slowride71
Posts: 24 +0
computer still acting ok. using avg 2011 free. its reporting rootkit problems also has disabled my ID protection. using explorer8, xp home sp3
Solved Virus in winnt\assembly\gac_MSIL\desktop
- Thread starter slowride71
- Start date
- Status
Broni
Posts: 56,041 +516
Welcome aboard
Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.
Please, observe following rules:
Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.
Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running tools or applying updates other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
slowride71
Posts: 24 +0
virus
I followed steps as close as I could. during gmer,active threat popped up .since avg was disabled ,I clicked quarartine. Its not letting me copy and paste.
I followed steps as close as I could. during gmer,active threat popped up .since avg was disabled ,I clicked quarartine. Its not letting me copy and paste.
slowride71
Posts: 24 +0
virus
alwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7606
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/29/2011 1:48:31 PM
mbam-log-2011-08-29 (13-48-15).txt
Scan type: Quick scan
Objects scanned: 161878
Time elapsed: 12 minute(s), 11 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 128
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 13
Files Infected: 122
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyWebSearchService (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{1093995A-BA37-41D2-836E-091067C4AD17} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.DataControl.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.DataControl (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.2 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3E720452-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3E720451-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.1 (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{A9571378-68A1-443d-B082-284F960C6D17} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{B813095C-81C0-4E40-AA14-67520372B987} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{F42228FB-E84E-479E-B922-FBBD096E792C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ED403E8-470A-4A8A-85A4-D7688CFE39A3} (Adware.Gamevance) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ED403E8-470A-4A8A-85A4-D7688CFE39A3} (Adware.Gamevance) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (Adware.GameVance) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\AppID\activex.DLL (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Value: (default) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Value: f3PopularScreensavers -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Value: FunWebProducts -> No action taken.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
c:\program files\mywebsearch (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\chrome (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Avatar (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\History (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
Files Infected:
c:\program files\mywebsearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> No action taken.
c:\WINNT\system32\f3PSSavr.scr (PUP.FunWebProducts) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\chrome.manifest (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\INSTALL.RDF (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\014759D1 (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01475D8A (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\014779FC.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\014783C0.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\0147866F.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01478C8A.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01478FC6.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\0147918B (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\015361D6.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\0153664A.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01536DBC.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\015371D3.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01E238E9.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01E23D4E.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\02EE4EEB (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\History\search3 (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\8_step1.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\ask_logo.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\autoup.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\autoup.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\bkwebfet.jpg (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\bkzwinky.jpg (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn2d.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn2r.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn3d.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn3r.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\center.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\index.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\logo_ZJ.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\logo_ZR.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\mid_dots.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\mws_logo.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\protect.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtnbg.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtnn1.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtnn2.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtny1.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtny2.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebclose.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut2.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut3.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut3b.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\reb_bg.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\repmidsm.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\shield.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\shocked.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\stop.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\systray.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\systrayp.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\tp_grad.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\warn.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken.
alwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7606
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/29/2011 1:48:31 PM
mbam-log-2011-08-29 (13-48-15).txt
Scan type: Quick scan
Objects scanned: 161878
Time elapsed: 12 minute(s), 11 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 128
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 13
Files Infected: 122
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyWebSearchService (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{1093995A-BA37-41D2-836E-091067C4AD17} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.DataControl.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.DataControl (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.2 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3E720452-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3E720451-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.1 (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{A9571378-68A1-443d-B082-284F960C6D17} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{B813095C-81C0-4E40-AA14-67520372B987} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{F42228FB-E84E-479E-B922-FBBD096E792C} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ED403E8-470A-4A8A-85A4-D7688CFE39A3} (Adware.Gamevance) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ED403E8-470A-4A8A-85A4-D7688CFE39A3} (Adware.Gamevance) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (Adware.GameVance) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\AppID\activex.DLL (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> No action taken.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Value: (default) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Value: f3PopularScreensavers -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Value: FunWebProducts -> No action taken.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
c:\program files\mywebsearch (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\chrome (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Avatar (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\History (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
Files Infected:
c:\program files\mywebsearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> No action taken.
c:\WINNT\system32\f3PSSavr.scr (PUP.FunWebProducts) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\chrome.manifest (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\INSTALL.RDF (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\014759D1 (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01475D8A (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\014779FC.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\014783C0.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\0147866F.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01478C8A.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01478FC6.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\0147918B (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\015361D6.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\0153664A.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01536DBC.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\015371D3.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01E238E9.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\01E23D4E.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\02EE4EEB (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\History\search3 (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\8_step1.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\ask_logo.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\autoup.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\autoup.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\bkwebfet.jpg (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\bkzwinky.jpg (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn2d.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn2r.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn3d.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\blubtn3r.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\center.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\index.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\logo_ZJ.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\logo_ZR.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\mid_dots.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\mws_logo.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\protect.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtnbg.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtnn1.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtnn2.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtny1.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebbtny2.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebclose.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut2.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut3.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\rebut3b.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\reb_bg.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\repmidsm.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\shield.png (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\shocked.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\stop.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\systray.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\systrayp.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\tp_grad.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Message\COMMON\warn.gif (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken.
slowride71
Posts: 24 +0
virus
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-29 15:15:19
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD400EB-75CPF0 rev.06.04G06
Running: bdoinouq.exe; Driver: C:\DOCUME~1\OWNER~1.HOM\LOCALS~1\Temp\uxldqpog.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xF789E738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xF789E7DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xF789E878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xF789E914]
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 4A0 804E2B0C 4 Bytes JMP 8F05229A
? nesxamj.sys The system cannot find the file specified. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExW] [005C02D5] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegOpenKeyExW] [005C0380] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [005C0267] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
---- Files - GMER 1.0.15 ----
File C:\WINNT\$NtUninstallKB42356$\1545864879 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\click.tlb 2144 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L\nnqkxjfa 64512 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\loader.tlb 2540 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@00000001 41360 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000c0 2560 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cb 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cf 1536 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@80000000 25600 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000c0 33280 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cb 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cf 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1734920488 0 bytes
ADS C:\WINNT\2936415324:2749102416.exe 816 bytes executable <-- ROOTKIT !!!
---- Services - GMER 1.0.15 ----
Service C:\WINNT\2936415324:2749102416.exe [MANUAL] 5c2406af <-- ROOTKIT !!!
