TechSpot

Virus/malware that keeps coming back despite being removed with Malwarebytes

Inactive
By lunsk
Feb 28, 2012
  1. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Same in safe mode?

    What does BSOD say?
     
  2. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    I can get into safe mode

    BSOD says: a problems been detected...
    IQRL_NOT_LESS_OR_EQUAL
    .
    .
    Technical information:
    ***STOP: 0x0000000A (0x00000000, 0x00000002, 0x00000001, 0x8225A0EC)
     
  3. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Does it mention any file?

    See if you can run Combofix from safe mode now.
     
  4. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Doesn't mention any files, combofix still mentions security essentials and doesn't run
     
  5. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    I need more details.
    Are you trying to run it from safe mode?
    What exactly do you mean by "doesn't run"?
    I assume you're getting some warning about MSE and then what?
    What options does it give you?
     
  6. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Running from safe mode, asks me if I want to run despite essentials being on, I press OK and then nothing happens
     
  7. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Doesn't really give an option just "do you want to run it despite the risks?" and ok
     
  8. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Let's see, if we can look at your computer booting from an external source.

    Please download OTLPE (filesize 120,9 MB)

    • When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
    • Reboot your system using the boot CD you just created.
      • Note : If you do not know how to set your computer to boot from CD follow the steps here
    • Your system should now display a REATOGO-X-PE desktop.
    • Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
    • Double-click on the OTLPE icon.
    • When asked Do you wish to load the remote registry, select Yes
    • When asked Do you wish to load remote user profile(s) for scanning, select Yes
    • Ensure the box Automatically Load All Remaining Users" is checked and press OK
    • OTL should now start.
    • Under the Custom Scan box paste this in:

      /md5start
      explorer.exe
      winlogon.exe
      userinit.exe
      svchost.exe
      afd.sys
      /md5stop

    • Press Run Scan to start the scan.
    • When finished, the file will be saved in drive C:\OTL.txt
    • Copy this file to your USB drive if you do not have internet connection on this system
    • Please post the contents of the OTL.txt file in your reply.
     
  9. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    This is the same disc as yesterday correct?
     
  10. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Yes.........
     
  11. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Log is being split in 3:

    OTL logfile created on: 3/1/2012 12:43:26 PM - Run
    OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
    Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
    Internet Explorer (Version = 7.0.6001.18000)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
    3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 288.29 Gb Total Space | 3.83 Gb Free Space | 1.33% Space Free | Partition Type: NTFS
    Drive D: | 9.77 Gb Total Space | 5.59 Gb Free Space | 57.21% Space Free | Partition Type: NTFS
    Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: REATOGO | User Name: SYSTEM
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
    Using ControlSet: ControlSet001

    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto] -- -- (z800bus)
    SRV - File not found [Auto] -- -- (slimsvc)
    SRV - File not found [Auto] -- -- (se58mdfl)
    SRV - File not found [Auto] -- -- (pnmsrv)
    SRV - File not found [Auto] -- -- (p17)
    SRV - File not found [Auto] -- -- (omniinet)
    SRV - File not found [Auto] -- -- (iPassPeriodicUpdateApp)
    SRV - File not found [Auto] -- -- (imonitor)
    SRV - File not found [Auto] -- -- (downloadmanagerlite)
    SRV - File not found [Auto] -- -- (DCamUSBGrandTek)
    SRV - File not found [Auto] -- -- (aw_host)
    SRV - File not found [Auto] -- -- (ARSVC)
    SRV - [2011/12/18 12:48:07 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
    SRV - [2011/06/21 18:57:40 | 000,196,912 | ---- | M] (Nitro PDF Software) [Auto] -- C:\Program Files\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe -- (NitroReaderDriverReadSpool2)
    SRV - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
    SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
    SRV - [2009/06/23 10:54:18 | 000,061,760 | ---- | M] (Nalpeiron Ltd.) [Auto] -- C:\Windows\System32\ASTSRV.EXE -- (astcc)
    SRV - [2009/02/19 15:10:54 | 000,238,968 | ---- | M] (Symantec Corporation) [Disabled] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
    SRV - [2009/02/19 15:09:53 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
    SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
    SRV - [2008/04/28 16:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
    SRV - [2008/03/25 21:53:16 | 000,302,144 | ---- | M] (DigitalPersona, Inc.) [Auto] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
    SRV - [2008/03/14 00:03:44 | 000,221,239 | ---- | M] (IDT, Inc.) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\stacsv.exe -- (STacSV)
    SRV - [2008/03/14 00:03:40 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\AEstSrv.exe -- (AESTFilters)
    SRV - [2008/02/29 04:37:16 | 001,053,944 | ---- | M] (AuthenTec, Inc.) [Auto] -- C:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\venturi2.dll -- (ZSMC303)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\w200obex.dll -- (U81xmgmt)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\xaudioservice.dll -- (SetupSys)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\mqdmmdfl.dll -- (elaunidr)
    SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2007/10/03 15:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand] -- -- (XDva391)
    DRV - File not found [Kernel | On_Demand] -- -- (XDva195)
    DRV - File not found [Kernel | System] -- -- (tdx)
    DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
    DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
    DRV - File not found [Kernel | System] -- -- (netbt)
    DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
    DRV - File not found [Kernel | System] -- -- (i8042prt)
    DRV - File not found [Kernel | On_Demand] -- -- (GGSAFERDriver)
    DRV - File not found [Kernel | On_Demand] -- -- (GarenaPEngine)
    DRV - File not found [Kernel | On_Demand] -- -- (EagleNT)
    DRV - File not found [Kernel | System] -- -- (cdrom)
    DRV - File not found [Kernel | On_Demand] -- -- (catchme)
    DRV - File not found [Kernel | System] -- -- (ASPI32)
    DRV - [2011/07/21 15:35:19 | 000,500,704 | ---- | M] (AhnLab, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\EagleXNt.sys -- (EagleXNt)
    DRV - [2011/06/27 18:41:51 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto] -- C:\Windows\System32\STEC3.sys -- (STEC3)
    DRV - [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
    DRV - [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
    DRV - [2009/03/18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
    DRV - [2008/11/17 06:29:08 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
    DRV - [2008/08/07 14:57:05 | 000,716,272 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
    DRV - [2008/08/04 13:17:40 | 000,046,464 | ---- | M] (www.wiselogic.co.kr) [Kernel | On_Demand] -- C:\Windows\System32\XDva189.sys -- (XDva189)
    DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
    DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
    DRV - [2008/04/22 16:33:30 | 000,038,856 | ---- | M] (Teruten Co. LTD.) [Kernel | On_Demand] -- C:\Windows\System32\GDISpy.sys -- (GDISpyDevice)
    DRV - [2008/04/18 21:43:40 | 000,170,032 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
    DRV - [2008/03/14 08:04:26 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
    DRV - [2008/03/14 00:03:48 | 000,374,784 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
    DRV - [2008/03/13 06:45:50 | 000,548,352 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)
    DRV - [2008/03/11 01:53:02 | 000,149,208 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Ufd.sys -- (OA001Ufd)
    DRV - [2008/03/11 01:53:00 | 000,277,624 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Vid.sys -- (OA001Vid)
    DRV - [2008/03/11 01:42:24 | 000,203,264 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
    DRV - [2008/03/11 01:24:46 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
    DRV - [2008/03/11 01:24:44 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
    DRV - [2008/03/11 01:24:42 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
    DRV - [2008/01/20 21:24:55 | 000,075,264 | ---- | M] () [File_System | System] -- C:\Windows\System32\drivers\dfsc.sys -- (DfsC)
    DRV - [2008/01/20 21:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
    DRV - [2007/11/02 05:47:38 | 000,109,992 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdm.sys -- (s916mdm)
    DRV - [2007/11/02 05:47:38 | 000,103,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mgmt.sys -- (s916mgmt) Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM)
    DRV - [2007/11/02 05:47:38 | 000,100,008 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916obex.sys -- (s916obex)
    DRV - [2007/11/02 05:47:38 | 000,083,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916bus.sys -- (s916bus) Sony Ericsson Device 916 driver (WDM)
    DRV - [2007/11/02 05:47:38 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdfl.sys -- (s916mdfl)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
     
