\Desktop\888log.xls
    [2010/10/22 00:08:03 | 000,002,754 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_10_22.log
    [2010/10/21 20:07:30 | 000,002,542 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_10_21.log
    [2010/07/29 20:13:57 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\gwscm.dll
    [2010/07/29 00:09:00 | 000,018,654 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_29.log
    [2010/07/28 00:10:13 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_28.log
    [2010/07/27 00:04:55 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_27.log
    [2010/07/26 00:08:52 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_26.log
    [2010/07/25 00:09:19 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_25.log
    [2010/07/24 00:03:47 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_24.log
    [2010/07/23 00:03:15 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_23.log
    [2010/07/22 00:02:17 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_22.log
    [2010/07/21 00:05:53 | 000,029,466 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_21.log
    [2010/07/20 00:05:01 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_20.log
    [2010/07/19 00:08:50 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_19.log
    [2010/07/18 00:00:07 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_18.log
    [2010/07/17 00:02:41 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_17.log
    [2010/07/16 00:06:16 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_16.log
    [2010/07/15 00:02:50 | 000,024,166 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_15.log
    [2010/07/14 00:07:28 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_14.log
    [2010/07/13 17:34:40 | 000,007,842 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_13.log
    [2010/07/12 00:09:27 | 000,010,174 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_12.log
    [2010/07/11 11:40:27 | 000,015,474 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_11.log
    [2010/07/10 00:03:17 | 000,017,170 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_10.log
    [2010/07/09 13:33:50 | 000,012,930 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_09.log
    [2010/07/08 16:17:56 | 000,006,782 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_08.log
    [2010/07/07 04:07:51 | 000,001,058 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_07.log
    [2010/07/06 16:36:36 | 000,006,358 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_06.log
    [2010/07/05 17:30:39 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_05.log
    [2010/07/04 09:59:39 | 000,015,686 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_04.log
    [2010/07/03 10:12:11 | 000,013,142 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_03.log
    [2010/07/02 07:03:30 | 000,006,782 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_07_02.log
    [2010/06/29 19:16:17 | 000,004,450 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_29.log
    [2010/06/28 18:18:11 | 000,005,298 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_28.log
    [2010/06/27 10:47:09 | 000,012,294 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_27.log
    [2010/06/26 10:50:01 | 000,008,054 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_26.log
    [2010/06/25 16:02:02 | 000,001,694 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_25.log
    [2010/06/24 17:52:44 | 000,005,934 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_24.log
    [2010/06/23 12:50:25 | 000,001,270 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_23.log
    [2010/06/22 20:27:09 | 000,001,270 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_22.log
    [2010/06/20 09:31:31 | 000,015,474 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_20.log
    [2010/06/19 03:17:54 | 000,008,690 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_19.log
    [2010/06/18 16:56:18 | 000,005,934 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_18.log
    [2010/06/17 00:10:13 | 000,009,538 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_17.log
    [2010/06/16 23:59:54 | 000,000,210 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_16.log
    [2010/06/13 16:01:38 | 000,009,326 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_13.log
    [2010/06/12 07:23:16 | 000,017,806 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_12.log
    [2010/06/11 15:51:28 | 000,004,238 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_11.log
    [2010/06/10 18:13:17 | 000,005,086 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_10.log
    [2010/06/08 20:08:54 | 000,004,874 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_08.log
    [2010/06/07 00:02:38 | 000,009,750 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_07.log
    [2010/06/06 09:23:58 | 000,017,382 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_06.log
    [2010/06/05 13:37:54 | 000,009,538 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_05.log
    [2010/06/04 15:31:33 | 000,004,662 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_04.log
    [2010/06/03 15:56:36 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_03.log
    [2010/06/02 16:05:24 | 000,005,510 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_02.log
    [2010/06/01 07:27:38 | 000,018,866 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_06_01.log
    [2010/05/31 17:23:56 | 000,003,814 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_31.log
    [2010/05/30 07:48:31 | 000,006,782 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_30.log
    [2010/05/29 07:24:30 | 000,019,714 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_29.log
    [2010/05/28 15:05:10 | 000,008,054 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_28.log
    [2010/05/27 00:01:42 | 000,009,114 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_27.log
    [2010/05/26 07:35:55 | 000,009,750 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_26.log