---- EOF - GMER 1.0.15 ----
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-29 15:15:19
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD400EB-75CPF0 rev.06.04G06
Running: bdoinouq.exe; Driver: C:\DOCUME~1\OWNER~1.HOM\LOCALS~1\Temp\uxldqpog.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xF789E738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xF789E7DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xF789E878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xF789E914]
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 4A0 804E2B0C 4 Bytes JMP 8F05229A
? nesxamj.sys The system cannot find the file specified. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExW] [005C02D5] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegOpenKeyExW] [005C0380] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [005C0267] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
---- Files - GMER 1.0.15 ----
File C:\WINNT\$NtUninstallKB42356$\1545864879 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\click.tlb 2144 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L\nnqkxjfa 64512 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\loader.tlb 2540 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@00000001 41360 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000c0 2560 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cb 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cf 1536 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@80000000 25600 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000c0 33280 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cb 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cf 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1734920488 0 bytes
ADS C:\WINNT\2936415324:2749102416.exe 816 bytes executable <-- ROOTKIT !!!
---- Services - GMER 1.0.15 ----
Service C:\WINNT\2936415324:2749102416.exe [MANUAL] 5c2406af <-- ROOTKIT !!!
---- EOF - GMER 1.0.15 ----
slowride71
Posts: 24 +0
virus
text ntoskrnl.exe!_abnormal_termination + 4A0 804E2B0C 4 Bytes JMP 8F05229A
? nesxamj.sys The system cannot find the file specified. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExW] [005C02D5] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegOpenKeyExW] [005C0380] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [005C0267] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
---- Files - GMER 1.0.15 ----
File C:\WINNT\$NtUninstallKB42356$\1545864879 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\click.tlb 2144 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L\nnqkxjfa 64512 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\loader.tlb 2540 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@00000001 41360 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000c0 2560 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cb 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cf 1536 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@80000000 25600 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000c0 33280 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cb 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cf 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1734920488 0 bytes
ADS C:\WINNT\2936415324:2749102416.exe 816 bytes executable <-- ROOTKIT !!!
---- Services - GMER 1.0.15 ----
Service C:\WINNT\2936415324:2749102416.exe [MANUAL] 5c2406af <-- ROOTKIT !!!
---- EOF - GMER 1.0.15 ----
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-29 15:14:34
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD400EB-75CPF0 rev.06.04G06
Running: bdoinouq.exe; Driver: C:\DOCUME~1\OWNER~1.HOM\LOCALS~1\Temp\uxldqpog.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xF789E738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xF789E7DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xF789E878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xF789E914]
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 4A0 804E2B0C 4 Bytes JMP 8F05229A
? nesxamj.sys The system cannot find the file specified. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExW] [005C02D5] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegOpenKeyExW] [005C0380] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [005C0267] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
---- Files - GMER 1.0.15 ----
File C:\WINNT\$NtUninstallKB42356$\1545864879 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\click.tlb 2144 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L\nnqkxjfa 64512 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\loader.tlb 2540 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@00000001 41360 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000c0 2560 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cb 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cf 1536 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@80000000 25600 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000c0 33280 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cb 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cf 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1734920488 0 bytes
ADS C:\WINNT\2936415324:2749102416.exe 816 bytes executable <-- ROOTKIT !!!
---- Services - GMER 1.0.15 ----
Service C:\WINNT\2936415324:2749102416.exe [MANUAL] 5c2406af <-- ROOTKIT !!!
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 15:19:21 on 2011-08-29
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.329 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINNT\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINNT\BCMSMMSG.exe
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uSearch Page =
uSearch Bar =
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
R
text ntoskrnl.exe!_abnormal_termination + 4A0 804E2B0C 4 Bytes JMP 8F05229A
? nesxamj.sys The system cannot find the file specified. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExW] [005C02D5] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegOpenKeyExW] [005C0380] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [005C0267] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
---- Files - GMER 1.0.15 ----
File C:\WINNT\$NtUninstallKB42356$\1545864879 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\click.tlb 2144 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L\nnqkxjfa 64512 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\loader.tlb 2540 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@00000001 41360 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000c0 2560 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cb 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cf 1536 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@80000000 25600 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000c0 33280 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cb 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cf 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1734920488 0 bytes
ADS C:\WINNT\2936415324:2749102416.exe 816 bytes executable <-- ROOTKIT !!!
---- Services - GMER 1.0.15 ----
Service C:\WINNT\2936415324:2749102416.exe [MANUAL] 5c2406af <-- ROOTKIT !!!
---- EOF - GMER 1.0.15 ----
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-29 15:14:34
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD400EB-75CPF0 rev.06.04G06
Running: bdoinouq.exe; Driver: C:\DOCUME~1\OWNER~1.HOM\LOCALS~1\Temp\uxldqpog.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xF789E738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xF789E7DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xF789E878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xF789E914]
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 4A0 804E2B0C 4 Bytes JMP 8F05229A
? nesxamj.sys The system cannot find the file specified. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\Explorer.EXE[1796] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExW] [005C02D5] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegOpenKeyExW] [005C0380] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [005C0267] C:\Program Files\AIM\aim.exe (AOL Instant Messenger/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9B02] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [6BFA99EE] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9A75] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9967] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
IAT C:\Program Files\AIM\aim.exe[3404] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9B8F] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL Inc.)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
---- Files - GMER 1.0.15 ----
File C:\WINNT\$NtUninstallKB42356$\1545864879 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\click.tlb 2144 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\L\nnqkxjfa 64512 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\loader.tlb 2540 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U 0 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@00000001 41360 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000c0 2560 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cb 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@000000cf 1536 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@80000000 25600 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000c0 33280 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cb 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\U\@800000cf 27648 bytes
File C:\WINNT\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} 2048 bytes
File C:\WINNT\$NtUninstallKB42356$\1734920488 0 bytes
ADS C:\WINNT\2936415324:2749102416.exe 816 bytes executable <-- ROOTKIT !!!
---- Services - GMER 1.0.15 ----
Service C:\WINNT\2936415324:2749102416.exe [MANUAL] 5c2406af <-- ROOTKIT !!!