     
  12. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "https://weblogin.utoronto.ca/|https://portal.utoronto.ca/webapps/portal/frameset.jsp|https://www.rosi.utoronto.ca/"
    FF - prefs.js..extensions.enabledItems: ankpixiv@snca.net:1.14.4
    FF - prefs.js..extensions.enabledItems: peraperakun-chinese@gmail.com:1.0
    FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
    FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
    FF - prefs.js..extensions.enabledItems: nicofox@littlebtc:0.4b1
    FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9
    FF - prefs.js..extensions.enabledItems: chineseperakun@gmail.com:2.1.1
    FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.7.5
    FF - prefs.js..extensions.enabledItems: {f701c26a-479a-4724-b4f1-870db12f063c}:1.4.4
    FF - prefs.js..extensions.enabledItems: {a95d8332-e4b4-6e7f-98ac-20b733364387}:0.5.2
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
    FF - prefs.js..network.proxy.backup.ftp: ""
    FF - prefs.js..network.proxy.backup.ftp_port: 0
    FF - prefs.js..network.proxy.backup.socks: ""
    FF - prefs.js..network.proxy.backup.socks_port: 0
    FF - prefs.js..network.proxy.backup.ssl: ""
    FF - prefs.js..network.proxy.backup.ssl_port: 0
    FF - prefs.js..network.proxy.ftp: "69.120.137.143"
    FF - prefs.js..network.proxy.ftp_port: 27977
    FF - prefs.js..network.proxy.http: "69.120.137.143"
    FF - prefs.js..network.proxy.http_port: 27977
    FF - prefs.js..network.proxy.share_proxy_settings: true
    FF - prefs.js..network.proxy.socks: "69.120.137.143"
    FF - prefs.js..network.proxy.socks_port: 27977
    FF - prefs.js..network.proxy.ssl: "69.120.137.143"
    FF - prefs.js..network.proxy.ssl_port: 27977

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: File not found
    FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\System32\npOGPPlugin.dll (OGPlanet)
    FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
    FF - HKLM\Software\MozillaPlugins\NitroPDF: C:\Program Files\Nitro PDF\Reader 2\npnitromozilla.dll ( )
    FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Jonathan\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
    FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/28 18:56:10 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/17 09:31:58 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/24 15:55:52 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/08/17 08:08:59 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\Jonathan\Program Files\DNA [2012/02/29 16:13:51 | 000,000,000 | ---D | M]

    [2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions
    [2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
    [2012/02/25 09:25:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions
    [2011/10/20 23:04:03 | 000,000,000 | ---D | M] (Rikaichan) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82}
    [2012/01/26 15:02:36 | 000,000,000 | ---D | M] (GameFOX) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{6dd0bdba-0a02-429e-b595-87a7dfdca7a1}
    [2009/01/08 22:34:09 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(17)
    [2012/01/09 15:31:46 | 000,000,000 | ---D | M] (Perapera Chinese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\chineseperakun@gmail.com
    [2012/01/10 10:18:24 | 000,000,000 | ---D | M] (Perapera Japanese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\peraperakun@gmail.com
    [2011/05/28 19:17:18 | 000,000,000 | ---D | M] (Rikaichan Japanese-English Dictionary File) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\rikaichan-jpen@polarcloud.com
    [2008/07/28 14:12:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    File not found (No name found) --
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{35106BCA-6C78-48C7-AC28-56DF30B51D2C}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A95D8332-E4B4-6E7F-98AC-20B733364387}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{F701C26A-479A-4724-B4F1-870DB12F063C}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\ANKPIXIV@SNCA.NET.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\NICOFOX@LITTLEBTC.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-CHINESE@GMAIL.COM.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-JPEN@GMAIL.COM.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\TABCOUNT@3GREENEGGS.COM.XPI
    [2012/02/17 09:31:57 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2011/03/22 13:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
    [2011/10/04 20:04:03 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2011/11/09 20:17:12 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