    [2010/05/25 00:07:42 | 000,027,558 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_25.log
    [2010/05/24 17:58:27 | 000,007,630 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_24.log
    [2010/05/23 08:39:54 | 000,017,594 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_23.log
    [2010/05/22 06:04:09 | 000,012,294 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_22.log
    [2010/05/21 07:25:06 | 000,011,870 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_21.log
    [2010/05/20 21:48:35 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\PC\Local Settings\Application Data\prvlcl.dat
    [2010/05/20 07:42:54 | 000,011,022 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_20.log
    [2010/05/19 07:40:03 | 000,017,806 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_19.log
    [2010/05/18 07:46:28 | 000,018,442 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_18.log
    [2010/05/17 06:57:33 | 000,020,562 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_17.log
    [2010/05/16 08:02:39 | 000,017,594 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_16.log
    [2010/05/15 07:12:25 | 000,019,502 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_15.log
    [2010/05/14 07:32:27 | 000,019,502 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_14.log
    [2010/05/13 18:51:38 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
    [2010/05/13 00:08:39 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_13.log
    [2010/05/12 16:05:51 | 000,009,962 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_12.log
    [2010/05/11 07:20:13 | 000,004,450 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_11.log
    [2010/05/10 07:21:15 | 000,007,630 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_10.log
    [2010/05/09 07:32:05 | 000,019,714 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_09.log
    [2010/05/08 08:35:29 | 000,018,866 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_08.log
    [2010/05/07 07:03:44 | 000,008,266 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_07.log
    [2010/05/06 00:08:36 | 000,019,290 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_06.log
    [2010/05/05 17:08:26 | 000,002,542 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_05.log
    [2010/05/04 16:19:39 | 000,009,114 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_04.log
    [2010/04/29 00:05:42 | 000,009,750 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_29.log
    [2010/04/28 00:09:46 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_28.log
    [2010/04/27 00:02:29 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_27.log
    [2010/04/26 07:40:22 | 000,005,722 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_26.log
    [2010/04/25 07:55:40 | 000,018,442 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_25.log
    [2010/04/24 08:03:18 | 000,010,598 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_24.log
    [2010/04/23 15:43:57 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_23.log
    [2010/04/22 00:02:22 | 000,017,806 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_22.log
    [2010/04/21 15:59:16 | 000,009,962 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_21.log
    [2010/04/20 00:09:05 | 000,028,406 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_20.log
    [2010/04/19 00:02:31 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_19.log
    [2010/04/18 07:47:03 | 000,019,714 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_18.log
    [2010/04/17 10:25:36 | 000,016,534 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_17.log
    [2010/04/16 18:33:16 | 000,000,210 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_16.log
    [2010/04/15 00:00:04 | 000,007,842 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_15.log
    [2010/04/14 17:19:23 | 000,008,266 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_14.log
    [2010/04/13 07:13:58 | 000,007,630 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_13.log
    [2010/04/12 07:36:14 | 000,005,934 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_12.log
    [2010/04/11 07:32:41 | 000,018,442 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_11.log
    [2010/04/10 07:54:34 | 000,009,326 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_10.log
    [2010/04/09 17:06:45 | 000,007,630 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_09.log
    [2010/04/08 00:07:39 | 000,008,266 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_08.log
    [2010/04/07 17:47:23 | 000,007,842 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_07.log
    [2010/04/06 01:03:59 | 000,007,206 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_06.log
    [2010/04/05 21:19:12 | 000,001,694 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_05.log
    [2010/04/04 16:14:19 | 000,005,086 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_04.log
    [2010/04/03 20:48:40 | 000,001,482 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_03.log
    [2010/04/02 00:04:57 | 000,001,058 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_02.log
    [2010/04/01 00:07:26 | 000,027,770 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_01.log
    [2010/03/31 17:16:26 | 000,008,478 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_31.log
    [2010/03/30 17:13:15 | 000,006,358 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_30.log
    [2010/03/29 17:36:41 | 000,006,782 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_29.log
    [2010/03/28 17:13:40 | 000,006,146 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_28.log
    [2010/03/27 00:04:45 | 000,013,990 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_27.log
    [2010/03/26 00:08:26 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_26.log
    [2010/03/25 00:01:09 | 000,029,890 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_25.log
