OTL logfile created on: 10/30/2011 9:11:23 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\~Vamp~\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1015.30 Mb Total Physical Memory | 661.64 Mb Available Physical Memory | 65.17% Memory free
2.38 Gb Paging File | 2.18 Gb Available in Paging File | 91.44% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 180.89 Gb Free Space | 77.68% Space Free | Partition Type: NTFS
Computer Name: VAMP | User Name: ~Vamp~ | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/10/30 21:09:23 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\~Vamp~\Desktop\OTL.exe
PRC - [2011/10/11 03:50:36 | 000,273,528 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\real\realplayer\Update\realsched.exe
PRC - [2009/03/10 23:18:14 | 000,934,792 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\system32\WgaTray.exe
PRC - [2008/04/14 00:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\explorer.exe
PRC - [2005/10/11 14:33:20 | 002,807,808 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS.0\alcwzrd.exe
PRC - [2005/09/21 11:24:02 | 000,086,016 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS.0\SoundMan.exe
========== Modules (No Company Name) ==========
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- -- (wuauserv)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon)
SRV - [2008/05/05 18:25:46 | 000,165,416 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe -- (GameConsoleService)
========== Driver Services (SafeList) ==========
DRV - [2009/02/24 18:42:14 | 000,116,736 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\mcdbus.sys -- (mcdbus)
DRV - [2008/10/09 15:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV - [2005/10/18 14:15:42 | 004,034,048 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/12/15 16:18:32 | 000,220,928 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2004/12/15 16:18:28 | 000,703,232 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/12/15 16:18:26 | 001,038,208 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\HSF_DP.sys -- (HSF_DP)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-725345543-2025429265-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.ask.com?o=14196&l=dis
IE - HKU\S-1-5-21-725345543-2025429265-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.5
FF - prefs.js..extensions.enabledItems:
jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@eximion.com/KalydoPlayer: C:\Documents and Settings\~Vamp~\Application Data\Kalydo\KalydoPlayer\bin\npkalydo.dll (Eximion B.V.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/10/11 03:51:04 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/11 03:50:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/11 03:51:31 | 000,000,000 | ---D | M]
[2010/03/24 23:26:44 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Extensions
[2010/03/24 23:26:44 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2011/10/27 23:04:33 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Firefox\Profiles\2u18d2m4.default\extensions
[2010/06/06 23:40:56 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Firefox\Profiles\2u18d2m4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/01 22:16:56 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Firefox\Profiles\2u18d2m4.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/08/18 22:25:34 | 000,000,000 | -H-D | M] (DownloadHelper) -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Firefox\Profiles\2u18d2m4.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/11/28 18:56:04 | 000,002,568 | -H-- | M] () -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Firefox\Profiles\2u18d2m4.default\searchplugins\askcom.xml
[2010/10/02 17:40:36 | 000,001,919 | -H-- | M] () -- C:\Documents and Settings\~Vamp~\Application Data\Mozilla\Firefox\Profiles\2u18d2m4.default\searchplugins\bing-zugo.xml
[2011/10/30 11:43:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/10/24 16:52:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/10/11 03:51:04 | 000,000,000 | -H-D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2010/03/24 23:25:35 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/10/03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