    Hosts file not found
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
    O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
    O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
    O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
    O4 - HKLM..\Run: [DellSupportCenter] File not found
    O4 - HKLM..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\DpAgent.exe (DigitalPersona, Inc.)
    O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
    O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
    O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
    O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
    O4 - HKU\Jonathan_ON_C..\Run: [BitTorrent DNA] C:\Users\Jonathan\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
    O4 - HKU\Jonathan_ON_C..\Run: [DellSupportCenter] File not found
    O4 - HKU\.DEFAULT..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10a.exe (Adobe Systems, Inc.)
    O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\thunderbird - Shortcut.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
    O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - File not found
    O13 - gopher Prefix: missing
    O16 - DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab (Symantec Configuration Class)
    O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
    O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab (RIM AxLoader)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O24 - Desktop WallPaper:
    O24 - Desktop BackupWallPaper:
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
    O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/03/01 00:06:25 | 000,000,000 | ---D | C] -- C:\_OTL
    [2012/02/29 21:54:04 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2012/02/29 15:32:17 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
    [2012/02/29 15:30:10 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
    [2012/02/29 13:14:26 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netbt.svs
    [2012/02/29 12:04:17 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2012/02/29 12:04:07 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
    [2012/02/29 01:15:03 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\afd.svs
    [2012/02/28 23:43:39 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2012/02/28 23:43:39 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2012/02/28 23:43:39 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2012/02/28 23:36:05 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2012/02/28 23:34:17 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/02/28 23:26:34 | 004,422,703 | R--- | C] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
    [2012/02/28 22:32:20 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\RK_Quarantine
    [2012/02/28 18:15:11 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\LA
    [2012/02/28 02:02:10 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\DO THIS
    [2012/02/28 00:26:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
    [2012/02/28 00:25:49 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
    [2012/02/27 23:56:02 | 000,000,000 | ---D | C] -- C:\Windows\Sun
    [2012/02/27 23:52:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
    [2012/02/27 23:52:53 | 000,000,000 | ---D | C] -- C:\Program Files\MozBackup
    [2012/02/26 15:43:14 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Mobile Suit Gundam Novel
    [2012/02/24 21:17:48 | 000,000,000 | ---D | C] -- C:\ProgramData\YouTube Downloader
    [2012/02/24 21:17:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
    [2012/02/24 21:17:43 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader
    [2012/02/24 00:17:42 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\(C81) [ReDrop (Miyamoto Smoke, Otsumami)] Minna no Asuka Bon (Neon Genesis Evangelion) [English] =LWB=
    [2012/02/18 04:23:06 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Spice and Wolf Light Novel
    [2012/02/16 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Inkey
    [2012/02/14 18:02:18 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\[DA HOOTCH (ShindoL)] Field Work Ch1-2
    [2012/02/07 18:12:52 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\SRWZ
    [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2012/03/01 12:32:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2012/03/01 11:46:56 | 000,600,882 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2012/03/01 11:46:56 | 000,105,658 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2012/02/29 20:27:19 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif
    [2012/02/29 20:05:37 | 000,232,960 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2012/02/29 17:11:33 | 000,396,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2012/02/29 14:06:36 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
    [2012/02/29 13:44:38 | 000,006,944 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
    [2012/02/28 23:26:48 | 004,422,703 | R--- | M] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
    [2012/02/28 00:26:20 | 000,000,878 | ---- | M] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
    [2012/02/28 00:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
    [2012/02/27 23:55:10 | 076,871,504 | ---- | M] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
    [2012/02/27 23:52:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
    [2012/02/27 18:20:32 | 080,340,888 | ---- | M] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
    [2012/02/26 23:41:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASX to MP3 Converter
    [2012/02/26 23:09:31 | 000,001,078 | ---- | M] () -- C:\Users\Jonathan\Desktop\ASX to MP3 Converter.lnk
    [2012/02/26 23:06:13 | 000,114,688 | ---- | M] () -- C:\Windows\System32\msvos.dll
    [2012/02/26 22:51:53 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia10.asx
    [2012/02/26 22:51:36 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia11.asx
    [2012/02/26 22:19:51 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia12.asx
    [2012/02/26 17:05:34 | 000,362,348 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
    [2012/02/26 16:03:24 | 013,456,449 | ---- | M] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
    [2012/02/24 21:17:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
    [2012/02/23 12:50:23 | 000,262,938 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
    [2012/02/20 02:44:00 | 000,257,373 | ---- | M] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
    [2012/02/18 20:38:46 | 039,022,043 | ---- | M] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
    [2012/02/18 20:38:14 | 002,185,701 | ---- | M] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
    [2012/02/15 10:34:02 | 149,144,660 | ---- | M] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
    [2012/02/12 22:14:20 | 000,397,103 | ---- | M] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
    [2012/02/05 17:37:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pokemon Online
    [2012/02/01 12:11:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
     
  13. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    ========== Files Created - No Company Name ==========

    [2012/03/01 00:06:27 | 000,273,920 | ---- | C] () -- C:\Windows\System32\drivers\afd.sys
    [2012/02/28 23:43:39 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2012/02/28 23:43:39 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2012/02/28 23:43:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2012/02/28 23:43:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2012/02/28 23:43:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2012/02/28 00:26:20 | 000,000,878 | ---- | C] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
    [2012/02/27 23:54:27 | 076,871,504 | ---- | C] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
    [2012/02/27 18:16:47 | 080,340,888 | ---- | C] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
    [2012/02/26 22:51:48 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia10.asx
    [2012/02/26 22:51:32 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia11.asx
    [2012/02/26 17:05:32 | 000,362,348 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
    [2012/02/26 16:01:37 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia12.asx
    [2012/02/26 15:59:07 | 013,456,449 | ---- | C] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
    [2012/02/23 12:50:22 | 000,262,938 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
    [2012/02/20 02:43:52 | 000,257,373 | ---- | C] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
    [2012/02/18 20:38:05 | 002,185,701 | ---- | C] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
    [2012/02/18 20:38:00 | 039,022,043 | ---- | C] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
    [2012/02/15 10:27:21 | 149,144,660 | ---- | C] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
    [2012/02/12 22:14:20 | 000,397,103 | ---- | C] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
    [2012/01/19 22:07:25 | 000,051,186 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room_v3.dat
    [2011/08/25 20:49:57 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
    [2011/08/25 20:49:56 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
    [2011/08/25 20:49:51 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
    [2011/08/25 20:49:51 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
    [2011/08/25 20:49:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
    [2011/07/21 00:56:16 | 000,090,112 | ---- | C] () -- C:\Windows\System32\imsfchk.dll
    [2011/07/21 00:56:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\imslevel.dll
    [2011/06/18 10:22:19 | 000,230,529 | ---- | C] () -- C:\Windows\System32\libpng14-14.dll
    [2011/06/18 10:22:19 | 000,100,352 | ---- | C] () -- C:\Windows\System32\zlib1.dll
    [2011/06/18 10:22:19 | 000,098,590 | ---- | C] () -- C:\Windows\System32\libwimp.dll
    [2011/06/18 10:22:19 | 000,062,130 | ---- | C] () -- C:\Windows\System32\libpixmap.dll
    [2011/06/18 10:22:18 | 000,103,029 | ---- | C] () -- C:\Windows\System32\libpangocairo-1.0-0.dll
    [2011/06/18 10:22:18 | 000,060,537 | ---- | C] () -- C:\Windows\System32\libgailutil-18.dll
    [2011/06/18 10:22:17 | 001,136,422 | ---- | C] () -- C:\Windows\System32\libcairo-2.dll
    [2011/06/18 10:22:17 | 000,551,096 | ---- | C] () -- C:\Windows\System32\freetype6.dll
    [2011/06/18 10:22:17 | 000,466,257 | ---- | C] () -- C:\Windows\System32\libgail.dll
    [2011/06/18 10:22:17 | 000,279,059 | ---- | C] () -- C:\Windows\System32\libfontconfig-1.dll
    [2011/06/18 10:22:17 | 000,143,096 | ---- | C] () -- C:\Windows\System32\libexpat-1.dll
    [2011/03/22 20:36:53 | 000,041,890 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room.dat
    [2011/02/09 23:03:48 | 000,000,314 | ---- | C] () -- C:\Windows\primopdf.ini
    [2010/06/15 14:59:08 | 000,073,728 | ---- | C] () -- C:\Windows\System32\imsaiff.dll
    [2010/06/15 14:59:08 | 000,036,864 | ---- | C] () -- C:\Windows\System32\DGRip.dll
    [2010/05/08 21:26:27 | 000,165,425 | ---- | C] () -- C:\Windows\hpoins28.dat.temp
    [2009/11/03 09:38:35 | 000,388,112 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
    [2009/10/27 23:01:35 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
    [2009/08/03 17:47:10 | 000,006,328 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\PrimoPDFSet.xml
    [2009/08/03 17:45:12 | 000,180,624 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
    [2009/07/09 09:32:07 | 000,000,056 | ---- | C] () -- C:\Windows\kgt2k.INI
    [2009/07/08 20:03:02 | 000,058,880 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll
    [2009/06/17 10:17:36 | 000,004,508 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
    [2009/05/12 14:23:05 | 000,000,398 | ---- | C] () -- C:\Windows\AudioConverter.INI
    [2009/03/06 23:29:32 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat.temp
    [2009/03/06 22:45:47 | 000,165,697 | ---- | C] () -- C:\Windows\hpoins28.dat
    [2008/10/26 19:01:59 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
    [2008/10/08 09:07:37 | 000,008,248 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\en.ini
    [2008/08/02 13:11:21 | 000,023,888 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\UserTile.png
    [2008/08/01 23:07:07 | 000,077,940 | ---- | C] () -- C:\Windows\War3Unin.dat
    [2008/07/29 23:15:09 | 000,006,944 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
    [2008/07/28 21:58:01 | 000,232,960 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/07/28 13:50:51 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
    [2008/07/28 13:50:51 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
    [2008/07/16 23:55:43 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
    [2008/07/16 23:55:43 | 000,168,883 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
    [2008/07/16 23:55:43 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
    [2008/07/16 23:55:43 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe
    [2008/07/16 21:22:33 | 000,000,076 | RHS- | C] () -- C:\Windows\CT4CET.bin
    [2008/07/16 21:16:21 | 000,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
    [2008/07/16 21:16:20 | 000,026,112 | ---- | C] () -- C:\Windows\System32\WLTRYSVC.EXE
    [2008/07/16 16:00:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
    [2008/05/11 22:49:03 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat
    [2008/04/29 13:42:24 | 000,503,808 | ---- | C] () -- C:\Windows\System32\ICCProfiles.dll
    [2008/01/20 21:24:55 | 000,075,264 | ---- | C] () -- C:\Windows\System32\drivers\dfsc.sys
    [2007/11/26 21:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
    [2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2006/11/02 07:47:37 | 000,396,976 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
    [2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/02 05:33:01 | 000,600,882 | ---- | C] () -- C:\Windows\System32\perfh009.dat
    [2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
    [2006/11/02 05:33:01 | 000,105,658 | ---- | C] () -- C:\Windows\System32\perfc009.dat
    [2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
    [2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
    [2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
    [2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
    [2005/03/30 11:29:16 | 000,114,688 | ---- | C] () -- C:\Windows\System32\msvos.dll