    [2010/03/24 00:04:48 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_24.log
    [2010/03/23 18:15:57 | 000,007,206 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_23.log
    [2010/03/22 17:58:26 | 000,004,874 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_22.log
    [2010/03/21 09:57:34 | 000,016,958 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_21.log
    [2010/03/20 00:02:51 | 000,025,650 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_20.log
    [2010/03/19 20:16:38 | 000,004,662 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_19.log
    [2010/03/18 00:04:29 | 000,005,510 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_18.log
    [2010/03/17 07:33:17 | 000,008,902 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_17.log
    [2010/03/16 19:04:15 | 000,003,390 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_16.log
    [2010/03/15 07:35:25 | 000,017,806 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_15.log
    [2010/03/14 08:41:24 | 000,017,170 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_14.log
    [2010/03/13 22:29:03 | 000,001,270 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_13.log
    [2010/03/11 00:00:19 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_11.log
    [2010/03/10 19:33:19 | 000,005,510 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_10.log
    [2010/03/09 17:01:14 | 000,004,238 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_09.log
    [2010/03/08 18:07:25 | 000,006,146 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_08.log
    [2010/03/07 09:00:14 | 000,017,170 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_07.log
    [2010/03/06 11:28:06 | 000,015,262 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_06.log
    [2010/03/05 00:03:13 | 000,006,146 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_05.log
    [2010/03/04 07:46:43 | 000,018,654 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_04.log
    [2010/03/03 15:56:30 | 000,008,690 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_03.log
    [2010/03/02 17:02:33 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_02.log
    [2010/03/01 17:28:38 | 000,006,994 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_01.log
    [2010/02/28 08:18:10 | 000,017,594 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_28.log
    [2010/02/27 17:22:13 | 000,004,865 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\bltofzsb.qlf
    [2010/02/27 06:10:08 | 000,022,258 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_27.log
    [2010/02/26 16:06:20 | 000,005,722 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_26.log
    [2010/02/25 19:40:42 | 000,004,026 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_25.log
    [2010/02/24 18:47:05 | 000,004,450 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_24.log
    [2010/02/23 00:05:16 | 000,001,482 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_23.log
    [2010/02/22 16:34:02 | 000,008,266 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_22.log
    [2010/02/21 19:17:02 | 000,000,422 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_21.log
    [2010/02/20 00:01:19 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_20.log
    [2010/02/19 13:05:24 | 000,012,718 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_19.log
    [2010/02/18 21:35:38 | 000,002,966 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_18.log
    [2010/02/04 00:03:08 | 000,020,138 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_04.log
    [2010/02/03 00:06:18 | 000,029,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_03.log
    [2010/02/02 07:39:05 | 000,011,446 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_02.log
    [2010/02/01 07:41:31 | 000,013,566 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_01.log
    [2010/01/31 07:18:47 | 000,019,078 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_31.log
    [2010/01/30 09:12:18 | 000,016,322 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_30.log
    [2010/01/29 07:26:57 | 000,012,082 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_29.log
    [2010/01/28 07:35:15 | 000,019,290 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_28.log
    [2010/01/27 07:46:50 | 000,016,958 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_27.log
    [2010/01/26 00:09:52 | 000,015,050 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_26.log
    [2010/01/25 09:56:54 | 000,017,594 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_25.log
    [2010/01/24 07:39:46 | 000,018,230 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_24.log
    [2010/01/23 08:20:19 | 000,018,442 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_23.log
    [2010/01/22 00:06:54 | 000,015,686 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_22.log
    [2010/01/21 07:44:12 | 000,018,018 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_21.log
    [2010/01/20 11:53:53 | 000,006,570 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_20.log
    [2010/01/19 17:50:13 | 000,007,630 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_19.log
    [2010/01/18 06:36:30 | 000,019,926 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_18.log
    [2010/01/17 06:48:58 | 000,018,230 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_17.log
    [2010/01/16 08:10:59 | 000,015,050 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_16.log
    [2010/01/15 22:51:01 | 000,000,210 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_15.log
    [2010/01/14 13:44:26 | 000,000,210 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_14.log
    [2009/06/12 17:28:09 | 000,004,987 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ojvzdisj.xda
    [2009/06/09 19:03:21 | 003,945,166 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\IcbcToolBar.log
    [2009/05/29 14:02:26 | 000,008,330 | ---- | C] () -- C:\Documents and Settings\PC\Local Settings\Application Data\IcbcToolBar.log