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 15:19:21 on 2011-08-29
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.329 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINNT\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINNT\BCMSMMSG.exe
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uSearch Page =
uSearch Bar =
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
R
slowride71
Posts: 24 +0
virus
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 15:19:21 on 2011-08-29
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.329 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINNT\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINNT\BCMSMMSG.exe
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uSearch Page =
uSearch Bar =
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe
uRun: [cdloader] "c:\documents and settings\owner.home-5nr1rmgi5l\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [IgfxTray] c:\winnt\system32\igfxtray.exe
mRun: [dla] c:\winnt\system32\dla\tfswctrl.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [TaskTray]
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [<NO NAME>]
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
IE: &Search
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: mswsock.dll
Trusted Zone: intuit.com\ttlc
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - hxxp://w4s2.work4sure.com/c/ge/w4sgeen9.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxps://lowes.2020.net/Core/Player/2020PlayerAX_Win32.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236304913634
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236305120181
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {775879E2-7309-4619-BB02-AADE41F4B690} - hxxp://webgames.d.tmsrv.com/c=51ebb4632190d3421704fb9e9c639c1a/aff=t_05en_wg/p/release/playfirst/wg_dreamchronicles/dreamchronicles/dreamweb.1.0.0.9.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1236551893483&h=1e9625ff85283ce92e2e831cbc104545/&filename=jinstall-6u12-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FC6DEB69-355C-480C-9408-580DCD42E9C3} : DhcpNameServer = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: c:\progra~1\google\go333c~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\winnt\system32\drivers\AVGIDSEH.sys [2010-9-13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\winnt\system32\drivers\avgrkx86.sys [2010-9-7 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\winnt\system32\drivers\avgldx86.sys [2010-9-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\winnt\system32\drivers\avgmfx86.sys [2010-9-7 34896]
R1 Avgtdix;AVG TDI Driver;c:\winnt\system32\drivers\avgtdix.sys [2010-9-7 297168]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-29 366640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-29 24652]
R3 AVGIDSDriver;AVGIDSDriver;c:\winnt\system32\drivers\AVGIDSDriver.sys [2010-8-19 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\winnt\system32\drivers\AVGIDSFilter.sys [2010-8-19 24144]
R3 AVGIDSShim;AVGIDSShim;c:\winnt\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
R3 MBAMProtector;MBAMProtector;c:\winnt\system32\drivers\mbam.sys [2011-8-29 22712]
S0 nielprt;Nielsen Patch Service;c:\winnt\system32\drivers\nielprt.sys --> c:\winnt\system32\drivers\nielprt.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
S2 gupdate1c9bddd41123d4a;Google Update Service (gupdate1c9bddd41123d4a);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-3-13 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\winnt\system32\drivers\mbamswissarmy.sys [2011-8-29 41272]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\winnt\system32\drivers\nx6000.sys [2010-9-30 30576]
S3 NielGfx;Nielsen USB GFX;c:\winnt\system32\drivers\nielgfx.sys --> c:\winnt\system32\drivers\nielgfx.sys [?]
.
=============== Created Last 30 ================
.
2011-08-29 17:34:07 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\Malwarebytes
2011-08-29 17:33:59 41272 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-08-29 17:33:58 -------- d-----w- c:\documents and settings\all users.winnt\application data\Malwarebytes
2011-08-29 17:33:55 22712 ----a-w- c:\winnt\system32\drivers\mbam.sys
2011-08-29 17:33:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-25 13:29:35 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\.frostwire5
2011-08-25 13:27:37 -------- d-----w- c:\program files\FrostWire 5
2011-08-10 22:00:43 139656 -c----w- c:\winnt\system32\dllcache\rdpwd.sys
2011-08-10 21:59:48 10496 -c----w- c:\winnt\system32\dllcache\ndistapi.sys
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\BigFish
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\all users.winnt\application data\BigFish
2011-08-09 20:09:39 -------- d-----w- c:\program files\Jewel Quest Mysteries - The Seventh Gate
.
==================== Find3M ====================
.
2011-08-25 12:53:18 404640 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29:31 456320 ----a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-07-08 14:02:00 10496 ----a-w- c:\winnt\system32\drivers\ndistapi.sys
2011-06-24 14:10:36 139656 ----a-w- c:\winnt\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\winnt\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\winnt\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ----a-w- c:\winnt\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\winnt\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\winnt\system32\winsrv.dll
2011-06-02 14:02:05 1858944 ----a-w- c:\winnt\system32\win32k.sys
2009-03-27 13:00:22 13440584 -c--a-w- c:\program files\Install_AIM.exe
.
============= FINISH: 15:20:04.26 ===============
that should be all of it, thanks
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 15:19:21 on 2011-08-29
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.329 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINNT\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINNT\BCMSMMSG.exe
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uSearch Page =
uSearch Bar =
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe
uRun: [cdloader] "c:\documents and settings\owner.home-5nr1rmgi5l\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [IgfxTray] c:\winnt\system32\igfxtray.exe
mRun: [dla] c:\winnt\system32\dla\tfswctrl.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [TaskTray]
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [<NO NAME>]
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
IE: &Search
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: mswsock.dll
Trusted Zone: intuit.com\ttlc
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - hxxp://w4s2.work4sure.com/c/ge/w4sgeen9.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxps://lowes.2020.net/Core/Player/2020PlayerAX_Win32.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236304913634
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236305120181
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {775879E2-7309-4619-BB02-AADE41F4B690} - hxxp://webgames.d.tmsrv.com/c=51ebb4632190d3421704fb9e9c639c1a/aff=t_05en_wg/p/release/playfirst/wg_dreamchronicles/dreamchronicles/dreamweb.1.0.0.9.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1236551893483&h=1e9625ff85283ce92e2e831cbc104545/&filename=jinstall-6u12-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FC6DEB69-355C-480C-9408-580DCD42E9C3} : DhcpNameServer = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: c:\progra~1\google\go333c~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\winnt\system32\drivers\AVGIDSEH.sys [2010-9-13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\winnt\system32\drivers\avgrkx86.sys [2010-9-7 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\winnt\system32\drivers\avgldx86.sys [2010-9-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\winnt\system32\drivers\avgmfx86.sys [2010-9-7 34896]
R1 Avgtdix;AVG TDI Driver;c:\winnt\system32\drivers\avgtdix.sys [2010-9-7 297168]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-29 366640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-29 24652]
R3 AVGIDSDriver;AVGIDSDriver;c:\winnt\system32\drivers\AVGIDSDriver.sys [2010-8-19 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\winnt\system32\drivers\AVGIDSFilter.sys [2010-8-19 24144]
R3 AVGIDSShim;AVGIDSShim;c:\winnt\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
R3 MBAMProtector;MBAMProtector;c:\winnt\system32\drivers\mbam.sys [2011-8-29 22712]
S0 nielprt;Nielsen Patch Service;c:\winnt\system32\drivers\nielprt.sys --> c:\winnt\system32\drivers\nielprt.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
S2 gupdate1c9bddd41123d4a;Google Update Service (gupdate1c9bddd41123d4a);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-3-13 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\winnt\system32\drivers\mbamswissarmy.sys [2011-8-29 41272]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\winnt\system32\drivers\nx6000.sys [2010-9-30 30576]
S3 NielGfx;Nielsen USB GFX;c:\winnt\system32\drivers\nielgfx.sys --> c:\winnt\system32\drivers\nielgfx.sys [?]
.
=============== Created Last 30 ================
.
2011-08-29 17:34:07 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\Malwarebytes
2011-08-29 17:33:59 41272 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-08-29 17:33:58 -------- d-----w- c:\documents and settings\all users.winnt\application data\Malwarebytes
2011-08-29 17:33:55 22712 ----a-w- c:\winnt\system32\drivers\mbam.sys
2011-08-29 17:33:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-25 13:29:35 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\.frostwire5
2011-08-25 13:27:37 -------- d-----w- c:\program files\FrostWire 5
2011-08-10 22:00:43 139656 -c----w- c:\winnt\system32\dllcache\rdpwd.sys
2011-08-10 21:59:48 10496 -c----w- c:\winnt\system32\dllcache\ndistapi.sys
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\BigFish
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\all users.winnt\application data\BigFish
2011-08-09 20:09:39 -------- d-----w- c:\program files\Jewel Quest Mysteries - The Seventh Gate
.