    ========== LOP Check ==========

    [2011/10/08 21:33:46 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Audacity
    [2008/07/28 13:42:32 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DigitalPersona
    [2012/02/29 15:55:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DNA
    [2010/12/08 15:43:13 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Downloaded Installations
    [2011/05/26 12:05:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Dropbox
    [2011/07/22 21:02:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\GetRightToGo
    [2010/06/26 10:18:54 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\IObit
    [2010/08/25 14:51:51 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\JAM Software
    [2011/07/22 21:12:31 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Music Recognition
    [2010/04/07 10:31:12 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NCH Swift Sound
    [2009/10/13 13:33:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NeopleLauncherDFO
    [2011/12/08 12:17:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Nitro PDF
    [2011/12/08 12:15:26 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\OpenCandy
    [2010/12/09 23:12:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PCDr
    [2008/08/02 13:11:21 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PeerNetworking
    [2011/07/11 17:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Lab
    [2011/07/09 23:07:05 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Online
    [2011/12/08 12:17:57 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PrimoPDF
    [2009/10/16 18:34:06 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\RenPy
    [2009/05/12 11:22:01 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\River Past G5
    [2010/12/17 13:35:42 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Sony
    [2008/09/07 17:09:33 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SonyEricsson
    [2010/10/04 19:40:10 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Synthesia
    [2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SYSTEMAX Software Development
    [2010/08/20 08:11:08 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Thunderbird
    [2012/02/28 19:59:59 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\uTorrent
    [2009/12/30 12:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\VBA-M
    [2008/07/29 20:01:29 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Windows Live Writer
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
    [2008/08/09 22:26:58 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
    [2008/10/29 15:55:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Citrix
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
    [2010/04/07 10:29:38 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound
    [2009/10/27 15:18:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Nexon
    [2011/09/11 16:35:36 | 000,000,000 | ---D | M] -- C:\ProgramData\NexonUS
    [2011/12/08 12:16:30 | 000,000,000 | ---D | M] -- C:\ProgramData\Nitro PDF
    [2011/05/24 15:14:54 | 000,000,000 | ---D | M] -- C:\ProgramData\PCDr
    [2011/05/02 22:20:11 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
    [2009/05/12 13:52:39 | 000,000,000 | ---D | M] -- C:\ProgramData\River Past G5
    [2008/09/06 19:01:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
    [2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
    [2008/10/09 11:23:29 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
    [2008/07/16 21:25:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Uninstall
    [2008/09/23 13:41:44 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
    [2012/01/30 18:58:57 | 000,000,000 | ---D | M] -- C:\ProgramData\youku
    [2012/02/24 21:17:52 | 000,000,000 | ---D | M] -- C:\ProgramData\YouTube Downloader
    [2011/01/30 23:23:07 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2009/10/19 16:59:18 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2012/02/29 16:57:54 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========



    < MD5 for: AFD.SYS >
    [2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\System32\drivers\afd.sys
    [2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys

    < MD5 for: EXPLORER.EXE >
    [2008/10/29 01:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
    [2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
    [2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
    [2008/10/29 22:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
    [2008/10/27 21:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
    [2008/01/20 21:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

    < MD5 for: SVCHOST.EXE >
    [2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
    [2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
    [2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

    < MD5 for: USERINIT.EXE >
    [2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
    [2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

    < MD5 for: WINLOGON.EXE >
    [2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
    [2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
    [2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

    ========== Files - Unicode (All) ==========
    [2010/06/22 23:17:59 | 000,769,473 | ---- | C] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
    [2010/06/21 10:39:53 | 000,769,473 | ---- | M] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
    [2009/10/06 23:06:03 | 005,765,164 | ---- | M] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
    [2009/10/06 23:05:37 | 005,765,164 | ---- | C] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
    < End of report >
     
  14. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Also, if it's the same as yesterday. After I apply th fix.txt, do I reboot with the disc still in it? Yesterday when I tried to reboot, the disc ejected and I went into Windows normally, not sure if that caused any problems because you said to reboot and then eject the disc and shut down manually. Which I also tried, but I could not shut down after I ejected the disc, so I had to forcifully turn it off. Not sure if that caused any problems
     
  15. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Restart computer back to safe mode or to safe mode with networking if it works.
    Download afd.sys file from here: http://www.uploadmb.com/dw.php?id=1330627560 (it comes from my computer.
    Paste the file to the root C:\ directory.

