Inactive Virus/malware that keeps coming back despite being removed with Malwarebytes

I can get into safe mode

BSOD says: a problems been detected...
IQRL_NOT_LESS_OR_EQUAL
.
.
Technical information:
***STOP: 0x0000000A (0x00000000, 0x00000002, 0x00000001, 0x8225A0EC)
 
I need more details.
Are you trying to run it from safe mode?
What exactly do you mean by "doesn't run"?
I assume you're getting some warning about MSE and then what?
What options does it give you?
 
Running from safe mode, asks me if I want to run despite essentials being on, I press OK and then nothing happens
 
Let's see, if we can look at your computer booting from an external source.

Please download OTLPE (filesize 120,9 MB)

  • When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
  • Reboot your system using the boot CD you just created.
    • Note : If you do not know how to set your computer to boot from CD follow the steps here
  • Your system should now display a REATOGO-X-PE desktop.
  • Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
  • Double-click on the OTLPE icon.
  • When asked Do you wish to load the remote registry, select Yes
  • When asked Do you wish to load remote user profile(s) for scanning, select Yes
  • Ensure the box Automatically Load All Remaining Users" is checked and press OK
  • OTL should now start.
  • Under the Custom Scan box paste this in:

    /md5start
    explorer.exe
    winlogon.exe
    userinit.exe
    svchost.exe
    afd.sys
    /md5stop

  • Press Run Scan to start the scan.
  • When finished, the file will be saved in drive C:\OTL.txt
  • Copy this file to your USB drive if you do not have internet connection on this system
  • Please post the contents of the OTL.txt file in your reply.
 
Log is being split in 3:

OTL logfile created on: 3/1/2012 12:43:26 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.29 Gb Total Space | 3.83 Gb Free Space | 1.33% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 5.59 Gb Free Space | 57.21% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (z800bus)
SRV - File not found [Auto] -- -- (slimsvc)
SRV - File not found [Auto] -- -- (se58mdfl)
SRV - File not found [Auto] -- -- (pnmsrv)
SRV - File not found [Auto] -- -- (p17)
SRV - File not found [Auto] -- -- (omniinet)
SRV - File not found [Auto] -- -- (iPassPeriodicUpdateApp)
SRV - File not found [Auto] -- -- (imonitor)
SRV - File not found [Auto] -- -- (downloadmanagerlite)
SRV - File not found [Auto] -- -- (DCamUSBGrandTek)
SRV - File not found [Auto] -- -- (aw_host)
SRV - File not found [Auto] -- -- (ARSVC)
SRV - [2011/12/18 12:48:07 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/06/21 18:57:40 | 000,196,912 | ---- | M] (Nitro PDF Software) [Auto] -- C:\Program Files\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe -- (NitroReaderDriverReadSpool2)
SRV - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2009/06/23 10:54:18 | 000,061,760 | ---- | M] (Nalpeiron Ltd.) [Auto] -- C:\Windows\System32\ASTSRV.EXE -- (astcc)
SRV - [2009/02/19 15:10:54 | 000,238,968 | ---- | M] (Symantec Corporation) [Disabled] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2009/02/19 15:09:53 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/04/28 16:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008/03/25 21:53:16 | 000,302,144 | ---- | M] (DigitalPersona, Inc.) [Auto] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2008/03/14 00:03:44 | 000,221,239 | ---- | M] (IDT, Inc.) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\stacsv.exe -- (STacSV)
SRV - [2008/03/14 00:03:40 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\AEstSrv.exe -- (AESTFilters)
SRV - [2008/02/29 04:37:16 | 001,053,944 | ---- | M] (AuthenTec, Inc.) [Auto] -- C:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\venturi2.dll -- (ZSMC303)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\w200obex.dll -- (U81xmgmt)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\xaudioservice.dll -- (SetupSys)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\mqdmmdfl.dll -- (elaunidr)
SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/10/03 15:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (XDva391)
DRV - File not found [Kernel | On_Demand] -- -- (XDva195)
DRV - File not found [Kernel | System] -- -- (tdx)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
DRV - File not found [Kernel | System] -- -- (netbt)
DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
DRV - File not found [Kernel | System] -- -- (i8042prt)
DRV - File not found [Kernel | On_Demand] -- -- (GGSAFERDriver)
DRV - File not found [Kernel | On_Demand] -- -- (GarenaPEngine)
DRV - File not found [Kernel | On_Demand] -- -- (EagleNT)
DRV - File not found [Kernel | System] -- -- (cdrom)
DRV - File not found [Kernel | On_Demand] -- -- (catchme)
DRV - File not found [Kernel | System] -- -- (ASPI32)
DRV - [2011/07/21 15:35:19 | 000,500,704 | ---- | M] (AhnLab, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - [2011/06/27 18:41:51 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto] -- C:\Windows\System32\STEC3.sys -- (STEC3)
DRV - [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2009/03/18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/11/17 06:29:08 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
DRV - [2008/08/07 14:57:05 | 000,716,272 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2008/08/04 13:17:40 | 000,046,464 | ---- | M] (www.wiselogic.co.kr) [Kernel | On_Demand] -- C:\Windows\System32\XDva189.sys -- (XDva189)
DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/04/22 16:33:30 | 000,038,856 | ---- | M] (Teruten Co. LTD.) [Kernel | On_Demand] -- C:\Windows\System32\GDISpy.sys -- (GDISpyDevice)
DRV - [2008/04/18 21:43:40 | 000,170,032 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008/03/14 08:04:26 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2008/03/14 00:03:48 | 000,374,784 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2008/03/13 06:45:50 | 000,548,352 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)
DRV - [2008/03/11 01:53:02 | 000,149,208 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV - [2008/03/11 01:53:00 | 000,277,624 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Vid.sys -- (OA001Vid)
DRV - [2008/03/11 01:42:24 | 000,203,264 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2008/03/11 01:24:46 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2008/03/11 01:24:44 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008/03/11 01:24:42 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2008/01/20 21:24:55 | 000,075,264 | ---- | M] () [File_System | System] -- C:\Windows\System32\drivers\dfsc.sys -- (DfsC)
DRV - [2008/01/20 21:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007/11/02 05:47:38 | 000,109,992 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdm.sys -- (s916mdm)
DRV - [2007/11/02 05:47:38 | 000,103,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mgmt.sys -- (s916mgmt) Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM)
DRV - [2007/11/02 05:47:38 | 000,100,008 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916obex.sys -- (s916obex)
DRV - [2007/11/02 05:47:38 | 000,083,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916bus.sys -- (s916bus) Sony Ericsson Device 916 driver (WDM)
DRV - [2007/11/02 05:47:38 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdfl.sys -- (s916mdfl)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "https://weblogin.utoronto.ca/|https://portal.utoronto.ca/webapps/portal/frameset.jsp|https://www.rosi.utoronto.ca/"
FF - prefs.js..extensions.enabledItems: ankpixiv@snca.net:1.14.4
FF - prefs.js..extensions.enabledItems: peraperakun-chinese@gmail.com:1.0
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: nicofox@littlebtc:0.4b1
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9
FF - prefs.js..extensions.enabledItems: chineseperakun@gmail.com:2.1.1
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.7.5
FF - prefs.js..extensions.enabledItems: {f701c26a-479a-4724-b4f1-870db12f063c}:1.4.4
FF - prefs.js..extensions.enabledItems: {a95d8332-e4b4-6e7f-98ac-20b733364387}:0.5.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "69.120.137.143"
FF - prefs.js..network.proxy.ftp_port: 27977
FF - prefs.js..network.proxy.http: "69.120.137.143"
FF - prefs.js..network.proxy.http_port: 27977
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "69.120.137.143"
FF - prefs.js..network.proxy.socks_port: 27977
FF - prefs.js..network.proxy.ssl: "69.120.137.143"
FF - prefs.js..network.proxy.ssl_port: 27977