    [2009/04/30 19:03:14 | 000,000,949 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2009/01/12 16:04:24 | 000,000,201 | ---- | C] () -- C:\WINDOWS\IRISPen.ini
    [2008/10/23 20:37:27 | 000,389,175 | ---- | C] () -- C:\WINDOWS\System32\RsaFun.dll
    [2008/10/23 20:37:27 | 000,282,734 | ---- | C] () -- C:\WINDOWS\System32\NPCard.dll
    [2008/10/23 20:37:27 | 000,278,658 | ---- | C] () -- C:\WINDOWS\System32\ICBCQPK_HH.dll
    [2008/10/23 20:37:27 | 000,262,208 | ---- | C] () -- C:\WINDOWS\System32\GPKPCSC.dll
    [2008/10/23 20:37:27 | 000,241,758 | ---- | C] () -- C:\WINDOWS\System32\GPKPIN.dll
    [2008/10/23 20:37:27 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\jcutilHUAUK.dll
    [2008/10/23 20:37:27 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\jcutilHUAUKLCD.dll
    [2008/10/23 20:37:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\jcinTHTFUK.dll
    [2008/10/23 20:37:27 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\jcidTHTFUK.dll
    [2008/10/23 20:37:27 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\jcinpublic.dll
    [2008/10/23 20:37:27 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\jcinHUAUK.dll
    [2008/10/23 20:37:27 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\GDReadPub.dll
    [2008/10/23 20:37:27 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\jcidHUAUK.dll
    [2008/10/23 20:37:27 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\CEA_Crypt.dll
    [2008/10/23 20:37:27 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\jcutilTdrUKLCD.dll
    [2008/10/23 20:37:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\jcutilgem101101.dll
    [2008/10/23 20:37:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\jcinGEM101.dll
    [2008/10/23 20:37:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\jcidGEM101.dll
    [2008/10/23 20:37:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\jcidGD84.dll
    [2008/10/23 20:37:27 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\jcinGD84.dll
    [2008/10/23 20:37:27 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\hmukchk.dll
    [2008/10/23 20:37:27 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\RootCert.dll
    [2008/10/23 20:37:27 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\ChangPIN.dll
    [2008/10/23 20:37:27 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\jcinWATCHK.dll
    [2008/10/23 20:37:27 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\jcidWATCHK.dll
    [2008/01/06 14:44:28 | 000,000,071 | ---- | C] () -- C:\WINDOWS\SCRCFG.ini
    [2007/12/06 11:44:22 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
    [2007/10/20 15:10:41 | 000,000,014 | ---- | C] () -- C:\WINDOWS\Powerplayer.ini
    [2007/10/20 15:10:36 | 000,000,309 | ---- | C] () -- C:\WINDOWS\psnetwork.ini
    [2007/09/19 12:44:32 | 000,005,717 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
    [2007/09/14 15:54:36 | 000,397,312 | ---- | C] () -- C:\WINDOWS\System32\CMBEdit.dll
    [2007/09/04 18:56:10 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
    [2007/09/03 06:26:00 | 000,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
    [2007/08/12 11:46:11 | 000,000,058 | ---- | C] () -- C:\WINDOWS\System32\wangwangver.ini
    [2007/06/18 18:13:53 | 000,000,211 | ---- | C] () -- C:\WINDOWS\AntHill.INI
    [2007/05/13 18:04:57 | 000,024,576 | ---- | C] () -- C:\WINDOWS\VMPipe.dll
    [2007/01/22 17:48:07 | 000,184,320 | ---- | C] () -- C:\WINDOWS\System32\GdApi.dll
    [2007/01/22 17:48:07 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\InputControl.dll
    [2007/01/22 17:48:07 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\EditControl.dll
    [2007/01/22 17:48:07 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\certInStall.dll
    [2007/01/22 17:48:07 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\UploadControl.dll
    [2007/01/22 17:48:07 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\SubmitControl.dll
    [2007/01/22 17:48:07 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\USBKey.dll
    [2007/01/22 17:48:07 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\GDSetLET.dll
    [2007/01/22 17:48:07 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\UnblkPIN.dll
    [2007/01/22 17:48:07 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\jcinGEM102.dll
    [2007/01/22 17:48:07 | 000,023,040 | ---- | C] () -- C:\WINDOWS\System32\jcidGEM102.dll
    [2007/01/22 17:48:07 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\GEMPIN01.dll
    [2007/01/01 19:30:13 | 000,068,608 | ---- | C] () -- C:\Documents and Settings\PC\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2006/12/26 19:27:18 | 000,001,752 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
    [2006/12/24 20:31:21 | 000,000,290 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
    [2006/12/21 02:42:11 | 000,796,584 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
    [2006/12/21 02:39:50 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2006/10/31 22:54:30 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
    [2006/10/31 22:52:38 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
    [2005/11/30 21:02:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
    [2005/11/30 21:02:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
    [2005/11/30 21:02:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
    [2005/11/30 21:02:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
    [2005/11/30 21:02:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
    [2005/11/30 21:02:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
    [2005/11/30 21:02:00 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
    [2004/08/04 12:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
    [2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
    [2003/01/01 00:28:05 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2002/05/15 12:58:38 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\v2k2_dec.dll
     