O1 HOSTS File: ([2011/10/30 12:43:39 | 000,000,027 | ---- | M]) - C:\WINDOWS.0\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS.0\alcwzrd.exe (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS.0\SoundMan.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\WINDOWS.0\System32\cmd.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-725345543-2025429265-1177238915-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-725345543-2025429265-1177238915-1003\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-725345543-2025429265-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-725345543-2025429265-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-725345543-2025429265-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 72.51.219.21 72.51.219.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F028BDBB-D2A2-4479-AE87-14B96E83FE20}: DhcpNameServer = 72.51.219.21 72.51.219.22
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS.0\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS.0\system32\userinit.exe) -C:\WINDOWS.0\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\~Vamp~\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\~Vamp~\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/23 23:10:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: wuauserv - File not found
Drivers32: msacm.iac2 - C:\WINDOWS.0\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS.0\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS.0\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS.0\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS.0\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS.0\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS.0\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS.0\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS.0\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.XVID - C:\WINDOWS.0\System32\xvidvfw.dll ()
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/10/30 21:09:36 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\~Vamp~\Desktop\OTL.exe
[2011/10/30 14:19:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Desktop\bootkit_remover
[2011/10/30 14:15:00 | 001,564,464 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\~Vamp~\Desktop\tdsskiller.exe
[2011/10/30 13:01:14 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/10/30 12:03:55 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/10/30 12:02:12 | 004,278,480 | R--- | C] (Swearware) -- C:\Documents and Settings\~Vamp~\Desktop\ComboFix.exe
[2011/10/30 11:50:20 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\~Vamp~\Desktop\aswMBR.exe
[2011/10/30 11:47:19 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/10/29 22:31:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/10/29 22:31:40 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/10/29 21:30:49 | 000,000,000 | ---D | C] -- C:\Program Files\MALWAREBYTES ANTI-MALWARE
[2011/10/28 01:02:19 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/10/27 23:14:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS.0\NIRCMD.exe
[2011/10/27 23:14:03 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS.0\SWREG.exe
[2011/10/27 23:14:03 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS.0\SWSC.exe
[2011/10/27 23:14:03 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS.0\SWXCACLS.exe
[2011/10/27 23:12:45 | 000,000,000 | ---D | C] -- C:\WINDOWS.0\ERDNT
[2011/10/27 23:04:31 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/10/24 17:53:56 | 000,000,000 | ---D | C] -- C:\WINDOWS.0\System32\WindowsPowerShell
[2011/10/24 17:53:54 | 000,000,000 | ---D | C] -- C:\WINDOWS.0\System32\winrm
[2011/10/24 17:53:54 | 000,000,000 | ---D | C] -- C:\WINDOWS.0\System32\GroupPolicy
[2011/10/24 17:53:48 | 000,000,000 | -H-D | C] -- C:\WINDOWS.0\$968930Uinstall_KB968930$
[2011/10/24 16:43:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Application Data\.minecraft
[2011/10/24 00:56:13 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011/10/24 00:56:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Start Menu\Programs\HiJackThis
[2011/10/21 11:40:03 | 000,000,000 | ---D | C] -- C:\data
[2011/10/21 11:40:03 | 000,000,000 | ---D | C] -- C:\c3
[2011/10/21 11:38:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Application Data\Kalydo
[2011/10/20 20:17:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/10/20 20:17:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG PC Tuneup 2011
[2011/10/20 18:47:02 | 000,000,000 | ---D | C] -- C:\Program Files\ASK.COM