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: File not found
FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\System32\npOGPPlugin.dll (OGPlanet)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKLM\Software\MozillaPlugins\NitroPDF: C:\Program Files\Nitro PDF\Reader 2\npnitromozilla.dll ( )
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Jonathan\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/28 18:56:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/17 09:31:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/24 15:55:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/08/17 08:08:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\Jonathan\Program Files\DNA [2012/02/29 16:13:51 | 000,000,000 | ---D | M]

[2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions
[2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/02/25 09:25:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions
[2011/10/20 23:04:03 | 000,000,000 | ---D | M] (Rikaichan) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82}
[2012/01/26 15:02:36 | 000,000,000 | ---D | M] (GameFOX) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{6dd0bdba-0a02-429e-b595-87a7dfdca7a1}
[2009/01/08 22:34:09 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(17)
[2012/01/09 15:31:46 | 000,000,000 | ---D | M] (Perapera Chinese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\chineseperakun@gmail.com
[2012/01/10 10:18:24 | 000,000,000 | ---D | M] (Perapera Japanese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\peraperakun@gmail.com
[2011/05/28 19:17:18 | 000,000,000 | ---D | M] (Rikaichan Japanese-English Dictionary File) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\rikaichan-jpen@polarcloud.com
[2008/07/28 14:12:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{35106BCA-6C78-48C7-AC28-56DF30B51D2C}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A95D8332-E4B4-6E7F-98AC-20B733364387}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{F701C26A-479A-4724-B4F1-870DB12F063C}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\ANKPIXIV@SNCA.NET.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\NICOFOX@LITTLEBTC.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-CHINESE@GMAIL.COM.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-JPEN@GMAIL.COM.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\TABCOUNT@3GREENEGGS.COM.XPI
[2012/02/17 09:31:57 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/03/22 13:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2011/10/04 20:04:03 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/09 20:17:12 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

Hosts file not found
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [DellSupportCenter] File not found
O4 - HKLM..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\DpAgent.exe (DigitalPersona, Inc.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\Jonathan_ON_C..\Run: [BitTorrent DNA] C:\Users\Jonathan\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\Jonathan_ON_C..\Run: [DellSupportCenter] File not found
O4 - HKU\.DEFAULT..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10a.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\thunderbird - Shortcut.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - File not found
O13 - gopher Prefix: missing
O16 - DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab (Symantec Configuration Class)
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab (RIM AxLoader)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/01 00:06:25 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/02/29 21:54:04 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/02/29 15:32:17 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012/02/29 15:30:10 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
[2012/02/29 13:14:26 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netbt.svs
[2012/02/29 12:04:17 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012/02/29 12:04:07 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012/02/29 01:15:03 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\afd.svs
[2012/02/28 23:43:39 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/02/28 23:43:39 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/02/28 23:43:39 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/02/28 23:36:05 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/02/28 23:34:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/02/28 23:26:34 | 004,422,703 | R--- | C] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
[2012/02/28 22:32:20 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\RK_Quarantine
[2012/02/28 18:15:11 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\LA
[2012/02/28 02:02:10 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\DO THIS
[2012/02/28 00:26:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2012/02/28 00:25:49 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2012/02/27 23:56:02 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/02/27 23:52:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2012/02/27 23:52:53 | 000,000,000 | ---D | C] -- C:\Program Files\MozBackup
[2012/02/26 15:43:14 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Mobile Suit Gundam Novel
[2012/02/24 21:17:48 | 000,000,000 | ---D | C] -- C:\ProgramData\YouTube Downloader
[2012/02/24 21:17:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
[2012/02/24 21:17:43 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader
[2012/02/24 00:17:42 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\(C81) [ReDrop (Miyamoto Smoke, Otsumami)] Minna no Asuka Bon (Neon Genesis Evangelion) [English] =LWB=
[2012/02/18 04:23:06 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Spice and Wolf Light Novel
[2012/02/16 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Inkey
[2012/02/14 18:02:18 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\[DA HOOTCH (ShindoL)] Field Work Ch1-2
[2012/02/07 18:12:52 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\SRWZ
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/03/01 12:32:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/03/01 11:46:56 | 000,600,882 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/03/01 11:46:56 | 000,105,658 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/02/29 20:27:19 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/02/29 20:05:37 | 000,232,960 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/29 17:11:33 | 000,396,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/02/29 14:06:36 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
[2012/02/29 13:44:38 | 000,006,944 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
[2012/02/28 23:26:48 | 004,422,703 | R--- | M] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
[2012/02/28 00:26:20 | 000,000,878 | ---- | M] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
[2012/02/28 00:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2012/02/27 23:55:10 | 076,871,504 | ---- | M] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
[2012/02/27 23:52:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2012/02/27 18:20:32 | 080,340,888 | ---- | M] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
[2012/02/26 23:41:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASX to MP3 Converter
[2012/02/26 23:09:31 | 000,001,078 | ---- | M] () -- C:\Users\Jonathan\Desktop\ASX to MP3 Converter.lnk
[2012/02/26 23:06:13 | 000,114,688 | ---- | M] () -- C:\Windows\System32\msvos.dll
[2012/02/26 22:51:53 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia10.asx
[2012/02/26 22:51:36 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia11.asx
[2012/02/26 22:19:51 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia12.asx
[2012/02/26 17:05:34 | 000,362,348 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
[2012/02/26 16:03:24 | 013,456,449 | ---- | M] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
[2012/02/24 21:17:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
[2012/02/23 12:50:23 | 000,262,938 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
[2012/02/20 02:44:00 | 000,257,373 | ---- | M] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
[2012/02/18 20:38:46 | 039,022,043 | ---- | M] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
[2012/02/18 20:38:14 | 002,185,701 | ---- | M] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
[2012/02/15 10:34:02 | 149,144,660 | ---- | M] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
[2012/02/12 22:14:20 | 000,397,103 | ---- | M] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
[2012/02/05 17:37:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pokemon Online
[2012/02/01 12:11:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========