  18. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    And part 3

    ========== LOP Check ==========

    [2006/12/21 03:24:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
    [2007/09/19 13:25:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sandlot Games
    [2007/10/04 09:20:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
    [2008/01/26 12:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2008/03/31 20:43:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith
    [2009/03/25 21:39:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
    [2009/04/23 07:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    [2010/05/09 18:20:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
    [2010/10/28 14:49:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Thomson.ResearchSoft.Installers
    [2010/10/29 10:32:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
    [2010/10/29 11:24:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
    [2010/11/23 18:30:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2010/12/04 15:31:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\F-Secure
    [2006/12/23 10:23:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\rich s
    [2007/02/08 16:39:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\uTorrent
    [2007/06/16 14:38:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Leadertech
    [2007/08/09 22:02:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\ICBC Security Ctrl
    [2007/09/03 07:02:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\My Games
    [2007/09/22 18:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Uniblue
    [2007/10/20 15:10:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\ppStream
    [2007/10/21 13:52:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\www.51Live.com
    [2007/12/09 11:44:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Snapfish
    [2008/01/06 14:44:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\QQ
    [2008/01/06 14:46:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\QQUpdate
    [2008/05/06 21:30:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\LimeWire
    [2008/05/25 06:33:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Grisoft
    [2008/10/11 18:07:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Flickr
    [2009/02/28 21:48:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\888poker.net
    [2009/03/29 18:24:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Microgaming
    [2009/11/07 21:38:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\StreamTorrent
    [2009/11/19 13:30:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Thunderbird
    [2010/05/13 18:51:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\FreeAudioPack
    [2010/07/29 15:13:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\CheckPoint
    [2010/10/28 14:50:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\EndNote
    [2010/10/29 11:25:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\AVG10
    [2010/11/07 19:49:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\XPTpoker
    [2010/11/23 17:47:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\OpenOffice.org
    [2010/05/24 17:55:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Wuufsa
    [2010/11/24 23:51:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Pyti

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2010/12/08 07:55:32 | 754,974,720 | -HS- | M] () -- C:\pagefile.sys
    [2004/08/04 12:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
    [2004/08/04 12:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2010/12/05 19:01:52 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2006/12/21 01:55:22 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2006/12/21 01:55:22 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2006/12/21 01:55:22 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2006/12/21 01:55:22 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2007/08/26 07:02:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
    [2007/08/26 07:02:34 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
    [2007/09/01 10:56:32 | 000,000,164 | ---- | M] () -- C:\install.dat
    [2004/12/28 21:57:36 | 000,017,505 | R--- | M] () -- C:\DBI.EXE
    [2007/08/26 21:20:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
    [2007/08/26 21:20:30 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
    [2007/09/10 16:26:42 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
    [2007/09/10 16:26:42 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
    [2007/09/11 07:45:50 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
    [2007/09/11 07:45:50 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
    [2007/09/11 16:41:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
    [2007/09/11 16:41:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
    [2007/09/12 13:43:50 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
    [2007/09/12 13:43:50 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
    [2007/09/12 19:30:50 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
    [2007/09/12 19:30:50 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
    [2007/07/01 07:33:04 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
    [2007/07/01 07:33:04 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
    [2007/07/11 16:40:28 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
    [2007/07/11 16:40:28 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
    [2007/07/14 17:50:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
    [2007/07/14 17:50:54 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
    [2007/07/17 12:27:00 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
    [2007/07/17 12:27:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
    [2007/08/05 17:12:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
    [2007/08/05 17:12:34 | 000,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
    [2007/08/07 21:02:12 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
    [2007/08/07 21:02:12 | 000,000,268 | -H-- | M] () -- C:\sqmdata12.sqm
    [2007/08/08 21:43:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
    [2007/08/08 21:43:54 | 000,000,268 | -H-- | M] () -- C:\sqmdata13.sqm
    [2007/08/09 16:34:46 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
    [2007/08/09 16:34:46 | 000,000,268 | -H-- | M] () -- C:\sqmdata14.sqm
    [2007/08/09 20:25:00 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
    [2007/08/09 20:25:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata15.sqm
    [2007/08/09 20:29:04 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
    [2007/08/09 20:29:04 | 000,000,268 | -H-- | M] () -- C:\sqmdata16.sqm
    [2007/08/10 14:29:20 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
    [2007/08/10 14:29:20 | 000,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
    [2007/08/25 09:47:32 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
    [2007/08/25 09:47:32 | 000,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
    [2007/08/25 22:10:04 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
    [2007/08/25 22:10:04 | 000,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
    [2007/11/25 20:58:22 | 000,000,000 | ---- | M] () -- C:\netsign_debuginfo.txt
    [2002/12/21 00:00:00 | 000,053,248 | ---- | M] () -- C:\gendel32.exe
    [2010/05/16 09:16:56 | 000,000,132 | ---- | M] () -- C:\acqv_conn.log
    [2008/09/20 11:39:32 | 002,097,876 | ---- | M] () -- C:\MSDE2kLog.txt
    [2009/01/11 11:12:46 | 000,000,000 | ---- | M] () -- C:\log_lobby.txt
    [2009/01/11 11:12:46 | 000,000,000 | ---- | M] () -- C:\log_lobby_dumper.txt
    [2010/12/05 06:59:44 | 000,041,834 | ---- | M] () -- C:\TDSSKiller.2.4.10.1_05.12.2010_06.57.38_log.txt
    [2004/08/03 23:00:02 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/12/07 07:32:32 | 000,022,605 | ---- | M] () -- C:\ComboFix.txt
    [2010/12/05 18:52:28 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2007/02/28 07:40:10 | 000,001,042 | ---- | M] () -- C:\INSTALL.LOG
    [2007/01/29 08:40:04 | 000,000,004 | -HS- | M] () -- C:\dllimp_regmsft985