==================== Find3M ====================
.
2011-08-25 12:53:18 404640 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29:31 456320 ----a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-07-08 14:02:00 10496 ----a-w- c:\winnt\system32\drivers\ndistapi.sys
2011-06-24 14:10:36 139656 ----a-w- c:\winnt\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\winnt\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\winnt\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ----a-w- c:\winnt\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\winnt\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\winnt\system32\winsrv.dll
2011-06-02 14:02:05 1858944 ----a-w- c:\winnt\system32\win32k.sys
2009-03-27 13:00:22 13440584 -c--a-w- c:\program files\Install_AIM.exe
.
============= FINISH: 15:20:04.26 ===============
that should be all of it, thanks
Broni
Posts: 56,041 +516
I still need Attach.txt part of DDS.
Then your MBAM log says "No action taken".
Re-run it, FIX all issues and post new log.
Next....
Download TDSSKiller and save it to your desktop.
Then your MBAM log says "No action taken".
Re-run it, FIX all issues and post new log.
Next....
Download TDSSKiller and save it to your desktop.
- Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
- If an infected file is detected, the default action will be Cure, click on Continue.
- If a suspicious file is detected, the default action will be Skip, click on Continue.
- It may ask you to reboot the computer to complete the process. Click on Reboot Now.
- If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
- If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
slowride71
Posts: 24 +0
virus
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 16:18:21 on 2011-08-31
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.58 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\WINNT\BCMSMMSG.exe
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINNT\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uSearch Page =
uSearch Bar =
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe
uRun: [cdloader] "c:\documents and settings\owner.home-5nr1rmgi5l\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [IgfxTray] c:\winnt\system32\igfxtray.exe
mRun: [dla] c:\winnt\system32\dla\tfswctrl.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [TaskTray]
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [<NO NAME>]
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
IE: &Search
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: mswsock.dll
Trusted Zone: intuit.com\ttlc
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - hxxp://w4s2.work4sure.com/c/ge/w4sgeen9.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxps://lowes.2020.net/Core/Player/2020PlayerAX_Win32.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236304913634
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236305120181
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {775879E2-7309-4619-BB02-AADE41F4B690} - hxxp://webgames.d.tmsrv.com/c=51ebb4632190d3421704fb9e9c639c1a/aff=t_05en_wg/p/release/playfirst/wg_dreamchronicles/dreamchronicles/dreamweb.1.0.0.9.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1236551893483&h=1e9625ff85283ce92e2e831cbc104545/&filename=jinstall-6u12-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FC6DEB69-355C-480C-9408-580DCD42E9C3} : DhcpNameServer = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: c:\progra~1\google\go333c~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\winnt\system32\drivers\AVGIDSEH.sys [2010-9-13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\winnt\system32\drivers\avgrkx86.sys [2010-9-7 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\winnt\system32\drivers\avgldx86.sys [2010-9-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\winnt\system32\drivers\avgmfx86.sys [2010-9-7 34896]
R1 Avgtdix;AVG TDI Driver;c:\winnt\system32\drivers\avgtdix.sys [2010-9-7 297168]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-29 366640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-29 24652]
R3 AVGIDSDriver;AVGIDSDriver;c:\winnt\system32\drivers\AVGIDSDriver.sys [2010-8-19 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\winnt\system32\drivers\AVGIDSFilter.sys [2010-8-19 24144]
R3 AVGIDSShim;AVGIDSShim;c:\winnt\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
R3 MBAMProtector;MBAMProtector;c:\winnt\system32\drivers\mbam.sys [2011-8-29 22712]
S0 nielprt;Nielsen Patch Service;c:\winnt\system32\drivers\nielprt.sys --> c:\winnt\system32\drivers\nielprt.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
S2 gupdate1c9bddd41123d4a;Google Update Service (gupdate1c9bddd41123d4a);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-3-13 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\winnt\system32\drivers\mbamswissarmy.sys [2011-8-29 41272]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\winnt\system32\drivers\nx6000.sys [2010-9-30 30576]
S3 NielGfx;Nielsen USB GFX;c:\winnt\system32\drivers\nielgfx.sys --> c:\winnt\system32\drivers\nielgfx.sys [?]
.
=============== Created Last 30 ================
.
2011-08-29 17:34:07 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\Malwarebytes
2011-08-29 17:33:59 41272 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-08-29 17:33:58 -------- d-----w- c:\documents and settings\all users.winnt\application data\Malwarebytes
2011-08-29 17:33:55 22712 ----a-w- c:\winnt\system32\drivers\mbam.sys
2011-08-29 17:33:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-25 13:29:35 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\.frostwire5
2011-08-25 13:27:37 -------- d-----w- c:\program files\FrostWire 5
2011-08-10 22:00:43 139656 -c----w- c:\winnt\system32\dllcache\rdpwd.sys
2011-08-10 21:59:48 10496 -c----w- c:\winnt\system32\dllcache\ndistapi.sys
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\BigFish
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\all users.winnt\application data\BigFish
2011-08-09 20:09:39 -------- d-----w- c:\program files\Jewel Quest Mysteries - The Seventh Gate
.
==================== Find3M ====================
.
2011-08-25 12:53:18 404640 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29:31 456320 ----a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-07-08 14:02:00 10496 ----a-w- c:\winnt\system32\drivers\ndistapi.sys
2011-06-24 14:10:36 139656 ----a-w- c:\winnt\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\winnt\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\winnt\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ----a-w- c:\winnt\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\winnt\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\winnt\system32\winsrv.dll
2009-03-27 13:00:22 13440584 -c--a-w- c:\program files\Install_AIM.exe
.