[2012/03/01 00:06:27 | 000,273,920 | ---- | C] () -- C:\Windows\System32\drivers\afd.sys
[2012/02/28 23:43:39 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/02/28 23:43:39 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/02/28 23:43:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/02/28 23:43:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/02/28 23:43:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/02/28 00:26:20 | 000,000,878 | ---- | C] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
[2012/02/27 23:54:27 | 076,871,504 | ---- | C] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
[2012/02/27 18:16:47 | 080,340,888 | ---- | C] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
[2012/02/26 22:51:48 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia10.asx
[2012/02/26 22:51:32 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia11.asx
[2012/02/26 17:05:32 | 000,362,348 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
[2012/02/26 16:01:37 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia12.asx
[2012/02/26 15:59:07 | 013,456,449 | ---- | C] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
[2012/02/23 12:50:22 | 000,262,938 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
[2012/02/20 02:43:52 | 000,257,373 | ---- | C] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
[2012/02/18 20:38:05 | 002,185,701 | ---- | C] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
[2012/02/18 20:38:00 | 039,022,043 | ---- | C] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
[2012/02/15 10:27:21 | 149,144,660 | ---- | C] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
[2012/02/12 22:14:20 | 000,397,103 | ---- | C] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
[2012/01/19 22:07:25 | 000,051,186 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room_v3.dat
[2011/08/25 20:49:57 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2011/08/25 20:49:56 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011/08/25 20:49:51 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011/08/25 20:49:51 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011/08/25 20:49:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011/07/21 00:56:16 | 000,090,112 | ---- | C] () -- C:\Windows\System32\imsfchk.dll
[2011/07/21 00:56:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\imslevel.dll
[2011/06/18 10:22:19 | 000,230,529 | ---- | C] () -- C:\Windows\System32\libpng14-14.dll
[2011/06/18 10:22:19 | 000,100,352 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2011/06/18 10:22:19 | 000,098,590 | ---- | C] () -- C:\Windows\System32\libwimp.dll
[2011/06/18 10:22:19 | 000,062,130 | ---- | C] () -- C:\Windows\System32\libpixmap.dll
[2011/06/18 10:22:18 | 000,103,029 | ---- | C] () -- C:\Windows\System32\libpangocairo-1.0-0.dll
[2011/06/18 10:22:18 | 000,060,537 | ---- | C] () -- C:\Windows\System32\libgailutil-18.dll
[2011/06/18 10:22:17 | 001,136,422 | ---- | C] () -- C:\Windows\System32\libcairo-2.dll
[2011/06/18 10:22:17 | 000,551,096 | ---- | C] () -- C:\Windows\System32\freetype6.dll
[2011/06/18 10:22:17 | 000,466,257 | ---- | C] () -- C:\Windows\System32\libgail.dll
[2011/06/18 10:22:17 | 000,279,059 | ---- | C] () -- C:\Windows\System32\libfontconfig-1.dll
[2011/06/18 10:22:17 | 000,143,096 | ---- | C] () -- C:\Windows\System32\libexpat-1.dll
[2011/03/22 20:36:53 | 000,041,890 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room.dat
[2011/02/09 23:03:48 | 000,000,314 | ---- | C] () -- C:\Windows\primopdf.ini
[2010/06/15 14:59:08 | 000,073,728 | ---- | C] () -- C:\Windows\System32\imsaiff.dll
[2010/06/15 14:59:08 | 000,036,864 | ---- | C] () -- C:\Windows\System32\DGRip.dll
[2010/05/08 21:26:27 | 000,165,425 | ---- | C] () -- C:\Windows\hpoins28.dat.temp
[2009/11/03 09:38:35 | 000,388,112 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
[2009/10/27 23:01:35 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
[2009/08/03 17:47:10 | 000,006,328 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\PrimoPDFSet.xml
[2009/08/03 17:45:12 | 000,180,624 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
[2009/07/09 09:32:07 | 000,000,056 | ---- | C] () -- C:\Windows\kgt2k.INI
[2009/07/08 20:03:02 | 000,058,880 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll
[2009/06/17 10:17:36 | 000,004,508 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2009/05/12 14:23:05 | 000,000,398 | ---- | C] () -- C:\Windows\AudioConverter.INI
[2009/03/06 23:29:32 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat.temp
[2009/03/06 22:45:47 | 000,165,697 | ---- | C] () -- C:\Windows\hpoins28.dat
[2008/10/26 19:01:59 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008/10/08 09:07:37 | 000,008,248 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\en.ini
[2008/08/02 13:11:21 | 000,023,888 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\UserTile.png
[2008/08/01 23:07:07 | 000,077,940 | ---- | C] () -- C:\Windows\War3Unin.dat
[2008/07/29 23:15:09 | 000,006,944 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
[2008/07/28 21:58:01 | 000,232,960 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/28 13:50:51 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008/07/28 13:50:51 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/07/16 23:55:43 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2008/07/16 23:55:43 | 000,168,883 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008/07/16 23:55:43 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/07/16 23:55:43 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe
[2008/07/16 21:22:33 | 000,000,076 | RHS- | C] () -- C:\Windows\CT4CET.bin
[2008/07/16 21:16:21 | 000,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2008/07/16 21:16:20 | 000,026,112 | ---- | C] () -- C:\Windows\System32\WLTRYSVC.EXE
[2008/07/16 16:00:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008/05/11 22:49:03 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat
[2008/04/29 13:42:24 | 000,503,808 | ---- | C] () -- C:\Windows\System32\ICCProfiles.dll
[2008/01/20 21:24:55 | 000,075,264 | ---- | C] () -- C:\Windows\System32\drivers\dfsc.sys
[2007/11/26 21:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,396,976 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,600,882 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,105,658 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005/03/30 11:29:16 | 000,114,688 | ---- | C] () -- C:\Windows\System32\msvos.dll