    < %systemroot%\Fonts\*.com >

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2006/12/21 01:54:54 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2003/06/18 17:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
    [2006/02/10 14:45:22 | 000,074,240 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp463.dll
    [2009/04/20 12:23:48 | 000,315,904 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpfpp70w.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >
    [2007/02/09 21:12:04 | 000,001,657 | ---- | M] () -- C:\Documents and Settings\All Users\Favorites\Storm Codec.lnk

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2003/01/01 00:24:20 | 000,901,120 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
    [2003/01/01 00:24:20 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2003/01/01 00:24:20 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2006/12/21 01:55:24 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini
    [2007/10/20 15:13:18 | 000,000,210 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\我要直播 2007.url

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2006/12/21 02:01:24 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\PC\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2010/12/04 17:54:36 | 002,457,600 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\PC\Desktop\RootkitBuster.exe
    [2010/09/01 15:33:50 | 000,083,968 | ---- | M] (eSage Lab) -- C:\Documents and Settings\PC\Desktop\remover.exe
    [2010/12/02 12:29:14 | 001,344,600 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\PC\Desktop\TDSSKiller.exe
    [2010/12/08 08:34:56 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC\Desktop\OTL.exe
    [2010/12/05 07:06:54 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\MBRCheck.exe
    [2010/12/05 18:26:22 | 003,984,562 | R--- | M] () -- C:\Documents and Settings\PC\Desktop\ComboFix.exe
    [2010/12/05 21:56:12 | 000,023,291 | ---- | M] () -- C:\Documents and Settings\PC\Desktop\ComboFix2.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >
    [2010/12/04 18:33:26 | 000,147,456 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\catchme.exe
    [2010/12/04 19:40:14 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC\My Documents\TFC.exe
    [2010/12/01 16:31:26 | 007,622,112 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\PC\My Documents\mbam-setup-1.50.0.0.exe
    [2010/12/04 14:51:46 | 000,874,272 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\PC\My Documents\jxpiinstall.exe
    [2010/12/04 15:49:28 | 003,349,000 | ---- | M] (McAfee, Inc.) -- C:\Documents and Settings\PC\My Documents\SecurityScan_Release.exe
    [2010/12/04 19:38:06 | 000,147,456 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\catchme(2).exe
    [2010/12/04 15:52:00 | 001,912,872 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\PC\My Documents\HousecallLauncher.exe
    [2010/12/04 18:14:54 | 001,376,832 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\sar_15_sfx.exe
    [2010/12/04 20:02:50 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\PC\My Documents\w1ryenmw.exe
    [2010/12/05 18:48:44 | 001,086,304 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Documents and Settings\PC\My Documents\avg_remover_stf_x86_2011_1165.exe

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2006/12/21 02:01:22 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\PC\Favorites\Desktop.ini
    [2007/02/09 21:12:04 | 000,001,657 | ---- | M] () -- C:\Documents and Settings\PC\Favorites\Storm Codec.lnk

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2007/10/03 18:45:40 | 000,000,440 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/12/08 07:57:52 | 000,098,304 | ---- | M] () -- C:\Documents and Settings\PC\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2004/08/04 12:00:00 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2004/08/04 04:00:00 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 04:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/04 04:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 04:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 01:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 01:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2004/08/04 01:06:34 | 000,082,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2004/08/04 01:06:34 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2004/08/04 01:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 01:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm
    [2004/10/13 08:24:38 | 001,694,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Files - Unicode (All) ==========
    [2007/08/12 10:59:40 | 000,000,000 | ---D | M](C:\Program Files\ì?±|í?) -- C:\Program Files\ÌÔ±¦Íø
    [2007/08/12 10:59:40 | 000,000,000 | ---D | M](C:\Program Files\ì?±|í?) -- C:\Program Files\ÌÔ±¦Íø
    (C:\Program Files\ì?±|í?) -- C:\Program Files\ÌÔ±¦Íø

    < End of report >
     
  19. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Good news :)

    You can reinstall your AV program now.