============= FINISH: 16:20:17.92 ===============
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 16:18:21 on 2011-08-31
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.58 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
C:\WINNT\BCMSMMSG.exe
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINNT\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uSearch Page =
uSearch Bar =
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe
uRun: [cdloader] "c:\documents and settings\owner.home-5nr1rmgi5l\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [IgfxTray] c:\winnt\system32\igfxtray.exe
mRun: [dla] c:\winnt\system32\dla\tfswctrl.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [TaskTray]
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [<NO NAME>]
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
IE: &Search
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: mswsock.dll
Trusted Zone: intuit.com\ttlc
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - hxxp://w4s2.work4sure.com/c/ge/w4sgeen9.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxps://lowes.2020.net/Core/Player/2020PlayerAX_Win32.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236304913634
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236305120181
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
DPF: {775879E2-7309-4619-BB02-AADE41F4B690} - hxxp://webgames.d.tmsrv.com/c=51ebb4632190d3421704fb9e9c639c1a/aff=t_05en_wg/p/release/playfirst/wg_dreamchronicles/dreamchronicles/dreamweb.1.0.0.9.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1236551893483&h=1e9625ff85283ce92e2e831cbc104545/&filename=jinstall-6u12-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FC6DEB69-355C-480C-9408-580DCD42E9C3} : DhcpNameServer = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: c:\progra~1\google\go333c~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\winnt\system32\drivers\AVGIDSEH.sys [2010-9-13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\winnt\system32\drivers\avgrkx86.sys [2010-9-7 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\winnt\system32\drivers\avgldx86.sys [2010-9-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\winnt\system32\drivers\avgmfx86.sys [2010-9-7 34896]
R1 Avgtdix;AVG TDI Driver;c:\winnt\system32\drivers\avgtdix.sys [2010-9-7 297168]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-29 366640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-29 24652]
R3 AVGIDSDriver;AVGIDSDriver;c:\winnt\system32\drivers\AVGIDSDriver.sys [2010-8-19 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\winnt\system32\drivers\AVGIDSFilter.sys [2010-8-19 24144]
R3 AVGIDSShim;AVGIDSShim;c:\winnt\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
R3 MBAMProtector;MBAMProtector;c:\winnt\system32\drivers\mbam.sys [2011-8-29 22712]
S0 nielprt;Nielsen Patch Service;c:\winnt\system32\drivers\nielprt.sys --> c:\winnt\system32\drivers\nielprt.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
S2 gupdate1c9bddd41123d4a;Google Update Service (gupdate1c9bddd41123d4a);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-3-13 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-4-15 133104]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\winnt\system32\drivers\mbamswissarmy.sys [2011-8-29 41272]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\winnt\system32\drivers\nx6000.sys [2010-9-30 30576]
S3 NielGfx;Nielsen USB GFX;c:\winnt\system32\drivers\nielgfx.sys --> c:\winnt\system32\drivers\nielgfx.sys [?]
.
=============== Created Last 30 ================
.
2011-08-29 17:34:07 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\Malwarebytes
2011-08-29 17:33:59 41272 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-08-29 17:33:58 -------- d-----w- c:\documents and settings\all users.winnt\application data\Malwarebytes
2011-08-29 17:33:55 22712 ----a-w- c:\winnt\system32\drivers\mbam.sys
2011-08-29 17:33:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-25 13:29:35 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\.frostwire5
2011-08-25 13:27:37 -------- d-----w- c:\program files\FrostWire 5
2011-08-10 22:00:43 139656 -c----w- c:\winnt\system32\dllcache\rdpwd.sys
2011-08-10 21:59:48 10496 -c----w- c:\winnt\system32\dllcache\ndistapi.sys
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\owner.home-5nr1rmgi5l\application data\BigFish
2011-08-09 20:11:48 -------- d-----w- c:\documents and settings\all users.winnt\application data\BigFish
2011-08-09 20:09:39 -------- d-----w- c:\program files\Jewel Quest Mysteries - The Seventh Gate
.
==================== Find3M ====================
.
2011-08-25 12:53:18 404640 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29:31 456320 ----a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-07-08 14:02:00 10496 ----a-w- c:\winnt\system32\drivers\ndistapi.sys
2011-06-24 14:10:36 139656 ----a-w- c:\winnt\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\winnt\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\winnt\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ----a-w- c:\winnt\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\winnt\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\winnt\system32\winsrv.dll
2009-03-27 13:00:22 13440584 -c--a-w- c:\program files\Install_AIM.exe
.
============= FINISH: 16:20:17.92 ===============
slowride71
Posts: 24 +0
virus
2011/08/31 16:25:09.0718 1596 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/31 16:25:10.0031 1596 ================================================================================
2011/08/31 16:25:10.0031 1596 SystemInfo:
2011/08/31 16:25:10.0031 1596
2011/08/31 16:25:10.0046 1596 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/31 16:25:10.0046 1596 Product type: Workstation
2011/08/31 16:25:10.0046 1596 ComputerName: BLACKIE
2011/08/31 16:25:10.0046 1596 UserName: Owner
2011/08/31 16:25:10.0046 1596 Windows directory: C:\WINNT
2011/08/31 16:25:10.0046 1596 System windows directory: C:\WINNT
2011/08/31 16:25:10.0046 1596 Processor architecture: Intel x86
2011/08/31 16:25:10.0046 1596 Number of processors: 1
2011/08/31 16:25:10.0046 1596 Page size: 0x1000
2011/08/31 16:25:10.0046 1596 Boot type: Normal boot
2011/08/31 16:25:10.0046 1596 ================================================================================
2011/08/31 16:25:14.0375 1596 Initialize success
2011/08/31 16:26:11.0078 3500 ================================================================================
2011/08/31 16:26:11.0078 3500 Scan started
2011/08/31 16:26:11.0078 3500 Mode: Manual;
2011/08/31 16:26:11.0078 3500 ================================================================================
2011/08/31 16:26:15.0171 3500 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINNT\system32\DRIVERS\ACPI.sys
2011/08/31 16:26:15.0515 3500 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINNT\system32\drivers\ACPIEC.sys
2011/08/31 16:26:16.0093 3500 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINNT\system32\drivers\aeaudio.sys
2011/08/31 16:26:16.0500 3500 aec (8bed39e3c35d6a489438b8141717a557) C:\WINNT\system32\drivers\aec.sys