========== LOP Check ==========

[2011/10/08 21:33:46 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Audacity
[2008/07/28 13:42:32 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DigitalPersona
[2012/02/29 15:55:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DNA
[2010/12/08 15:43:13 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Downloaded Installations
[2011/05/26 12:05:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Dropbox
[2011/07/22 21:02:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\GetRightToGo
[2010/06/26 10:18:54 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\IObit
[2010/08/25 14:51:51 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\JAM Software
[2011/07/22 21:12:31 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Music Recognition
[2010/04/07 10:31:12 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NCH Swift Sound
[2009/10/13 13:33:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NeopleLauncherDFO
[2011/12/08 12:17:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Nitro PDF
[2011/12/08 12:15:26 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\OpenCandy
[2010/12/09 23:12:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PCDr
[2008/08/02 13:11:21 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PeerNetworking
[2011/07/11 17:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Lab
[2011/07/09 23:07:05 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Online
[2011/12/08 12:17:57 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PrimoPDF
[2009/10/16 18:34:06 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\RenPy
[2009/05/12 11:22:01 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\River Past G5
[2010/12/17 13:35:42 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Sony
[2008/09/07 17:09:33 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SonyEricsson
[2010/10/04 19:40:10 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Synthesia
[2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SYSTEMAX Software Development
[2010/08/20 08:11:08 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Thunderbird
[2012/02/28 19:59:59 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\uTorrent
[2009/12/30 12:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\VBA-M
[2008/07/29 20:01:29 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Windows Live Writer
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2008/08/09 22:26:58 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
[2008/10/29 15:55:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Citrix
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2010/04/07 10:29:38 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound
[2009/10/27 15:18:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Nexon
[2011/09/11 16:35:36 | 000,000,000 | ---D | M] -- C:\ProgramData\NexonUS
[2011/12/08 12:16:30 | 000,000,000 | ---D | M] -- C:\ProgramData\Nitro PDF
[2011/05/24 15:14:54 | 000,000,000 | ---D | M] -- C:\ProgramData\PCDr
[2011/05/02 22:20:11 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2009/05/12 13:52:39 | 000,000,000 | ---D | M] -- C:\ProgramData\River Past G5
[2008/09/06 19:01:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
[2008/10/09 11:23:29 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/07/16 21:25:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Uninstall
[2008/09/23 13:41:44 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2012/01/30 18:58:57 | 000,000,000 | ---D | M] -- C:\ProgramData\youku
[2012/02/24 21:17:52 | 000,000,000 | ---D | M] -- C:\ProgramData\YouTube Downloader
[2011/01/30 23:23:07 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/19 16:59:18 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2012/02/29 16:57:54 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========



< MD5 for: AFD.SYS >
[2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\System32\drivers\afd.sys
[2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys

< MD5 for: EXPLORER.EXE >
[2008/10/29 01:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
[2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 22:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008/10/27 21:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 21:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

========== Files - Unicode (All) ==========
[2010/06/22 23:17:59 | 000,769,473 | ---- | C] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
[2010/06/21 10:39:53 | 000,769,473 | ---- | M] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
[2009/10/06 23:06:03 | 005,765,164 | ---- | M] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
[2009/10/06 23:05:37 | 005,765,164 | ---- | C] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
< End of report >
 
Also, if it's the same as yesterday. After I apply th fix.txt, do I reboot with the disc still in it? Yesterday when I tried to reboot, the disc ejected and I went into Windows normally, not sure if that caused any problems because you said to reboot and then eject the disc and shut down manually. Which I also tried, but I could not shut down after I ejected the disc, so I had to forcifully turn it off. Not sure if that caused any problems
 
Restart computer back to safe mode or to safe mode with networking if it works.
Download afd.sys file from here: http://www.uploadmb.com/dw.php?id=1330627560 (it comes from my computer.
Paste the file to the root C:\ directory.

Restart to OTLPE CD and re-run OTL with the very same script as last time.
Post new log.
 