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - No CLSID value found.
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - No CLSID value found.
      O2 - BHO: (no name) - {53763D1D-9CA8-4C7C-9756-A8E6B8FC063B} - No CLSID value found.
      O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
      O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - No CLSID value found.
      O2 - BHO: (no name) - {90760F64-1931-4AAC-8E2E-AB39AAC071E1} - No CLSID value found.
      O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No CLSID value found.
      O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll File not found
      O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
      O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
      O9 - Extra Button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Microgaming\Poker\ladbrokesMPP\MPPoker.exe File not found
      O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - E:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File not found
      O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - Reg Error: Key error. File not found
      O9 - Extra Button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe File not found
      O15 - HKCU\..Trusted Domains: com.cn ([mybank.icbc] https in Trusted sites)
      O15 - HKCU\..Trusted Domains: com.cn ([www.icbc] http in Trusted sites)
      O15 - HKCU\..Trusted Domains: shanghaiexpat.com ([jobs] http in Trusted sites)
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...22/wmv9VCM.CAB (Reg Error: Key error.)
      O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O20 - Winlogon\Notify\avgrsstarter: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
      [2010/02/27 17:22:13 | 000,004,865 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\bltofzsb.qlf
      [2009/06/12 17:28:09 | 000,004,987 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ojvzdisj.xda
      [2010/05/09 18:20:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
      [2008/05/25 06:33:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\Grisoft
      [2010/10/29 11:25:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Application Data\AVG10
      
      
      :Services
      
      :Reg
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ===================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  20. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Scan from OTL below. Doing other scans now...

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53763D1D-9CA8-4C7C-9756-A8E6B8FC063B}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53763D1D-9CA8-4C7C-9756-A8E6B8FC063B}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90760F64-1931-4AAC-8E2E-AB39AAC071E1}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90760F64-1931-4AAC-8E2E-AB39AAC071E1}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C2A80015-C447-4dc4-82DD-AED83D6ED57E}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2A80015-C447-4dc4-82DD-AED83D6ED57E}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{DDE87865-83C5-48c4-8357-2F5B1AA84522}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DDE87865-83C5-48c4-8357-2F5B1AA84522}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F47C1DB5-ED21-4dc1-853E-D1495792D4C5}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F47C1DB5-ED21-4dc1-853E-D1495792D4C5}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com.cn\mybank.icbc\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com.cn\www.icbc\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\shanghaiexpat.com\jobs\ deleted successfully.
    Starting removal of ActiveX control {0A5FD7C5-A45C-49FC-ADB5-9952547D5715}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ not found.
    Starting removal of ActiveX control {33564D57-0000-0010-8000-00AA00389B71}
    C:\WINDOWS\Downloaded Program Files\WMV9VCM.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33564D57-0000-0010-8000-00AA00389B71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
    Starting removal of ActiveX control {488A4255-3236-44B3-8F27-FA1AECAA8844}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{488A4255-3236-44B3-8F27-FA1AECAA8844}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{488A4255-3236-44B3-8F27-FA1AECAA8844}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{488A4255-3236-44B3-8F27-FA1AECAA8844}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{488A4255-3236-44B3-8F27-FA1AECAA8844}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{488A4255-3236-44B3-8F27-FA1AECAA8844}\ not found.
    Starting removal of ActiveX control {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter\ deleted successfully.
    C:\Documents and Settings\All Users\Application Data\bltofzsb.qlf moved successfully.
    C:\Documents and Settings\All Users\Application Data\ojvzdisj.xda moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Dumps folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Temp folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Log folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\CfgAll folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Cfg folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\admincli folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\AvgApi folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\AvgAm folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\emc folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update\backup folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update\prepare\temp folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update\prepare folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\scanlogs folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9 folder moved successfully.
    C:\Documents and Settings\PC\Application Data\Grisoft\AVG Antispyware 7.5\Reports folder moved successfully.
    C:\Documents and Settings\PC\Application Data\Grisoft\AVG Antispyware 7.5\quarantine folder moved successfully.
    C:\Documents and Settings\PC\Application Data\Grisoft\AVG Antispyware 7.5 folder moved successfully.
    C:\Documents and Settings\PC\Application Data\Grisoft folder moved successfully.
    C:\Documents and Settings\PC\Application Data\AVG10\cfgall folder moved successfully.
    C:\Documents and Settings\PC\Application Data\AVG10 folder moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 80704 bytes