2011/08/31 16:26:17.0046 3500 AFD (355556d9e580915118cd7ef736653a89) C:\WINNT\System32\drivers\afd.sys
2011/08/31 16:26:19.0000 3500 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINNT\system32\DRIVERS\asyncmac.sys
2011/08/31 16:26:19.0421 3500 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINNT\system32\DRIVERS\atapi.sys
2011/08/31 16:26:19.0906 3500 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINNT\system32\DRIVERS\atmarpc.sys
2011/08/31 16:26:20.0171 3500 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINNT\system32\DRIVERS\audstub.sys
2011/08/31 16:26:20.0546 3500 AVGIDSDriver (c403e7f715bb0a851a9dfae16ec4ae42) C:\WINNT\system32\DRIVERS\AVGIDSDriver.Sys
2011/08/31 16:26:20.0921 3500 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINNT\system32\DRIVERS\AVGIDSEH.Sys
2011/08/31 16:26:21.0281 3500 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINNT\system32\DRIVERS\AVGIDSFilter.Sys
2011/08/31 16:26:21.0546 3500 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINNT\system32\DRIVERS\AVGIDSShim.Sys
2011/08/31 16:26:21.0968 3500 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINNT\system32\DRIVERS\avgldx86.sys
2011/08/31 16:26:22.0343 3500 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINNT\system32\DRIVERS\avgmfx86.sys
2011/08/31 16:26:22.0671 3500 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINNT\system32\DRIVERS\avgrkx86.sys
2011/08/31 16:26:23.0015 3500 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINNT\system32\DRIVERS\avgtdix.sys
2011/08/31 16:26:23.0390 3500 bcm4sbxp (b60f57b4d9cdbc663cc03eb8af7ec34e) C:\WINNT\system32\DRIVERS\bcm4sbxp.sys
2011/08/31 16:26:24.0015 3500 BCMModem (41347688046d49cde0f6d138a534f73d) C:\WINNT\system32\DRIVERS\BCMSM.sys
2011/08/31 16:26:24.0640 3500 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINNT\system32\drivers\Beep.sys
2011/08/31 16:26:25.0046 3500 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINNT\system32\drivers\cbidf2k.sys
2011/08/31 16:26:25.0375 3500 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINNT\system32\DRIVERS\CCDECODE.sys
2011/08/31 16:26:26.0015 3500 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINNT\system32\drivers\Cdaudio.sys
2011/08/31 16:26:26.0437 3500 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINNT\system32\drivers\Cdfs.sys
2011/08/31 16:26:26.0718 3500 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINNT\system32\DRIVERS\cdrom.sys
2011/08/31 16:26:28.0312 3500 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINNT\system32\DRIVERS\disk.sys
2011/08/31 16:26:28.0843 3500 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINNT\system32\drivers\dmboot.sys
2011/08/31 16:26:29.0468 3500 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINNT\system32\drivers\dmio.sys
2011/08/31 16:26:29.0859 3500 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINNT\system32\drivers\dmload.sys
2011/08/31 16:26:30.0265 3500 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINNT\system32\drivers\DMusic.sys
2011/08/31 16:26:30.0703 3500 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINNT\system32\drivers\drmkaud.sys
2011/08/31 16:26:31.0000 3500 drvmcdb (7f056a52bcba3102d2d37a4a2646c807) C:\WINNT\system32\drivers\drvmcdb.sys
2011/08/31 16:26:31.0468 3500 drvnddm (d3c1e501ed42e77574b3095309dd4075) C:\WINNT\system32\drivers\drvnddm.sys
2011/08/31 16:26:31.0781 3500 Fastfat (38d332a6d56af32635675f132548343e) C:\WINNT\system32\drivers\Fastfat.sys
2011/08/31 16:26:32.0062 3500 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINNT\system32\DRIVERS\fdc.sys
2011/08/31 16:26:32.0375 3500 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINNT\system32\drivers\Fips.sys
2011/08/31 16:26:32.0812 3500 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINNT\system32\DRIVERS\flpydisk.sys
2011/08/31 16:26:33.0218 3500 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINNT\system32\drivers\fltmgr.sys
2011/08/31 16:26:33.0578 3500 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINNT\system32\drivers\Fs_Rec.sys
2011/08/31 16:26:33.0921 3500 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINNT\system32\DRIVERS\ftdisk.sys
2011/08/31 16:26:34.0281 3500 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINNT\system32\DRIVERS\GEARAspiWDM.sys
2011/08/31 16:26:34.0609 3500 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINNT\system32\DRIVERS\msgpc.sys
2011/08/31 16:26:35.0031 3500 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINNT\system32\DRIVERS\hidusb.sys
2011/08/31 16:26:35.0734 3500 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINNT\system32\Drivers\HTTP.sys
2011/08/31 16:26:36.0734 3500 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINNT\system32\DRIVERS\i8042prt.sys
2011/08/31 16:26:37.0296 3500 ialm (44b7d5a4f2bd9fe21aea0bb0bace38c4) C:\WINNT\system32\DRIVERS\ialmnt5.sys
2011/08/31 16:26:38.0031 3500 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINNT\system32\DRIVERS\imapi.sys
2011/08/31 16:26:38.0578 3500 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINNT\system32\DRIVERS\intelide.sys
2011/08/31 16:26:38.0984 3500 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINNT\system32\DRIVERS\intelppm.sys
2011/08/31 16:26:39.0312 3500 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINNT\system32\drivers\ip6fw.sys
2011/08/31 16:26:39.0640 3500 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINNT\system32\DRIVERS\ipfltdrv.sys
2011/08/31 16:26:39.0984 3500 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINNT\system32\DRIVERS\ipinip.sys
2011/08/31 16:26:40.0359 3500 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINNT\system32\DRIVERS\ipnat.sys
2011/08/31 16:26:40.0687 3500 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINNT\system32\DRIVERS\ipsec.sys
2011/08/31 16:26:41.0046 3500 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINNT\system32\DRIVERS\irenum.sys
2011/08/31 16:26:41.0375 3500 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINNT\system32\DRIVERS\isapnp.sys
2011/08/31 16:26:41.0718 3500 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINNT\system32\DRIVERS\kbdclass.sys
2011/08/31 16:26:42.0093 3500 kmixer (692bcf44383d056aed41b045a323d378) C:\WINNT\system32\drivers\kmixer.sys
2011/08/31 16:26:42.0453 3500 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINNT\system32\drivers\KSecDD.sys
2011/08/31 16:26:43.0031 3500 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\WINNT\system32\drivers\mbam.sys
2011/08/31 16:26:43.0359 3500 MBAMSwissArmy (b18225739ed9caa83ba2df966e9f43e8) C:\WINNT\system32\drivers\mbamswissarmy.sys
2011/08/31 16:26:43.0718 3500 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINNT\system32\drivers\mnmdd.sys
2011/08/31 16:26:44.0171 3500 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINNT\system32\drivers\Modem.sys
2011/08/31 16:26:44.0421 3500 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINNT\system32\drivers\MODEMCSA.sys
2011/08/31 16:26:44.0781 3500 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINNT\system32\DRIVERS\mouclass.sys