Splitting log in 3:

OTL logfile created on: 3/1/2012 2:13:06 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.29 Gb Total Space | 3.84 Gb Free Space | 1.33% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 5.59 Gb Free Space | 57.21% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (z800bus)
SRV - File not found [Auto] -- -- (slimsvc)
SRV - File not found [Auto] -- -- (se58mdfl)
SRV - File not found [Auto] -- -- (pnmsrv)
SRV - File not found [Auto] -- -- (p17)
SRV - File not found [Auto] -- -- (omniinet)
SRV - File not found [Auto] -- -- (iPassPeriodicUpdateApp)
SRV - File not found [Auto] -- -- (imonitor)
SRV - File not found [Auto] -- -- (downloadmanagerlite)
SRV - File not found [Auto] -- -- (DCamUSBGrandTek)
SRV - File not found [Auto] -- -- (aw_host)
SRV - File not found [Auto] -- -- (ARSVC)
SRV - [2011/12/18 12:48:07 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/06/21 18:57:40 | 000,196,912 | ---- | M] (Nitro PDF Software) [Auto] -- C:\Program Files\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe -- (NitroReaderDriverReadSpool2)
SRV - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2009/06/23 10:54:18 | 000,061,760 | ---- | M] (Nalpeiron Ltd.) [Auto] -- C:\Windows\System32\ASTSRV.EXE -- (astcc)
SRV - [2009/02/19 15:10:54 | 000,238,968 | ---- | M] (Symantec Corporation) [Disabled] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2009/02/19 15:09:53 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/04/28 16:56:28 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008/03/25 21:53:16 | 000,302,144 | ---- | M] (DigitalPersona, Inc.) [Auto] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2008/03/14 00:03:44 | 000,221,239 | ---- | M] (IDT, Inc.) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\stacsv.exe -- (STacSV)
SRV - [2008/03/14 00:03:40 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\AEstSrv.exe -- (AESTFilters)
SRV - [2008/02/29 04:37:16 | 001,053,944 | ---- | M] (AuthenTec, Inc.) [Auto] -- C:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\venturi2.dll -- (ZSMC303)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\w200obex.dll -- (U81xmgmt)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\xaudioservice.dll -- (SetupSys)
SRV - [2008/01/20 21:23:43 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\Windows\System32\mqdmmdfl.dll -- (elaunidr)
SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/10/03 15:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (XDva391)
DRV - File not found [Kernel | On_Demand] -- -- (XDva195)
DRV - File not found [Kernel | System] -- -- (tdx)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
DRV - File not found [Kernel | System] -- -- (netbt)
DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
DRV - File not found [Kernel | System] -- -- (i8042prt)
DRV - File not found [Kernel | On_Demand] -- -- (GGSAFERDriver)
DRV - File not found [Kernel | On_Demand] -- -- (GarenaPEngine)
DRV - File not found [Kernel | On_Demand] -- -- (EagleNT)
DRV - File not found [Kernel | System] -- -- (cdrom)
DRV - File not found [Kernel | On_Demand] -- -- (catchme)
DRV - File not found [Kernel | System] -- -- (ASPI32)
DRV - [2011/07/21 15:35:19 | 000,500,704 | ---- | M] (AhnLab, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - [2011/06/27 18:41:51 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto] -- C:\Windows\System32\STEC3.sys -- (STEC3)
DRV - [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2009/03/18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/11/17 06:29:08 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
DRV - [2008/08/07 14:57:05 | 000,716,272 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2008/08/04 13:17:40 | 000,046,464 | ---- | M] (www.wiselogic.co.kr) [Kernel | On_Demand] -- C:\Windows\System32\XDva189.sys -- (XDva189)
DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2008/05/04 03:42:18 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/04/22 16:33:30 | 000,038,856 | ---- | M] (Teruten Co. LTD.) [Kernel | On_Demand] -- C:\Windows\System32\GDISpy.sys -- (GDISpyDevice)
DRV - [2008/04/18 21:43:40 | 000,170,032 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008/03/14 08:04:26 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2008/03/14 00:03:48 | 000,374,784 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2008/03/13 06:45:50 | 000,548,352 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)
DRV - [2008/03/11 01:53:02 | 000,149,208 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV - [2008/03/11 01:53:00 | 000,277,624 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Vid.sys -- (OA001Vid)
DRV - [2008/03/11 01:42:24 | 000,203,264 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2008/03/11 01:24:46 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2008/03/11 01:24:44 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008/03/11 01:24:42 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2008/01/20 21:24:55 | 000,075,264 | ---- | M] () [File_System | System] -- C:\Windows\System32\drivers\dfsc.sys -- (DfsC)
DRV - [2008/01/20 21:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007/11/02 05:47:38 | 000,109,992 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdm.sys -- (s916mdm)
DRV - [2007/11/02 05:47:38 | 000,103,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mgmt.sys -- (s916mgmt) Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM)
DRV - [2007/11/02 05:47:38 | 000,100,008 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916obex.sys -- (s916obex)
DRV - [2007/11/02 05:47:38 | 000,083,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916bus.sys -- (s916bus) Sony Ericsson Device 916 driver (WDM)
DRV - [2007/11/02 05:47:38 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s916mdfl.sys -- (s916mdfl)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=0080717
IE - HKU\Jonathan_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Jonathan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local




========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "https://weblogin.utoronto.ca/|https://portal.utoronto.ca/webapps/portal/frameset.jsp|https://www.rosi.utoronto.ca/"
FF - prefs.js..extensions.enabledItems: ankpixiv@snca.net:1.14.4
FF - prefs.js..extensions.enabledItems: peraperakun-chinese@gmail.com:1.0
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: nicofox@littlebtc:0.4b1
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9
FF - prefs.js..extensions.enabledItems: chineseperakun@gmail.com:2.1.1
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.7.5
FF - prefs.js..extensions.enabledItems: {f701c26a-479a-4724-b4f1-870db12f063c}:1.4.4
FF - prefs.js..extensions.enabledItems: {a95d8332-e4b4-6e7f-98ac-20b733364387}:0.5.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "69.120.137.143"
FF - prefs.js..network.proxy.ftp_port: 27977
FF - prefs.js..network.proxy.http: "69.120.137.143"
FF - prefs.js..network.proxy.http_port: 27977
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "69.120.137.143"
FF - prefs.js..network.proxy.socks_port: 27977
FF - prefs.js..network.proxy.ssl: "69.120.137.143"
FF - prefs.js..network.proxy.ssl_port: 27977

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: File not found
FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\System32\npOGPPlugin.dll (OGPlanet)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKLM\Software\MozillaPlugins\NitroPDF: C:\Program Files\Nitro PDF\Reader 2\npnitromozilla.dll ( )
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Jonathan\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/28 18:56:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/17 09:31:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/24 15:55:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/08/17 08:08:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\Jonathan\Program Files\DNA [2012/02/29 16:13:51 | 000,000,000 | ---D | M]