    User: PC
    ->Temp folder emptied: 1180957 bytes
    ->Temporary Internet Files folder emptied: 735449 bytes
    ->Java cache emptied: 4336486 bytes
    ->FireFox cache emptied: 90897841 bytes
    ->Google Chrome cache emptied: 10554928 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 4513 bytes

    User: postgres
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: postgres.DESKTOP
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: postgres.DESKTOP.000
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 944331 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 288797 bytes

    Total Files Cleaned = 104.00 mb


    [EMPTYFLASH]

    User: Default User

    User: All Users

    User: NetworkService

    User: LocalService

    User: PC
    ->Flash cache emptied: 0 bytes

    User: postgres

    User: postgres.DESKTOP

    User: postgres.DESKTOP.000

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.3 log created on 12092010_084644

    Files\Folders moved on Reboot...
    C:\Documents and Settings\PC\Local Settings\Temp\~DF79AD.tmp moved successfully.
    File\Folder C:\WINDOWS\temp\ZLT076eb.TMP not found!

    Registry entries deleted on Reboot...
     
  21. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Ok, here are the other two logfiles. ESET detected Everest Poker as possible malware. This is a program I still use so would like to keep it! It's also detected as a FP by SBS&D

    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 2
    Out of date service pack!!
    Internet Explorer 6 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Disabled!
    AVG 2011
    McAfee Security Scan Plus
    ZoneAlarm
    Antivirus up to date!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 22
    Out of date Java installed!
    Adobe Flash Player 10.1.102.64
    Adobe Reader 8.1.4
    Chinese Simplified Fonts Support For Adobe Reader 8
    Mozilla Firefox (3.6.12) Firefox Out of Date!
    Mozilla Thunderbird (2.0.0) Thunderbird Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    AVG avgwdsvc.exe
    AVG avgtray.exe
    AVG avgrsx.exe
    AVG avgnsx.exe
    Zone Labs ZoneAlarm zlclient.exe
    ````````````````````````````````
    DNS Vulnerability Check:

    Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?)

    ``````````End of Log````````````

    C:\gendel32.exe Win32/HackTool.Gendel.A trojan
    C:\Program Files\Everest Poker\Everest Poker.exe a variant of Win32/Casino application
    C:\Program Files\Everest Poker\cstart-tmp.exe a variant of Win32/Casino application
    C:\Program Files\Everest Poker\CStart.exe a variant of Win32/Casino application
    C:\Program Files\Everest Poker\var\Everest Casino.exe a variant of Win32/Casino application
     
  22. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Update Internet Explorer to at least version 7. Version 6 is obsolete and thus dangerous.

    You need to install Service Pack 3.

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      
      :Services
      
      :Reg
      
      :Files
      C:\gendel32.exe
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ==================================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current (including Service Pack 3 installation and upgrading IE)

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
     
  23. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    That's great news, the computer is behaving well on search results and generally

    Here are the logs. To get OTL to finish running and reboot when setting a new system restore point, I had to run it in safe mode. Was that ok?

    All processes killed
    ========== OTL ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\gendel32.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 80987 bytes

    User: PC
    ->Temp folder emptied: 1093126 bytes
    ->Temporary Internet Files folder emptied: 735583 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 104347901 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 1941 bytes

    User: postgres
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: postgres.DESKTOP
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: postgres.DESKTOP.000
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 30554 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 101.00 mb


    [EMPTYFLASH]

    User: Default User

    User: All Users

    User: NetworkService

    User: LocalService

    User: PC
    ->Flash cache emptied: 0 bytes

    User: postgres

    User: postgres.DESKTOP

    User: postgres.DESKTOP.000

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.3 log created on 12102010_094309

    Files\Folders moved on Reboot...
    C:\Documents and Settings\PC\Local Settings\Temp\~DF2FBC.tmp moved successfully.
    File\Folder C:\WINDOWS\temp\ZLT0770b.TMP not found!

    Registry entries deleted on Reboot...

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: PC
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: postgres
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: postgres.DESKTOP
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: postgres.DESKTOP.000
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 0.00 mb


    [EMPTYFLASH]

    User: Default User

    User: All Users

    User: NetworkService

    User: LocalService

    User: PC
    ->Flash cache emptied: 0 bytes

    User: postgres

    User: postgres.DESKTOP

    User: postgres.DESKTOP.000

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.17.3 log created on 12102010_104111

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
  24. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    You did fine :)

    Way to go!! [​IMG]
    Good luck and stay safe :)
     
  25. ricardo1979

    ricardo1979 TS Rookie Topic Starter Posts: 16

    Thanks again for your efforts on this one. Really appreciate it.

    R
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...