:OTL
PRC - [2010/09/08 19:40:30 | 000,057,616 | ---- | M] () -- C:\ProgramData\ZwankySearch\zwankysearch149.exe
PRC - [2010/09/08 19:40:30 | 000,057,616 | ---- | M] () -- C:\Program Files (x86)\ZwankySearch\zwankysearch.exe
MOD - [2010/09/08 19:41:06 | 000,577,536 | ---- | M] () -- C:\Program Files (x86)\ZwankySearch\zwankysearch.dll
SRV - [2010/09/08 19:40:30 | 000,057,616 | ---- | M] () [Auto | Running] -- C:\ProgramData\ZwankySearch\zwankysearch149.exe -- (ZwankySearch Service)
[2010/09/08 21:49:06 | 000,000,000 | ---D | M] (ZwankySearch) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKCU..\Run: [RemoteControl] File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.164.80,93.188.166.230
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
[2 C:\Users\Zachareye\*.tmp files -> C:\Users\Zachareye\*.tmp -> ]
[2010/03/13 13:30:28 | 000,000,088 | RHS- | C] () -- C:\ProgramData\464B05520D.sys
@Alternate Data Stream - 76 bytes -> C:\Users\Zachareye\Documents\hells choirs the song movie_0001.wmv:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Zachareye\Documents\billing_315664045_4b63051fe9445.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Zachareye\Documents\015.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Zachareye\Documents\007 (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Zachareye\Documents\006 (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Zachareye\Documents\004.JPG:Roxio EMC Stream
@Alternate Data Stream - 1161 bytes -> C:\Users\Zachareye\AppData\Local\Temp:XO3mxP5FCFJ7Hb7Gti27k
@Alternate Data Stream - 1146 bytes -> C:\ProgramData\Microsoft:gpGsYheuPiHZzNpBhxrFcB
@Alternate Data Stream - 1111 bytes -> C:\Users\Zachareye\AppData\Local\Temp:uJ3rYPnJDKxkets5e6tPD1iRPU
@Alternate Data Stream - 1110 bytes -> C:\Users\Zachareye\AppData\Local\Temp:71bKPnAsXDylFi1I2iW0x6k9
@Alternate Data Stream - 1079 bytes -> C:\ProgramData\Microsoft:uGPTw8s383GO1QncBySMV6UuyReE2
@Alternate Data Stream - 1014 bytes -> C:\Users\Zachareye\AppData\Local\BmMRwwWJgvC:oz0qeERBVTxx15Uurziwc
:Services
:Reg
:Files
C:\ProgramData\ZwankySearch
C:\Program Files (x86)\ZwankySearch
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]