[2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions
[2010/08/20 08:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/02/25 09:25:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions
[2011/10/20 23:04:03 | 000,000,000 | ---D | M] (Rikaichan) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82}
[2012/01/26 15:02:36 | 000,000,000 | ---D | M] (GameFOX) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{6dd0bdba-0a02-429e-b595-87a7dfdca7a1}
[2009/01/08 22:34:09 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(17)
[2012/01/09 15:31:46 | 000,000,000 | ---D | M] (Perapera Chinese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\chineseperakun@gmail.com
[2012/01/10 10:18:24 | 000,000,000 | ---D | M] (Perapera Japanese) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\peraperakun@gmail.com
[2011/05/28 19:17:18 | 000,000,000 | ---D | M] (Rikaichan Japanese-English Dictionary File) -- C:\Users\Jonathan\AppData\Roaming\Mozilla\Firefox\Profiles\s1agfejk.default\extensions\rikaichan-jpen@polarcloud.com
[2008/07/28 14:12:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{35106BCA-6C78-48C7-AC28-56DF30B51D2C}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{A95D8332-E4B4-6E7F-98AC-20B733364387}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\{F701C26A-479A-4724-B4F1-870DB12F063C}.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\ANKPIXIV@SNCA.NET.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\NICOFOX@LITTLEBTC.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-CHINESE@GMAIL.COM.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\PERAPERAKUN-JPEN@GMAIL.COM.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI
() (No name found) -- C:\USERS\JONATHAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S1AGFEJK.DEFAULT\EXTENSIONS\TABCOUNT@3GREENEGGS.COM.XPI
[2012/02/17 09:31:57 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/03/22 13:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2011/10/04 20:04:03 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/09 20:17:12 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
 
Hosts file not found
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [DellSupportCenter] File not found
O4 - HKLM..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\DpAgent.exe (DigitalPersona, Inc.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\Jonathan_ON_C..\Run: [BitTorrent DNA] C:\Users\Jonathan\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\Jonathan_ON_C..\Run: [DellSupportCenter] File not found
O4 - HKU\.DEFAULT..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10a.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Jonathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\thunderbird - Shortcut.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - File not found
O13 - gopher Prefix: missing
O16 - DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab (Symantec Configuration Class)
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab (RIM AxLoader)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
O34 - HKLM BootExecute: (autocheck autochk /p \??\C) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/01 14:01:29 | 000,273,408 | ---- | C] (Microsoft Corporation) -- C:\afd.sys
[2012/03/01 00:06:25 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/02/29 21:54:04 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/02/29 15:32:17 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012/02/29 15:30:10 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
[2012/02/29 13:14:26 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netbt.svs
[2012/02/29 12:04:17 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012/02/29 12:04:07 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012/02/29 01:15:03 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\afd.svs
[2012/02/28 23:43:39 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/02/28 23:43:39 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/02/28 23:43:39 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/02/28 23:36:05 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/02/28 23:34:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/02/28 23:26:34 | 004,422,703 | R--- | C] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
[2012/02/28 22:32:20 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\RK_Quarantine
[2012/02/28 18:15:11 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\LA
[2012/02/28 02:02:10 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\DO THIS
[2012/02/28 00:26:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2012/02/28 00:25:49 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2012/02/27 23:56:02 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/02/27 23:52:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2012/02/27 23:52:53 | 000,000,000 | ---D | C] -- C:\Program Files\MozBackup
[2012/02/26 15:43:14 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Mobile Suit Gundam Novel
[2012/02/24 21:17:48 | 000,000,000 | ---D | C] -- C:\ProgramData\YouTube Downloader
[2012/02/24 21:17:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
[2012/02/24 21:17:43 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader
[2012/02/24 00:17:42 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\(C81) [ReDrop (Miyamoto Smoke, Otsumami)] Minna no Asuka Bon (Neon Genesis Evangelion) [English] =LWB=
[2012/02/18 04:23:06 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Spice and Wolf Light Novel
[2012/02/16 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\Inkey
[2012/02/14 18:02:18 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\[DA HOOTCH (ShindoL)] Field Work Ch1-2
[2012/02/07 18:12:52 | 000,000,000 | ---D | C] -- C:\Users\Jonathan\Desktop\SRWZ
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/03/01 14:01:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/03/01 14:01:47 | 000,600,882 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/03/01 14:01:47 | 000,105,658 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/03/01 14:00:48 | 000,273,408 | ---- | M] (Microsoft Corporation) -- C:\afd.sys
[2012/02/29 20:27:19 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/02/29 20:05:37 | 000,232,960 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/29 18:18:45 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/29 17:11:33 | 000,396,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/02/29 14:06:36 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Jonathan\Desktop\TDSSKiller.exe
[2012/02/29 13:44:38 | 000,006,944 | ---- | M] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
[2012/02/28 23:26:48 | 004,422,703 | R--- | M] (Swearware) -- C:\Users\Jonathan\Desktop\ComboFix.exe
[2012/02/28 00:26:20 | 000,000,878 | ---- | M] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
[2012/02/28 00:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2012/02/27 23:55:10 | 076,871,504 | ---- | M] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
[2012/02/27 23:52:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2012/02/27 18:20:32 | 080,340,888 | ---- | M] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
[2012/02/26 23:41:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASX to MP3 Converter
[2012/02/26 23:09:31 | 000,001,078 | ---- | M] () -- C:\Users\Jonathan\Desktop\ASX to MP3 Converter.lnk
[2012/02/26 23:06:13 | 000,114,688 | ---- | M] () -- C:\Windows\System32\msvos.dll
[2012/02/26 22:51:53 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia10.asx
[2012/02/26 22:51:36 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia11.asx
[2012/02/26 22:19:51 | 000,000,526 | ---- | M] () -- C:\Users\Jonathan\Desktop\xillia12.asx
[2012/02/26 17:05:34 | 000,362,348 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
[2012/02/26 16:03:24 | 013,456,449 | ---- | M] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
[2012/02/24 21:17:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Downloader
[2012/02/23 12:50:23 | 000,262,938 | ---- | M] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
[2012/02/20 02:44:00 | 000,257,373 | ---- | M] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
[2012/02/18 20:38:46 | 039,022,043 | ---- | M] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
[2012/02/18 20:38:14 | 002,185,701 | ---- | M] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
[2012/02/15 10:34:02 | 149,144,660 | ---- | M] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
[2012/02/12 22:14:20 | 000,397,103 | ---- | M] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
[2012/02/05 17:37:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pokemon Online
[2012/02/01 12:11:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========