2011/08/31 16:26:45.0093 3500 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINNT\system32\DRIVERS\mouhid.sys
2011/08/31 16:26:45.0390 3500 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINNT\system32\drivers\MountMgr.sys
2011/08/31 16:26:45.0953 3500 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINNT\system32\DRIVERS\mrxdav.sys
2011/08/31 16:26:46.0390 3500 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINNT\system32\DRIVERS\mrxsmb.sys
2011/08/31 16:26:46.0828 3500 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINNT\system32\drivers\Msfs.sys
2011/08/31 16:26:47.0187 3500 MSHUSBVideo (5119ffc2a6b51089cdb0efdc75808c97) C:\WINNT\system32\Drivers\nx6000.sys
2011/08/31 16:26:47.0453 3500 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINNT\system32\drivers\MSKSSRV.sys
2011/08/31 16:26:47.0765 3500 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINNT\system32\drivers\MSPCLOCK.sys
2011/08/31 16:26:48.0046 3500 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINNT\system32\drivers\MSPQM.sys
2011/08/31 16:26:48.0265 3500 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINNT\system32\DRIVERS\mssmbios.sys
2011/08/31 16:26:48.0515 3500 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINNT\system32\drivers\MSTEE.sys
2011/08/31 16:26:48.0859 3500 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINNT\system32\drivers\Mup.sys
2011/08/31 16:26:49.0250 3500 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINNT\system32\DRIVERS\NABTSFEC.sys
2011/08/31 16:26:49.0765 3500 NDIS (1df7f42665c94b825322fae71721130d) C:\WINNT\system32\drivers\NDIS.sys
2011/08/31 16:26:50.0125 3500 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINNT\system32\DRIVERS\NdisIP.sys
2011/08/31 16:26:50.0500 3500 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINNT\system32\DRIVERS\ndistapi.sys
2011/08/31 16:26:50.0906 3500 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINNT\system32\DRIVERS\ndisuio.sys
2011/08/31 16:26:51.0218 3500 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINNT\system32\DRIVERS\ndiswan.sys
2011/08/31 16:26:51.0578 3500 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINNT\system32\drivers\NDProxy.sys
2011/08/31 16:26:51.0843 3500 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINNT\system32\DRIVERS\netbios.sys
2011/08/31 16:26:52.0140 3500 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINNT\system32\DRIVERS\netbt.sys
2011/08/31 16:26:52.0906 3500 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINNT\system32\drivers\Npfs.sys
2011/08/31 16:26:53.0468 3500 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINNT\system32\drivers\Ntfs.sys
2011/08/31 16:26:53.0953 3500 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINNT\system32\drivers\Null.sys
2011/08/31 16:26:54.0390 3500 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINNT\system32\DRIVERS\nwlnkflt.sys
2011/08/31 16:26:54.0828 3500 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINNT\system32\DRIVERS\nwlnkfwd.sys
2011/08/31 16:26:55.0359 3500 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINNT\SYSTEM32\DRIVERS\OMCI.SYS
2011/08/31 16:26:56.0187 3500 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINNT\system32\DRIVERS\parport.sys
2011/08/31 16:26:56.0640 3500 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINNT\system32\drivers\PartMgr.sys
2011/08/31 16:26:57.0046 3500 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINNT\system32\drivers\ParVdm.sys
2011/08/31 16:26:57.0296 3500 PCI (a219903ccf74233761d92bef471a07b1) C:\WINNT\system32\DRIVERS\pci.sys
2011/08/31 16:26:57.0781 3500 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINNT\system32\DRIVERS\pciide.sys
2011/08/31 16:26:58.0046 3500 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINNT\system32\drivers\Pcmcia.sys
2011/08/31 16:27:00.0515 3500 PID_PEPI (dd184d9adfe2a8a21741dbdfe9e22f5c) C:\WINNT\system32\DRIVERS\LV302V32.SYS
2011/08/31 16:27:01.0875 3500 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINNT\system32\DRIVERS\raspptp.sys
2011/08/31 16:27:02.0390 3500 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINNT\system32\DRIVERS\processr.sys
2011/08/31 16:27:02.0703 3500 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINNT\system32\DRIVERS\psched.sys
2011/08/31 16:27:03.0078 3500 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINNT\system32\DRIVERS\ptilink.sys
2011/08/31 16:27:03.0671 3500 PxHelp20 (7e1eacdecba39e0b2a35306426f0decc) C:\WINNT\system32\DRIVERS\PxHelp20.sys
2011/08/31 16:27:05.0203 3500 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINNT\system32\DRIVERS\rasacd.sys
2011/08/31 16:27:05.0562 3500 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINNT\system32\DRIVERS\rasl2tp.sys
2011/08/31 16:27:05.0812 3500 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINNT\system32\DRIVERS\raspppoe.sys
2011/08/31 16:27:06.0265 3500 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINNT\system32\DRIVERS\raspti.sys
2011/08/31 16:27:06.0609 3500 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINNT\system32\DRIVERS\rdbss.sys
2011/08/31 16:27:06.0937 3500 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINNT\system32\DRIVERS\RDPCDD.sys
2011/08/31 16:27:07.0328 3500 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINNT\system32\drivers\RDPWD.sys
2011/08/31 16:27:07.0718 3500 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINNT\system32\DRIVERS\redbook.sys
2011/08/31 16:27:08.0125 3500 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINNT\system32\DRIVERS\secdrv.sys
2011/08/31 16:27:08.0375 3500 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINNT\system32\DRIVERS\serenum.sys
2011/08/31 16:27:08.0703 3500 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINNT\system32\DRIVERS\serial.sys
2011/08/31 16:27:09.0046 3500 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINNT\system32\drivers\Sfloppy.sys
2011/08/31 16:27:09.0593 3500 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINNT\system32\DRIVERS\SLIP.sys
2011/08/31 16:27:10.0140 3500 smwdm (31fd0707c7dbe715234f2823b27214fe) C:\WINNT\system32\drivers\smwdm.sys
2011/08/31 16:27:10.0828 3500 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINNT\system32\drivers\splitter.sys
2011/08/31 16:27:11.0093 3500 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINNT\system32\DRIVERS\sr.sys
2011/08/31 16:27:11.0531 3500 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINNT\system32\DRIVERS\srv.sys
2011/08/31 16:27:11.0890 3500 sscdbhk5 (328e8bb94ec58480f60458fb4b8437a7) C:\WINNT\system32\drivers\sscdbhk5.sys
2011/08/31 16:27:12.0359 3500 ssrtln (7ec8b427cee5c0cdac066320b93f1355) C:\WINNT\system32\drivers\ssrtln.sys
2011/08/31 16:27:12.0812 3500 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINNT\system32\DRIVERS\StreamIP.sys
2011/08/31 16:27:13.0187 3500 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINNT\system32\DRIVERS\swenum.sys
2011/08/31 16:27:13.0546 3500 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINNT\system32\drivers\swmidi.sys