    Restart to OTLPE CD and re-run OTL with the very same script as last time.
    Post new log.
     
  16. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Splitting log in 3:

    OTL logfile created on: 3/1/2012 2:13:06 PM - Run
    OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
    Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
    Internet Explorer (Version = 7.0.6001.18000)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
    3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 288.29 Gb Total Space | 3.84 Gb Free Space | 1.33% Space Free | Partition Type: NTFS
    Drive D: | 9.77 Gb Total Space | 5.59 Gb Free Space | 57.21% Space Free | Partition Type: NTFS
    Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: REATOGO | User Name: SYSTEM
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
    Using ControlSet: ControlSet001

    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto] -- -- (z800bus)
    SRV - File not found [Auto] -- -- (slimsvc)
    SRV - File not found [Auto] -- -- (se58mdfl)
    SRV - File not found [Auto] -- -- (pnmsrv)
    SRV - File not found [Auto] -- -- (p17)
    SRV - File not found [Auto] -- -- (omniinet)
    SRV - File not found [Auto] -- -- (iPassPeriodicUpdateApp)
    SRV - File not found [Auto] -- -- (imonitor)
    SRV - File not found [Auto] -- -- (downloadmanagerlite)
    SRV - File not found [Auto] -- -- (DCamUSBGrandTek)
    SRV - File not found [Auto] -- -- (aw_host)
    SRV - File not found [Auto] -- -- (ARSVC)
    SRV - [2011/12/18 12:48:07 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
    SRV - [2011/06/21 18:57:40 | 000,196,912 | ---- | M] (Nitro PDF Software) [Auto] -- C:\Program Files\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe -- (NitroReaderDriverReadSpool2)
    SRV - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
    SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
    SRV - [2009/06/23 10:54:18 | 000,061,760 | ---- | M] (Nalpeiron Ltd.) [Auto] -- C:\Windows\System32\ASTSRV.EXE -- (astcc)
    SRV - [2009/02/19 15:10:54 | 000,238,968 | ---- | M] (Symantec Corporation) [Disabled] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
    SRV - [2009/02/19 15:09:53 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
    SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
    SRV - [2008/04/28 16:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
    SRV - [2008/03/25 21:53:16 | 000,302,144 | ---- | M] (DigitalPersona, Inc.) [Auto] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
    SRV - [2008/03/14 00:03:44 | 000,221,239 | ---- | M] (IDT, Inc.) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\stacsv.exe -- (STacSV)
    SRV - [2008/03/14 00:03:40 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\AEstSrv.exe -- (AESTFilters)
    SRV - [2008/02/29 04:37:16 | 001,053,944 | ---- | M] (AuthenTec, Inc.) [Auto] -- C:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\venturi2.dll -- (ZSMC303)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\w200obex.dll -- (U81xmgmt)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\xaudioservice.dll -- (SetupSys)
    SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\mqdmmdfl.dll -- (elaunidr)
    SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2007/10/03 15:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand] -- -- (XDva391)
    DRV - File not found [Kernel | On_Demand] -- -- (XDva195)
    DRV - File not found [Kernel | System] -- -- (tdx)
    DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
    DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
    DRV - File not found [Kernel | System] -- -- (netbt)
    DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
    DRV - File not found [Kernel | System] -- -- (i8042prt)
    DRV - File not found [Kernel | On_Demand] -- -- (GGSAFERDriver)
    DRV - File not found [Kernel | On_Demand] -- -- (GarenaPEngine)
    DRV - File not found [Kernel | On_Demand] -- -- (EagleNT)
    DRV - File not found [Kernel | System] -- -- (cdrom)
    DRV - File not found [Kernel | On_Demand] -- -- (catchme)
    DRV - File not found [Kernel | System] -- -- (ASPI32)
    DRV - [2011/07/21 15:35:19 | 000,500,704 | ---- | M] (AhnLab, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\EagleXNt.sys -- (EagleXNt)
    DRV - [2011/06/27 18:41:51 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto] -- C:\Windows\System32\STEC3.sys -- (STEC3)
    DRV - [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
    DRV - [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
    DRV - [2009/03/18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
    DRV - [2008/11/17 06:29:08 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
    DRV - [2008/08/07 14:57:05 | 000,716,272 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
    DRV - [2008/08/04 13:17:40 | 000,046,464 | ---- | M] (www.wiselogic.co.kr) [Kernel | On_Demand] -- C:\Windows\System32\XDva189.sys -- (XDva189)
    DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
    DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
    DRV - [2008/04/22 16:33:30 | 000,038,856 | ---- | M] (Teruten Co. LTD.) [Kernel | On_Demand] -- C:\Windows\System32\GDISpy.sys -- (GDISpyDevice)
    DRV - [2008/04/18 21:43:40 | 000,170,032 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
    DRV - [2008/03/14 08:04:26 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
    DRV - [2008/03/14 00:03:48 | 000,374,784 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
    DRV - [2008/03/13 06:45:50 | 000,548,352 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)
    DRV - [2008/03/11 01:53:02 | 000,149,208 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Ufd.sys -- (OA001Ufd)
    DRV - [2008/03/11 01:53:00 | 000,277,624 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Vid.sys -- (OA001Vid)
    DRV - [2008/03/11 01:42:24 | 000,203,264 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
    DRV - [2008/03/11 01:24:46 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
    DRV - [2008/03/11 01:24:44 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
    DRV - [2008/03/11 01:24:42 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
    DRV - [2008/01/20 21:24:55 | 000,075,264 | ---- | M] () [File_System | System] -- C:\Windows\System32\drivers\dfsc.sys -- (DfsC)
    DRV - [2008/01/20 21:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
    DRV - [2007/11/02 05:47:38 | 000,109,992 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdm.sys -- (s916mdm)
    DRV - [2007/11/02 05:47:38 | 000,103,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mgmt.sys -- (s916mgmt) Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM)
    DRV - [2007/11/02 05:47:38 | 000,100,008 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916obex.sys -- (s916obex)
    DRV - [2007/11/02 05:47:38 | 000,083,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916bus.sys -- (s916bus) Sony Ericsson Device 916 driver (WDM)
    DRV - [2007/11/02 05:47:38 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdfl.sys -- (s916mdfl)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local