[2012/03/01 00:06:27 | 000,273,920 | ---- | C] () -- C:\Windows\System32\drivers\afd.sys
[2012/02/28 23:43:39 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/02/28 23:43:39 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/02/28 23:43:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/02/28 23:43:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/02/28 23:43:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/02/28 00:26:20 | 000,000,878 | ---- | C] () -- C:\Users\Jonathan\Desktop\SpywareBlaster.lnk
[2012/02/27 23:54:27 | 076,871,504 | ---- | C] () -- C:\Users\Jonathan\Documents\Firefox 10.0.2 (en-US) - 2012-02-27.pcv
[2012/02/27 18:16:47 | 080,340,888 | ---- | C] () -- C:\Users\Jonathan\Desktop\Dr Web.exe
[2012/02/26 22:51:48 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia10.asx
[2012/02/26 22:51:32 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia11.asx
[2012/02/26 17:05:32 | 000,362,348 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330290697983.jpg
[2012/02/26 16:01:37 | 000,000,526 | ---- | C] () -- C:\Users\Jonathan\Desktop\xillia12.asx
[2012/02/26 15:59:07 | 013,456,449 | ---- | C] () -- C:\Users\Jonathan\Desktop\Taketatsu Ayana and Hanazawa Kana Talk About Lolis.flv
[2012/02/23 12:50:22 | 000,262,938 | ---- | C] () -- C:\Users\Jonathan\Desktop\1330015465258.jpg
[2012/02/20 02:43:52 | 000,257,373 | ---- | C] () -- C:\Users\Jonathan\Desktop\rinne-07.jpg
[2012/02/18 20:38:05 | 002,185,701 | ---- | C] () -- C:\Users\Jonathan\Desktop\blazblue_phase_shift_2.zip
[2012/02/18 20:38:00 | 039,022,043 | ---- | C] () -- C:\Users\Jonathan\Desktop\Phase Shift 1.zip
[2012/02/15 10:27:21 | 149,144,660 | ---- | C] () -- C:\Users\Jonathan\Desktop\OP-Podcast-0506-MP3.mp3
[2012/02/12 22:14:20 | 000,397,103 | ---- | C] () -- C:\Users\Jonathan\Desktop\1329092028963.jpg
[2012/01/19 22:07:25 | 000,051,186 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room_v3.dat
[2011/08/25 20:49:57 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2011/08/25 20:49:56 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011/08/25 20:49:51 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011/08/25 20:49:51 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011/08/25 20:49:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011/07/21 00:56:16 | 000,090,112 | ---- | C] () -- C:\Windows\System32\imsfchk.dll
[2011/07/21 00:56:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\imslevel.dll
[2011/06/18 10:22:19 | 000,230,529 | ---- | C] () -- C:\Windows\System32\libpng14-14.dll
[2011/06/18 10:22:19 | 000,100,352 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2011/06/18 10:22:19 | 000,098,590 | ---- | C] () -- C:\Windows\System32\libwimp.dll
[2011/06/18 10:22:19 | 000,062,130 | ---- | C] () -- C:\Windows\System32\libpixmap.dll
[2011/06/18 10:22:18 | 000,103,029 | ---- | C] () -- C:\Windows\System32\libpangocairo-1.0-0.dll
[2011/06/18 10:22:18 | 000,060,537 | ---- | C] () -- C:\Windows\System32\libgailutil-18.dll
[2011/06/18 10:22:17 | 001,136,422 | ---- | C] () -- C:\Windows\System32\libcairo-2.dll
[2011/06/18 10:22:17 | 000,551,096 | ---- | C] () -- C:\Windows\System32\freetype6.dll
[2011/06/18 10:22:17 | 000,466,257 | ---- | C] () -- C:\Windows\System32\libgail.dll
[2011/06/18 10:22:17 | 000,279,059 | ---- | C] () -- C:\Windows\System32\libfontconfig-1.dll
[2011/06/18 10:22:17 | 000,143,096 | ---- | C] () -- C:\Windows\System32\libexpat-1.dll
[2011/03/22 20:36:53 | 000,041,890 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\room.dat
[2011/02/09 23:03:48 | 000,000,314 | ---- | C] () -- C:\Windows\primopdf.ini
[2010/06/15 14:59:08 | 000,073,728 | ---- | C] () -- C:\Windows\System32\imsaiff.dll
[2010/06/15 14:59:08 | 000,036,864 | ---- | C] () -- C:\Windows\System32\DGRip.dll
[2010/05/08 21:26:27 | 000,165,425 | ---- | C] () -- C:\Windows\hpoins28.dat.temp
[2009/11/03 09:38:35 | 000,388,112 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
[2009/10/27 23:01:35 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
[2009/08/03 17:47:10 | 000,006,328 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\PrimoPDFSet.xml
[2009/08/03 17:45:12 | 000,180,624 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
[2009/07/09 09:32:07 | 000,000,056 | ---- | C] () -- C:\Windows\kgt2k.INI
[2009/07/08 20:03:02 | 000,058,880 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll
[2009/06/17 10:17:36 | 000,004,508 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2009/05/12 14:23:05 | 000,000,398 | ---- | C] () -- C:\Windows\AudioConverter.INI
[2009/03/06 23:29:32 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat.temp
[2009/03/06 22:45:47 | 000,165,697 | ---- | C] () -- C:\Windows\hpoins28.dat
[2008/10/26 19:01:59 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008/10/08 09:07:37 | 000,008,248 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\en.ini
[2008/08/02 13:11:21 | 000,023,888 | ---- | C] () -- C:\Users\Jonathan\AppData\Roaming\UserTile.png
[2008/08/01 23:07:07 | 000,077,940 | ---- | C] () -- C:\Windows\War3Unin.dat
[2008/07/29 23:15:09 | 000,006,944 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\d3d9caps.dat
[2008/07/28 21:58:01 | 000,232,960 | ---- | C] () -- C:\Users\Jonathan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/28 13:50:51 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008/07/28 13:50:51 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/07/16 23:55:43 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2008/07/16 23:55:43 | 000,168,883 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008/07/16 23:55:43 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/07/16 23:55:43 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe
[2008/07/16 21:22:33 | 000,000,076 | RHS- | C] () -- C:\Windows\CT4CET.bin
[2008/07/16 21:16:21 | 000,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2008/07/16 21:16:20 | 000,026,112 | ---- | C] () -- C:\Windows\System32\WLTRYSVC.EXE
[2008/07/16 16:00:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008/05/11 22:49:03 | 000,000,796 | ---- | C] () -- C:\Windows\hpomdl28.dat
[2008/04/29 13:42:24 | 000,503,808 | ---- | C] () -- C:\Windows\System32\ICCProfiles.dll
[2008/01/20 21:24:55 | 000,075,264 | ---- | C] () -- C:\Windows\System32\drivers\dfsc.sys
[2007/11/26 21:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,396,976 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,600,882 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,105,658 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005/03/30 11:29:16 | 000,114,688 | ---- | C] () -- C:\Windows\System32\msvos.dll