[2011/10/20 17:53:30 | 000,000,000 | ---D | C] -- C:\Program Files\Free Window Registry Repair
[2011/10/18 13:11:33 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Funcom
[2011/10/18 13:11:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\media center programs
[2011/10/18 13:11:28 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Conquer Online 2.0
[2011/10/18 13:11:28 | 000,000,000 | ---D | C] -- C:\Program Files\Funcom
[2011/10/18 13:11:08 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\GameHouse
[2011/10/18 13:11:07 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Philips Digital Audio Player
[2011/10/18 13:11:07 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\~Vamp~\Application Data\InstallShield
[2011/10/18 13:11:07 | 000,000,000 | ---D | C] -- C:\Program Files\Philips
[2011/10/18 13:10:57 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Bethesda Softworks
[2011/10/18 13:10:50 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\~Vamp~\Application Data\WSOP-USA.com
[2011/10/18 13:10:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Start Menu\Programs\WSOP-USA.com
[2011/10/18 13:10:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Start Menu\Programs\Games
[2011/10/18 13:10:49 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo Layers Runtime
[2011/10/18 13:10:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Start Menu\Programs\MagicISO
[2011/10/18 01:23:24 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/10/18 01:23:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/10/17 22:47:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Application Data\AVG
[2011/10/17 17:21:35 | 000,000,000 | ---D | C] -- C:\$AVG
[2011/10/17 16:56:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/10/17 16:55:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/10/17 16:54:45 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2011/10/17 16:50:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2011/10/17 16:42:14 | 000,000,000 | ---D | C] -- C:\WINDOWS.0\pss
[2011/10/15 07:31:46 | 000,000,000 | -HSD | C] -- C:\WINDOWS.0\CSC
[2011/10/15 07:27:30 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\~Vamp~\Recent
[2011/10/14 00:06:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Start Menu\Programs\GetFunGames
[2011/10/13 00:51:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Local Settings\Application Data\Funcom
[2011/10/11 13:30:11 | 000,000,000 | -H-D | C] -- C:\WINDOWS.0\ie8
[2011/10/11 03:51:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2011/10/11 02:03:32 | 000,000,000 | ---D | C] -- C:\GameHouse Games
[2011/10/11 02:02:56 | 000,000,000 | ---D | C] -- C:\Program Files\RealArcade
[2011/10/11 01:57:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\~Vamp~\Local Settings\Application Data\OpenCandy
[2011/10/11 01:57:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\~Vamp~\Application Data\OpenCandy
[5 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ]
[1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/10/30 21:11:10 | 000,000,288 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeScheduledTaskS-1-5-21-725345543-2025429265-1177238915-1003.job
[2011/10/30 21:11:10 | 000,000,280 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeLogonTaskS-1-5-21-725345543-2025429265-1177238915-1003.job
[2011/10/30 21:09:23 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\~Vamp~\Desktop\OTL.exe
[2011/10/30 21:02:20 | 000,000,664 | ---- | M] () -- C:\WINDOWS.0\System32\d3d9caps.dat
[2011/10/30 18:57:02 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\~Vamp~\My Documents\MBR.dat
[2011/10/30 18:09:20 | 000,000,428 | -H-- | M] () -- C:\WINDOWS.0\tasks\User_Feed_Synchronization-{83055DD6-53B0-4A37-AD36-8700BF7A2095}.job
[2011/10/30 14:17:37 | 000,002,206 | ---- | M] () -- C:\WINDOWS.0\System32\wpa.dbl
[2011/10/30 14:17:27 | 000,000,294 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeLogonTaskS-1-5-21-725345543-2025429265-1177238915-500.job
[2011/10/30 14:17:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS.0\bootstat.dat
[2011/10/30 14:15:04 | 000,044,607 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Desktop\bootkit_remover.zip
[2011/10/30 14:15:00 | 001,564,464 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\~Vamp~\Desktop\tdsskiller.exe