    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "https://weblogin.utoronto.ca/|https://portal.utoronto.ca/webapps/portal/frameset.jsp|https://www.rosi.utoronto.ca/"
    FF - prefs.js..extensions.enabledItems: ankpixiv@snca.net:1.14.4
    FF - prefs.js..extensions.enabledItems: peraperakun-chinese@gmail.com:1.0
    FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
    FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
    FF - prefs.js..extensions.enabledItems: nicofox@littlebtc:0.4b1
    FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9
    FF - prefs.js..extensions.enabledItems: chineseperakun@gmail.com:2.1.1
    FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.7.5
    FF - prefs.js..extensions.enabledItems: {f701c26a-479a-4724-b4f1-870db12f063c}:1.4.4
    FF - prefs.js..extensions.enabledItems: {a95d8332-e4b4-6e7f-98ac-20b733364387}:0.5.2
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
    FF - prefs.js..network.proxy.backup.ftp: ""
    FF - prefs.js..network.proxy.backup.ftp_port: 0
    FF - prefs.js..network.proxy.backup.socks: ""
    FF - prefs.js..network.proxy.backup.socks_port: 0
    FF - prefs.js..network.proxy.backup.ssl: ""
    FF - prefs.js..network.proxy.backup.ssl_port: 0
    FF - prefs.js..network.proxy.ftp: "69.120.137.143"
    FF - prefs.js..network.proxy.ftp_port: 27977
    FF - prefs.js..network.proxy.http: "69.120.137.143"
    FF - prefs.js..network.proxy.http_port: 27977
    FF - prefs.js..network.proxy.share_proxy_settings: true
    FF - prefs.js..network.proxy.socks: "69.120.137.143"
    FF - prefs.js..network.proxy.socks_port: 27977
    FF - prefs.js..network.proxy.ssl: "69.120.137.143"
    FF - prefs.js..network.proxy.ssl_port: 27977

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: File not found
    FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\System32\npOGPPlugin.dll (OGPlanet)
    FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
    FF - HKLM\Software\MozillaPlugins\NitroPDF: C:\Program Files\Nitro PDF\Reader 2\npnitromozilla.dll ( )
    FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Jonathan\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
    FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/28 18:56:10 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/17 09:31:58 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/24 15:55:52 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/08/17 08:08:59 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\Jonathan\Program Files\DNA [2012/02/29 16:13:51 | 000,000,000 | ---D | M]

    [2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions
    [2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
    [2012/02/25 09:25:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions
    [2011/10/20 23:04:03 | 000,000,000 | ---D | M] (Rikaichan) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82}
    [2012/01/26 15:02:36 | 000,000,000 | ---D | M] (GameFOX) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{6dd0bdba-0a02-429e-b595-87a7dfdca7a1}
    [2009/01/08 22:34:09 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(17)
    [2012/01/09 15:31:46 | 000,000,000 | ---D | M] (Perapera Chinese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\chineseperakun@gmail.com
    [2012/01/10 10:18:24 | 000,000,000 | ---D | M] (Perapera Japanese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\peraperakun@gmail.com
    [2011/05/28 19:17:18 | 000,000,000 | ---D | M] (Rikaichan Japanese-English Dictionary File) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\rikaichan-jpen@polarcloud.com
    [2008/07/28 14:12:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    File not found (No name found) --
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{35106BCA-6C78-48C7-AC28-56DF30B51D2C}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A95D8332-E4B4-6E7F-98AC-20B733364387}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{F701C26A-479A-4724-B4F1-870DB12F063C}.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\ANKPIXIV@SNCA.NET.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\NICOFOX@LITTLEBTC.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-CHINESE@GMAIL.COM.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-JPEN@GMAIL.COM.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI
    () (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\TABCOUNT@3GREENEGGS.COM.XPI
    [2012/02/17 09:31:57 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2011/03/22 13:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
    [2011/10/04 20:04:03 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2011/11/09 20:17:12 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
     
  17. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Hosts file not found
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
    O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
    O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
    O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
    O4 - HKLM..\Run: [DellSupportCenter] File not found
    O4 - HKLM..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\DpAgent.exe (DigitalPersona, Inc.)
    O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
    O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
    O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
    O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
    O4 - HKU\Jonathan_ON_C..\Run: [BitTorrent DNA] C:\Users\Jonathan\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
    O4 - HKU\Jonathan_ON_C..\Run: [DellSupportCenter] File not found
    O4 - HKU\.DEFAULT..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10a.exe (Adobe Systems, Inc.)
    O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\thunderbird - Shortcut.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
    O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - File not found
    O13 - gopher Prefix: missing
    O16 - DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab (Symantec Configuration Class)
    O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
    O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab (RIM AxLoader)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O24 - Desktop WallPaper:
    O24 - Desktop BackupWallPaper:
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
    O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/03/01 14:01:29 | 000,273,408 | ---- | C] (Microsoft Corporation) -- C:\afd.sys
    [2012/03/01 00:06:25 | 000,000,000 | ---D | C] -- C:\_OTL
    [2012/02/29 21:54:04 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2012/02/29 15:32:17 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
    [2012/02/29 15:30:10 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
    [2012/02/29 13:14:26 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netbt.svs
    [2012/02/29 12:04:17 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2012/02/29 12:04:07 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
    [2012/02/29 01:15:03 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\afd.svs
    [2012/02/28 23:43:39 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2012/02/28 23:43:39 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2012/02/28 23:43:39 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2012/02/28 23:36:05 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2012/02/28 23:34:17 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/02/28 23:26:34 | 004,422,703 | R--- | C] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
    [2012/02/28 22:32:20 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\RK_Quarantine
    [2012/02/28 18:15:11 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\LA
    [2012/02/28 02:02:10 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\DO THIS
    [2012/02/28 00:26:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
    [2012/02/28 00:25:49 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
    [2012/02/27 23:56:02 | 000,000,000 | ---D | C] -- C:\Windows\Sun
    [2012/02/27 23:52:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
    [2012/02/27 23:52:53 | 000,000,000 | ---D | C] -- C:\Program Files\MozBackup
    [2012/02/26 15:43:14 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Mobile Suit Gundam Novel
    [2012/02/24 21:17:48 | 000,000,000 | ---D | C] -- C:\ProgramData\YouTube Downloader
    [2012/02/24 21:17:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
    [2012/02/24 21:17:43 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader
    [2012/02/24 00:17:42 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\(C81) [ReDrop (Miyamoto Smoke, Otsumami)] Minna no Asuka Bon (Neon Genesis Evangelion) [English] =LWB=
    [2012/02/18 04:23:06 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Spice and Wolf Light Novel
    [2012/02/16 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Inkey
    [2012/02/14 18:02:18 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\[DA HOOTCH (ShindoL)] Field Work Ch1-2
    [2012/02/07 18:12:52 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\SRWZ
    [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2012/03/01 14:01:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2012/03/01 14:01:47 | 000,600,882 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2012/03/01 14:01:47 | 000,105,658 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2012/03/01 14:00:48 | 000,273,408 | ---- | M] (Microsoft Corporation) -- C:\afd.sys
    [2012/02/29 20:27:19 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif
    [2012/02/29 20:05:37 | 000,232,960 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2012/02/29 17:11:33 | 000,396,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2012/02/29 14:06:36 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
    [2012/02/29 13:44:38 | 000,006,944 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
    [2012/02/28 23:26:48 | 004,422,703 | R--- | M] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
    [2012/02/28 00:26:20 | 000,000,878 | ---- | M] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
    [2012/02/28 00:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
    [2012/02/27 23:55:10 | 076,871,504 | ---- | M] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
    [2012/02/27 23:52:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
    [2012/02/27 18:20:32 | 080,340,888 | ---- | M] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
    [2012/02/26 23:41:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASX to MP3 Converter
    [2012/02/26 23:09:31 | 000,001,078 | ---- | M] () -- C:\Users\Jonathan\Desktop\ASX to MP3 Converter.lnk
    [2012/02/26 23:06:13 | 000,114,688 | ---- | M] () -- C:\Windows\System32\msvos.dll
    [2012/02/26 22:51:53 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia10.asx
    [2012/02/26 22:51:36 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia11.asx
    [2012/02/26 22:19:51 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia12.asx
    [2012/02/26 17:05:34 | 000,362,348 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
    [2012/02/26 16:03:24 | 013,456,449 | ---- | M] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
    [2012/02/24 21:17:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
    [2012/02/23 12:50:23 | 000,262,938 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
    [2012/02/20 02:44:00 | 000,257,373 | ---- | M] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
    [2012/02/18 20:38:46 | 039,022,043 | ---- | M] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
    [2012/02/18 20:38:14 | 002,185,701 | ---- | M] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
    [2012/02/15 10:34:02 | 149,144,660 | ---- | M] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
    [2012/02/12 22:14:20 | 000,397,103 | ---- | M] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
    [2012/02/05 17:37:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pokemon Online
    [2012/02/01 12:11:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
     