========== LOP Check ==========

[2011/10/08 21:33:46 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Audacity
[2008/07/28 13:42:32 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DigitalPersona
[2012/02/29 15:55:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\DNA
[2010/12/08 15:43:13 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Downloaded Installations
[2011/05/26 12:05:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Dropbox
[2011/07/22 21:02:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\GetRightToGo
[2010/06/26 10:18:54 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\IObit
[2010/08/25 14:51:51 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\JAM Software
[2011/07/22 21:12:31 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Music Recognition
[2010/04/07 10:31:12 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NCH Swift Sound
[2009/10/13 13:33:22 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\NeopleLauncherDFO
[2011/12/08 12:17:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Nitro PDF
[2011/12/08 12:15:26 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\OpenCandy
[2010/12/09 23:12:02 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PCDr
[2008/08/02 13:11:21 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PeerNetworking
[2011/07/11 17:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Lab
[2011/07/09 23:07:05 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Pokemon Online
[2011/12/08 12:17:57 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\PrimoPDF
[2009/10/16 18:34:06 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\RenPy
[2009/05/12 11:22:01 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\River Past G5
[2010/12/17 13:35:42 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Sony
[2008/09/07 17:09:33 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SonyEricsson
[2010/10/04 19:40:10 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Synthesia
[2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\SYSTEMAX Software Development
[2010/08/20 08:11:08 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Thunderbird
[2012/02/28 19:59:59 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\uTorrent
[2009/12/30 12:01:34 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\VBA-M
[2008/07/29 20:01:29 | 000,000,000 | ---D | M] -- C:\Users\Jonathan\AppData\Roaming\Windows Live Writer
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2008/08/09 22:26:58 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
[2008/10/29 15:55:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Citrix
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2010/04/07 10:29:38 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound
[2009/10/27 15:18:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Nexon
[2011/09/11 16:35:36 | 000,000,000 | ---D | M] -- C:\ProgramData\NexonUS
[2011/12/08 12:16:30 | 000,000,000 | ---D | M] -- C:\ProgramData\Nitro PDF
[2011/05/24 15:14:54 | 000,000,000 | ---D | M] -- C:\ProgramData\PCDr
[2011/05/02 22:20:11 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2009/05/12 13:52:39 | 000,000,000 | ---D | M] -- C:\ProgramData\River Past G5
[2008/09/06 19:01:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/08/09 19:37:25 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
[2008/10/09 11:23:29 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2008/07/28 13:37:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/07/16 21:25:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Uninstall
[2008/09/23 13:41:44 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2012/01/30 18:58:57 | 000,000,000 | ---D | M] -- C:\ProgramData\youku
[2012/02/24 21:17:52 | 000,000,000 | ---D | M] -- C:\ProgramData\YouTube Downloader
[2011/01/30 23:23:07 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/19 16:59:18 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2012/02/29 16:57:54 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========



< MD5 for: AFD.SYS >
[2012/03/01 14:00:48 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\afd.sys
[2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\System32\drivers\afd.sys
[2008/01/20 21:24:17 | 000,273,920 | ---- | M] () MD5=B758C5505715AD33D6DFB4332C7F07D5 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys

< MD5 for: EXPLORER.EXE >
[2008/10/29 01:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
[2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 22:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008/10/27 21:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 21:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

========== Files - Unicode (All) ==========
[2010/06/22 23:17:59 | 000,769,473 | ---- | C] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
[2010/06/21 10:39:53 | 000,769,473 | ---- | M] ()(C:\Users\Jonathan\Desktop\11338478- SAE^2 - ??????????.png) -- C:\Users\Jonathan\Desktop\11338478- SAE^2 - はやぶさの名を冠する.png
[2009/10/06 23:06:03 | 005,765,164 | ---- | M] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
[2009/10/06 23:05:37 | 005,765,164 | ---- | C] ()(C:\Users\Jonathan\Desktop\Life Goes On - ???.mp3) -- C:\Users\Jonathan\Desktop\Life Goes On - 中文版.mp3
< End of report >
 
Do this on the computer you are posting from:
Copy the text in the codebox below:


Code:
:OTL

:Services

:Reg

:Files
C:\Windows\System32\drivers\afd.sys|C:\afd.sys /replace
C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys|C:\afd.sys /replace

:Commands
[purity]

Open Notepad and paste it.
Save the document as Fix.txt on to a USB flash drive


On the infected computer the following...

Run OTLPE

  • Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
    • (The content of Fix.txt should appear in the box)
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Post the log produced (you'll need to transfer it with USB stick)
  • Remove the CD and shut down computer manually.
  • Attempt to reboot normally into Windows.
 
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File C:\Windows\System32\drivers\afd.sys successfully replaced with C:\afd.sys
File C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys successfully replaced with C:\afd.sys
========== COMMANDS ==========

OTLPE by OldTimer - Version 3.1.48.0 log created on 03012012_153247
 
Back