[2011/10/30 12:43:39 | 000,000,027 | ---- | M] () -- C:\WINDOWS.0\System32\drivers\etc\hosts
[2011/10/30 12:02:11 | 004,278,480 | R--- | M] (Swearware) -- C:\Documents and Settings\~Vamp~\Desktop\ComboFix.exe
[2011/10/30 11:58:18 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\~Vamp~\Desktop\aswMBR.exe
[2011/10/29 22:31:46 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/10/29 20:21:43 | 000,000,552 | ---- | M] () -- C:\WINDOWS.0\System32\d3d8caps.dat
[2011/10/29 07:47:00 | 000,000,302 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeScheduledTaskS-1-5-21-725345543-2025429265-1177238915-500.job
[2011/10/28 02:41:20 | 000,022,016 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/28 01:02:39 | 000,000,441 | RHS- | M] () -- C:\boot.ini
[2011/10/27 22:50:58 | 000,002,449 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Desktop\HiJackThis.lnk
[2011/10/24 18:20:32 | 000,503,056 | ---- | M] () -- C:\WINDOWS.0\System32\perfh009.dat
[2011/10/24 18:20:32 | 000,088,454 | ---- | M] () -- C:\WINDOWS.0\System32\perfc009.dat
[2011/10/24 17:55:45 | 000,001,393 | ---- | M] () -- C:\WINDOWS.0\imsins.BAK
[2011/10/24 16:54:57 | 000,000,875 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Desktop\Shortcut to Minecraft.lnk
[2011/10/20 20:17:03 | 000,000,848 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Application Data\Microsoft\Internet Explorer\Quick Launch\AVG PC Tuneup 2011.lnk
[2011/10/20 20:17:03 | 000,000,830 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Desktop\AVG PC Tuneup 2011.lnk
[2011/10/20 18:30:39 | 000,000,324 | ---- | M] () -- C:\Boot.bak
[2011/10/20 17:10:10 | 000,000,949 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Desktop\Shortcut to firefox.lnk
[2011/10/20 16:24:22 | 001,008,092 | ---- | M] () -- C:\Documents and Settings\~Vamp~\My Documents\rkill.exe
[2011/10/15 07:29:17 | 000,000,328 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk
[2011/10/13 03:27:18 | 000,093,480 | ---- | M] () -- C:\WINDOWS.0\System32\FNTCACHE.DAT
[2011/10/11 03:50:38 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS.0\System32\pncrt.dll
[2011/10/03 00:28:30 | 000,001,472 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Desktop\DivX Movies.lnk
[5 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ]
[1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/10/30 18:57:02 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\~Vamp~\My Documents\MBR.dat
[2011/10/30 14:15:05 | 000,044,607 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Desktop\bootkit_remover.zip
[2011/10/30 13:01:55 | 000,000,664 | ---- | C] () -- C:\WINDOWS.0\System32\d3d9caps.dat
[2011/10/29 22:31:46 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/10/29 20:21:43 | 000,000,552 | ---- | C] () -- C:\WINDOWS.0\System32\d3d8caps.dat
[2011/10/28 01:02:37 | 000,000,324 | ---- | C] () -- C:\Boot.bak
[2011/10/28 01:02:22 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/10/27 23:14:04 | 000,208,896 | ---- | C] () -- C:\WINDOWS.0\MBR.exe
[2011/10/27 23:14:03 | 000,256,000 | ---- | C] () -- C:\WINDOWS.0\PEV.exe
[2011/10/27 23:14:03 | 000,098,816 | ---- | C] () -- C:\WINDOWS.0\sed.exe
[2011/10/27 23:14:03 | 000,080,412 | ---- | C] () -- C:\WINDOWS.0\grep.exe
[2011/10/27 23:14:03 | 000,068,096 | ---- | C] () -- C:\WINDOWS.0\zip.exe
[2011/10/26 23:16:06 | 000,000,280 | ---- | C] () -- C:\WINDOWS.0\tasks\RealUpgradeLogonTaskS-1-5-21-725345543-2025429265-1177238915-1003.job
[2011/10/24 16:54:57 | 000,000,875 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Desktop\Shortcut to Minecraft.lnk
[2011/10/24 00:56:13 | 000,002,449 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Desktop\HiJackThis.lnk
[2011/10/20 20:17:03 | 000,000,848 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Application Data\Microsoft\Internet Explorer\Quick Launch\AVG PC Tuneup 2011.lnk
[2011/10/20 20:17:03 | 000,000,830 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Desktop\AVG PC Tuneup 2011.lnk
[2011/10/20 17:10:10 | 000,000,949 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Desktop\Shortcut to firefox.lnk
[2011/10/20 16:24:19 | 001,008,092 | ---- | C] () -- C:\Documents and Settings\~Vamp~\My Documents\rkill.exe
[2011/10/15 07:47:52 | 000,000,302 | ---- | C] () -- C:\WINDOWS.0\tasks\RealUpgradeScheduledTaskS-1-5-21-725345543-2025429265-1177238915-500.job