  18. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    ========== Files Created - No Company Name ==========

    [2012/03/01 00:06:27 | 000,273,920 | ---- | C] () -- C:\Windows\System32\drivers\afd.sys
    [2012/02/28 23:43:39 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2012/02/28 23:43:39 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2012/02/28 23:43:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2012/02/28 23:43:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2012/02/28 23:43:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2012/02/28 00:26:20 | 000,000,878 | ---- | C] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
    [2012/02/27 23:54:27 | 076,871,504 | ---- | C] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
    [2012/02/27 18:16:47 | 080,340,888 | ---- | C] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
    [2012/02/26 22:51:48 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia10.asx
    [2012/02/26 22:51:32 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia11.asx
    [2012/02/26 17:05:32 | 000,362,348 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
    [2012/02/26 16:01:37 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia12.asx
    [2012/02/26 15:59:07 | 013,456,449 | ---- | C] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
    [2012/02/23 12:50:22 | 000,262,938 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
    [2012/02/20 02:43:52 | 000,257,373 | ---- | C] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
    [2012/02/18 20:38:05 | 002,185,701 | ---- | C] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
    [2012/02/18 20:38:00 | 039,022,043 | ---- | C] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
    [2012/02/15 10:27:21 | 149,144,660 | ---- | C] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
    [2012/02/12 22:14:20 | 000,397,103 | ---- | C] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
    [2012/01/19 22:07:25 | 000,051,186 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room_v3.dat
    [2011/08/25 20:49:57 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
    [2011/08/25 20:49:56 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
    [2011/08/25 20:49:51 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
    [2011/08/25 20:49:51 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
    [2011/08/25 20:49:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
    [2011/07/21 00:56:16 | 000,090,112 | ---- | C] () -- C:\Windows\System32\imsfchk.dll
    [2011/07/21 00:56:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\imslevel.dll
    [2011/06/18 10:22:19 | 000,230,529 | ---- | C] () -- C:\Windows\System32\libpng14-14.dll
    [2011/06/18 10:22:19 | 000,100,352 | ---- | C] () -- C:\Windows\System32\zlib1.dll
    [2011/06/18 10:22:19 | 000,098,590 | ---- | C] () -- C:\Windows\System32\libwimp.dll
    [2011/06/18 10:22:19 | 000,062,130 | ---- | C] () -- C:\Windows\System32\libpixmap.dll
    [2011/06/18 10:22:18 | 000,103,029 | ---- | C] () -- C:\Windows\System32\libpangocairo-1.0-0.dll
    [2011/06/18 10:22:18 | 000,060,537 | ---- | C] () -- C:\Windows\System32\libgailutil-18.dll
    [2011/06/18 10:22:17 | 001,136,422 | ---- | C] () -- C:\Windows\System32\libcairo-2.dll
    [2011/06/18 10:22:17 | 000,551,096 | ---- | C] () -- C:\Windows\System32\freetype6.dll
    [2011/06/18 10:22:17 | 000,466,257 | ---- | C] () -- C:\Windows\System32\libgail.dll
    [2011/06/18 10:22:17 | 000,279,059 | ---- | C] () -- C:\Windows\System32\libfontconfig-1.dll
    [2011/06/18 10:22:17 | 000,143,096 | ---- | C] () -- C:\Windows\System32\libexpat-1.dll
    [2011/03/22 20:36:53 | 000,041,890 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room.dat
    [2011/02/09 23:03:48 | 000,000,314 | ---- | C] () -- C:\Windows\primopdf.ini
    [2010/06/15 14:59:08 | 000,073,728 | ---- | C] () -- C:\Windows\System32\imsaiff.dll
    [2010/06/15 14:59:08 | 000,036,864 | ---- | C] () -- C:\Windows\System32\DGRip.dll
    [2010/05/08 21:26:27 | 000,165,425 | ---- | C] () -- C:\Windows\hpoins28.dat.temp
    [2009/11/03 09:38:35 | 000,388,112 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
    [2009/10/27 23:01:35 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
    [2009/08/03 17:47:10 | 000,006,328 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\PrimoPDFSet.xml
    [2009/08/03 17:45:12 | 000,180,624 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
    [2009/07/09 09:32:07 | 000,000,056 | ---- | C] () -- C:\Windows\kgt2k.INI
    [2009/07/08 20:03:02 | 000,058,880 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll
    [2009/06/17 10:17:36 | 000,004,508 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
    [2009/05/12 14:23:05 | 000,000,398 | ---- | C] () -- C:\Windows\AudioConverter.INI
    [2009/03/06 23:29:32 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat.temp
    [2009/03/06 22:45:47 | 000,165,697 | ---- | C] () -- C:\Windows\hpoins28.dat
    [2008/10/26 19:01:59 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
    [2008/10/08 09:07:37 | 000,008,248 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\en.ini
    [2008/08/02 13:11:21 | 000,023,888 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\UserTile.png
    [2008/08/01 23:07:07 | 000,077,940 | ---- | C] () -- C:\Windows\War3Unin.dat
    [2008/07/29 23:15:09 | 000,006,944 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
    [2008/07/28 21:58:01 | 000,232,960 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/07/28 13:50:51 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
    [2008/07/28 13:50:51 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
    [2008/07/16 23:55:43 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
    [2008/07/16 23:55:43 | 000,168,883 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
    [2008/07/16 23:55:43 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
    [2008/07/16 23:55:43 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe
    [2008/07/16 21:22:33 | 000,000,076 | RHS- | C] () -- C:\Windows\CT4CET.bin
    [2008/07/16 21:16:21 | 000,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
    [2008/07/16 21:16:20 | 000,026,112 | ---- | C] () -- C:\Windows\System32\WLTRYSVC.EXE
    [2008/07/16 16:00:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
    [2008/05/11 22:49:03 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat
    [2008/04/29 13:42:24 | 000,503,808 | ---- | C] () -- C:\Windows\System32\ICCProfiles.dll
    [2008/01/20 21:24:55 | 000,075,264 | ---- | C] () -- C:\Windows\System32\drivers\dfsc.sys
    [2007/11/26 21:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
    [2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2006/11/02 07:47:37 | 000,396,976 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
    [2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/02 05:33:01 | 000,600,882 | ---- | C] () -- C:\Windows\System32\perfh009.dat
    [2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
    [2006/11/02 05:33:01 | 000,105,658 | ---- | C] () -- C:\Windows\System32\perfc009.dat
    [2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
    [2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
    [2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
    [2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
    [2005/03/30 11:29:16 | 000,114,688 | ---- | C] () -- C:\Windows\System32\msvos.dll