[2011/10/15 07:47:52 | 000,000,294 | ---- | C] () -- C:\WINDOWS.0\tasks\RealUpgradeLogonTaskS-1-5-21-725345543-2025429265-1177238915-500.job
[2011/10/15 07:29:17 | 000,000,328 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk
[2011/10/11 13:36:37 | 000,000,428 | -H-- | C] () -- C:\WINDOWS.0\tasks\User_Feed_Synchronization-{83055DD6-53B0-4A37-AD36-8700BF7A2095}.job
[2011/10/03 00:28:30 | 000,001,472 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Desktop\DivX Movies.lnk
[2010/11/26 21:03:31 | 000,815,104 | ---- | C] () -- C:\WINDOWS.0\System32\xvidcore.dll
[2010/11/26 21:03:30 | 000,180,224 | ---- | C] () -- C:\WINDOWS.0\System32\xvidvfw.dll
[2010/06/05 01:53:23 | 000,022,016 | ---- | C] () -- C:\Documents and Settings\~Vamp~\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/05 01:38:51 | 000,165,376 | ---- | C] () -- C:\WINDOWS.0\System32\unrar.dll
[2010/03/27 01:02:27 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\~Vamp~\Application Data\725F07
[2010/03/27 01:02:26 | 000,870,128 | -H-- | C] () -- C:\Documents and Settings\~Vamp~\Application Data\mcs.rma
[2010/03/24 22:27:09 | 000,157,184 | ---- | C] () -- C:\WINDOWS.0\System32\RtlCPAPI.dll
[2010/03/24 22:27:09 | 000,040,960 | ---- | C] () -- C:\WINDOWS.0\System32\ChCfg.exe
[2010/03/23 23:12:30 | 000,002,048 | --S- | C] () -- C:\WINDOWS.0\bootstat.dat
[2010/03/23 23:07:12 | 000,021,640 | ---- | C] () -- C:\WINDOWS.0\System32\emptyregdb.dat
[2010/03/23 22:30:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS.0\nsreg.dat
[2010/03/23 16:58:43 | 000,004,249 | ---- | C] () -- C:\WINDOWS.0\ODBCINST.INI
[2010/03/23 16:57:13 | 000,093,480 | ---- | C] () -- C:\WINDOWS.0\System32\FNTCACHE.DAT
[2008/04/14 00:55:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS.0\System32\Dcache.bin
[2006/12/31 02:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS.0\System32\secupd.dat
[2001/08/23 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.bin
[2001/08/23 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS.0\System32\mlang.dat
[2001/08/23 07:00:00 | 000,503,056 | ---- | C] () -- C:\WINDOWS.0\System32\perfh009.dat
[2001/08/23 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS.0\System32\perfi009.dat
[2001/08/23 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS.0\System32\dssec.dat
[2001/08/23 07:00:00 | 000,088,454 | ---- | C] () -- C:\WINDOWS.0\System32\perfc009.dat
[2001/08/23 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS.0\System32\mib.bin
[2001/08/23 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS.0\System32\perfd009.dat
[2001/08/23 07:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.dat
[2001/08/23 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS.0\System32\noise.dat
========== LOP Check ==========
[2011/10/30 11:52:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/10/17 16:56:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/10/30 11:48:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/09/07 23:40:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters Inc
[2011/08/22 20:14:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RoboForm
[2011/03/05 14:04:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Soulseek
[2011/10/21 09:47:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/04/02 12:35:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
[2011/02/26 02:03:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/10/24 18:50:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\~Vamp~\Application Data\.minecraft
[2010/08/18 16:26:18 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\AnvSoft
[2011/10/20 20:21:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\~Vamp~\Application Data\AVG
[2011/06/21 21:59:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\Azureus
[2010/09/19 16:52:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\enchant
[2011/10/09 19:35:58 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\FrostWire
[2010/09/07 23:37:38 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\GetRightToGo
[2011/10/21 11:38:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\~Vamp~\Application Data\Kalydo
[2011/10/11 01:57:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\OpenCandy
[2011/08/16 22:19:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\Spore
[2011/04/02 12:35:58 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\WildTangent