    ========== LOP Check ==========

    [2011/10/08 21:33:46 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Audacity
    [2008/07/28 13:42:32 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DigitalPersona
    [2012/02/29 15:55:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DNA
    [2010/12/08 15:43:13 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Downloaded Installations
    [2011/05/26 12:05:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Dropbox
    [2011/07/22 21:02:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\GetRightToGo
    [2010/06/26 10:18:54 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\IObit
    [2010/08/25 14:51:51 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\JAM Software
    [2011/07/22 21:12:31 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Music Recognition
    [2010/04/07 10:31:12 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NCH Swift Sound
    [2009/10/13 13:33:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NeopleLauncherDFO
    [2011/12/08 12:17:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Nitro PDF
    [2011/12/08 12:15:26 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\OpenCandy
    [2010/12/09 23:12:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PCDr
    [2008/08/02 13:11:21 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PeerNetworking
    [2011/07/11 17:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Lab
    [2011/07/09 23:07:05 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Online
    [2011/12/08 12:17:57 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PrimoPDF
    [2009/10/16 18:34:06 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\RenPy
    [2009/05/12 11:22:01 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\River Past G5
    [2010/12/17 13:35:42 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Sony
    [2008/09/07 17:09:33 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SonyEricsson
    [2010/10/04 19:40:10 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Synthesia
    [2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SYSTEMAX Software Development
    [2010/08/20 08:11:08 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Thunderbird
    [2012/02/28 19:59:59 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\uTorrent
    [2009/12/30 12:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\VBA-M
    [2008/07/29 20:01:29 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Windows Live Writer
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
    [2008/08/09 22:26:58 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
    [2008/10/29 15:55:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Citrix
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
    [2010/04/07 10:29:38 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound
    [2009/10/27 15:18:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Nexon
    [2011/09/11 16:35:36 | 000,000,000 | ---D | M] -- C:\ProgramData\NexonUS
    [2011/12/08 12:16:30 | 000,000,000 | ---D | M] -- C:\ProgramData\Nitro PDF
    [2011/05/24 15:14:54 | 000,000,000 | ---D | M] -- C:\ProgramData\PCDr
    [2011/05/02 22:20:11 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
    [2009/05/12 13:52:39 | 000,000,000 | ---D | M] -- C:\ProgramData\River Past G5
    [2008/09/06 19:01:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
    [2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
    [2008/10/09 11:23:29 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
    [2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
    [2008/07/16 21:25:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Uninstall
    [2008/09/23 13:41:44 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
    [2012/01/30 18:58:57 | 000,000,000 | ---D | M] -- C:\ProgramData\youku
    [2012/02/24 21:17:52 | 000,000,000 | ---D | M] -- C:\ProgramData\YouTube Downloader
    [2011/01/30 23:23:07 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2009/10/19 16:59:18 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2012/02/29 16:57:54 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========



    < MD5 for: AFD.SYS >
    [2012/03/01 14:00:48 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\afd.sys
    [2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\System32\drivers\afd.sys
    [2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys

    < MD5 for: EXPLORER.EXE >
    [2008/10/29 01:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
    [2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
    [2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
    [2008/10/29 22:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
    [2008/10/27 21:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
    [2008/01/20 21:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

    < MD5 for: SVCHOST.EXE >
    [2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
    [2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
    [2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

    < MD5 for: USERINIT.EXE >
    [2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
    [2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

    < MD5 for: WINLOGON.EXE >
    [2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
    [2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
    [2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

    ========== Files - Unicode (All) ==========
    [2010/06/22 23:17:59 | 000,769,473 | ---- | C] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
    [2010/06/21 10:39:53 | 000,769,473 | ---- | M] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
    [2009/10/06 23:06:03 | 005,765,164 | ---- | M] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
    [2009/10/06 23:05:37 | 005,765,164 | ---- | C] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
    < End of report >
     
  19. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Do this on the computer you are posting from:
    Copy the text in the codebox below:


    Code:
    :OTL
    
    :Services
    
    :Reg
    
    :Files
    C:\Windows\System32\drivers\afd.sys|C:\afd.sys /replace
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys|C:\afd.sys /replace
    
    :Commands
    [purity]
    
    Open Notepad and paste it.
    Save the document as Fix.txt on to a USB flash drive


    On the infected computer the following...

    Run OTLPE

    • Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
      • (The content of Fix.txt should appear in the box)
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post the log produced (you'll need to transfer it with USB stick)
    • Remove the CD and shut down computer manually.
    • Attempt to reboot normally into Windows.
     
  20. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    ========== OTL ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    File C:\Windows\System32\drivers\afd.sys successfully replaced with C:\afd.sys
    File C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys successfully replaced with C:\afd.sys
    ========== COMMANDS ==========

    OTLPE by OldTimer - Version 3.1.48.0 log created on 03012012_153247
     
  21. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    I'm still getting a blue screen...
     
  22. Broni

    Broni Malware Annihilator Posts: 47,066   +257

  23. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    It says I need to install vista sp1, should I do that?
     
  24. lunsk

    lunsk TS Rookie Topic Starter Posts: 62

    Oops, found it
     
  25. Broni

    Broni Malware Annihilator Posts: 47,066   +257



Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.