[2011/10/18 13:10:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\~Vamp~\Application Data\WSOP-USA.com
[2011/10/30 18:09:20 | 000,000,428 | -H-- | M] () -- C:\WINDOWS.0\Tasks\User_Feed_Synchronization-{83055DD6-53B0-4A37-AD36-8700BF7A2095}.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2010/03/23 23:10:02 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2011/10/20 18:30:39 | 000,000,324 | ---- | M] () -- C:\Boot.bak
[2011/10/28 01:02:39 | 000,000,441 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/10/30 12:59:52 | 000,012,215 | ---- | M] () -- C:\ComboFix.txt
[2010/03/23 23:10:02 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2010/03/23 23:10:02 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/03/23 23:10:02 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/13 17:13:04 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/13 19:01:44 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/10/30 14:17:16 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2011/10/20 17:43:07 | 000,000,522 | ---- | M] () -- C:\rkill.log
[2011/10/30 14:16:16 | 000,044,644 | ---- | M] () -- C:\TDSSKiller.2.6.14.0_30.10.2011_14.15.20_log.txt
[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI
< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS.0\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS.0\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS.0\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS.0\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2010/03/23 23:09:34 | 000,000,067 | -HS- | M] () -- C:\WINDOWS.0\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2010/03/23 16:56:37 | 000,094,208 | ---- | M] () -- C:\WINDOWS.0\System32\config\default.sav
[2010/03/23 16:56:37 | 001,089,536 | ---- | M] () -- C:\WINDOWS.0\System32\config\software.sav
[2010/03/23 16:56:37 | 000,913,408 | ---- | M] () -- C:\WINDOWS.0\System32\config\system.sav
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
< %USERPROFILE%\Desktop\*.exe >
[2011/10/30 11:58:18 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\~Vamp~\Desktop\aswMBR.exe
[2011/10/30 12:02:11 | 004,278,480 | R--- | M] (Swearware) -- C:\Documents and Settings\~Vamp~\Desktop\ComboFix.exe
[2011/07/26 20:32:55 | 795,911,552 | ---- | M] () -- C:\Documents and Settings\~Vamp~\Desktop\grandfantasia_install_20101210.exe
[2011/10/30 21:09:23 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\~Vamp~\Desktop\OTL.exe
[2011/10/30 14:15:00 | 001,564,464 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\~Vamp~\Desktop\tdsskiller.exe
[2010/06/01 11:17:48 | 005,252,408 | ---- | M] (Yahoo! Inc.) -- C:\Documents and Settings\~Vamp~\Desktop\YahooMessenger.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
[2011/10/20 16:24:22 | 001,008,092 | ---- | M] () -- C:\Documents and Settings\~Vamp~\My Documents\rkill.exe
< %USERPROFILE%\*.exe >
< %systemroot%\ADDINS\*.* >
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
[2010/03/23 23:15:03 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\~Vamp~\Favorites\Desktop.ini
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
< dir /b "%systemroot%\*.exe" | find /i " " /c >
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
[2011/10/30 21:11:09 | 000,196,608 | -H-- | M] () -- C:\Documents and Settings\~Vamp~\Cookies\index.dat
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 23:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\inf\unregmp2.exe
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.* >
[2008/04/14 00:41:52 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2007/04/02 18:37:24 | 000,004,821 | R--- | M] () -- C:\Program Files\Messenger\logowin.gif
[2007/04/03 00:37:24 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/14 00:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 06:42:30 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2001/08/23 07:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2001/08/23 07:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2001/08/23 07:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2007/04/03 00:37:28 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2007/04/03 00:34:02 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"AutoInstallMinorUpdates" = 1
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
========== Alternate Data Streams ==========
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4
< End of report >