2011/08/31 16:27:14.0578 3500 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINNT\system32\drivers\sysaudio.sys
2011/08/31 16:27:14.0984 3500 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINNT\system32\DRIVERS\tcpip.sys
2011/08/31 16:27:15.0562 3500 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINNT\system32\drivers\TDPIPE.sys
2011/08/31 16:27:15.0921 3500 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINNT\system32\drivers\TDTCP.sys
2011/08/31 16:27:16.0265 3500 TermDD (88155247177638048422893737429d9e) C:\WINNT\system32\DRIVERS\termdd.sys
2011/08/31 16:27:16.0625 3500 tfsnboio (c229bf90443be8d3bd2b65d7f3ac0f35) C:\WINNT\system32\dla\tfsnboio.sys
2011/08/31 16:27:16.0828 3500 tfsncofs (79ee9fcd7728e54ab8fbc30962f0416f) C:\WINNT\system32\dla\tfsncofs.sys
2011/08/31 16:27:17.0031 3500 tfsndrct (9efb37e7de17d783a059b653f7e8afad) C:\WINNT\system32\dla\tfsndrct.sys
2011/08/31 16:27:17.0250 3500 tfsndres (130254995ebedcb34d62e8d78ec9dbd0) C:\WINNT\system32\dla\tfsndres.sys
2011/08/31 16:27:17.0468 3500 tfsnifs (9b40e1e4aeed849812a2e43a388a7e77) C:\WINNT\system32\dla\tfsnifs.sys
2011/08/31 16:27:17.0734 3500 tfsnopio (818047ad850b312705aa17ca96b9427d) C:\WINNT\system32\dla\tfsnopio.sys
2011/08/31 16:27:17.0937 3500 tfsnpool (4603e813bcc6dd465cd8d2afd37fa90d) C:\WINNT\system32\dla\tfsnpool.sys
2011/08/31 16:27:18.0187 3500 tfsnudf (6fc2cd904a9a55acfdfc780a611a75ed) C:\WINNT\system32\dla\tfsnudf.sys
2011/08/31 16:27:18.0437 3500 tfsnudfa (d4afa4d00f8db3fd1c15b3fe49c3a96c) C:\WINNT\system32\dla\tfsnudfa.sys
2011/08/31 16:27:19.0171 3500 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINNT\system32\drivers\Udfs.sys
2011/08/31 16:27:19.0718 3500 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINNT\system32\DRIVERS\update.sys
2011/08/31 16:27:20.0203 3500 usbaudio (e919708db44ed8543a7c017953148330) C:\WINNT\system32\drivers\usbaudio.sys
2011/08/31 16:27:20.0609 3500 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINNT\system32\DRIVERS\usbccgp.sys
2011/08/31 16:27:20.0906 3500 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINNT\system32\DRIVERS\usbehci.sys
2011/08/31 16:27:21.0328 3500 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINNT\system32\DRIVERS\usbhub.sys
2011/08/31 16:27:21.0671 3500 usbprint (a717c8721046828520c9edf31288fc00) C:\WINNT\system32\DRIVERS\usbprint.sys
2011/08/31 16:27:22.0140 3500 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINNT\system32\DRIVERS\usbscan.sys
2011/08/31 16:27:22.0453 3500 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINNT\system32\DRIVERS\USBSTOR.SYS
2011/08/31 16:27:22.0781 3500 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINNT\system32\DRIVERS\usbuhci.sys
2011/08/31 16:27:23.0203 3500 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINNT\system32\Drivers\usbvideo.sys
2011/08/31 16:27:23.0515 3500 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINNT\System32\drivers\vga.sys
2011/08/31 16:27:24.0109 3500 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINNT\system32\drivers\VolSnap.sys
2011/08/31 16:27:24.0531 3500 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINNT\system32\DRIVERS\wanarp.sys
2011/08/31 16:27:25.0000 3500 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINNT\system32\Drivers\wdf01000.sys
2011/08/31 16:27:25.0703 3500 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINNT\system32\drivers\wdmaud.sys
2011/08/31 16:27:26.0109 3500 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINNT\system32\DRIVERS\WSTCODEC.SYS
2011/08/31 16:27:26.0500 3500 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINNT\system32\DRIVERS\WudfPf.sys
2011/08/31 16:27:26.0906 3500 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINNT\system32\DRIVERS\wudfrd.sys
2011/08/31 16:27:27.0093 3500 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/08/31 16:27:27.0343 3500 Boot (0x1200) (bfda6547d4f60e282496defcfa5a50a6) \Device\Harddisk0\DR0\Partition0
2011/08/31 16:27:27.0343 3500 ================================================================================
2011/08/31 16:27:27.0343 3500 Scan finished
2011/08/31 16:27:27.0343 3500 ================================================================================
2011/08/31 16:27:27.0375 1096 Detected object count: 0
2011/08/31 16:27:27.0375 1096 Actual detected object count: 0
2011/08/31 16:29:52.0734 3864 Deinitialize success
2011/08/31 16:25:09.0718 1596 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/31 16:25:10.0031 1596 ================================================================================
2011/08/31 16:25:10.0031 1596 SystemInfo:
2011/08/31 16:25:10.0031 1596
2011/08/31 16:25:10.0046 1596 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/31 16:25:10.0046 1596 Product type: Workstation
2011/08/31 16:25:10.0046 1596 ComputerName: BLACKIE
2011/08/31 16:25:10.0046 1596 UserName: Owner
2011/08/31 16:25:10.0046 1596 Windows directory: C:\WINNT
2011/08/31 16:25:10.0046 1596 System windows directory: C:\WINNT
2011/08/31 16:25:10.0046 1596 Processor architecture: Intel x86
2011/08/31 16:25:10.0046 1596 Number of processors: 1
2011/08/31 16:25:10.0046 1596 Page size: 0x1000
2011/08/31 16:25:10.0046 1596 Boot type: Normal boot
2011/08/31 16:25:10.0046 1596 ================================================================================
2011/08/31 16:25:14.0375 1596 Initialize success
2011/08/31 16:26:11.0078 3500 ================================================================================
2011/08/31 16:26:11.0078 3500 Scan started
2011/08/31 16:26:11.0078 3500 Mode: Manual;
2011/08/31 16:26:11.0078 3500 ================================================================================
2011/08/31 16:26:15.0171 3500 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINNT\system32\DRIVERS\ACPI.sys
2011/08/31 16:26:15.0515 3500 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINNT\system32\drivers\ACPIEC.sys
2011/08/31 16:26:16.0093 3500 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINNT\system32\drivers\aeaudio.sys
2011/08/31 16:26:16.0500 3500 aec (8bed39e3c35d6a489438b8141717a557) C:\WINNT\system32\drivers\aec.sys
2011/08/31 16:26:17.0046 3500 AFD (355556d9e580915118cd7ef736653a89) C:\WINNT\System32\drivers\afd.sys
2011/08/31 16:26:19.0000 3500 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINNT\system32\DRIVERS\asyncmac.sys
2011/08/31 16:26:19.0421 3500 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINNT\system32\DRIVERS\atapi.sys
2011/08/31 16:26:19.0906 3500 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINNT\system32\DRIVERS\atmarpc.sys
2011/08/31 16:26:20.0171 3500 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINNT\system32\DRIVERS\audstub.sys
2011/08/31 16:26:20.0546 3500 AVGIDSDriver (c403e7f715bb0a851a9dfae16ec4ae42) C:\WINNT\system32\DRIVERS\AVGIDSDriver.Sys
2011/08/31 16:26:20.0921 3500 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINNT\system32\DRIVERS\AVGIDSEH.Sys
2011/08/31 16:26:21.0281 3500 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINNT\system32\DRIVERS\AVGIDSFilter.Sys
2011/08/31 16:26:21.0546 3500 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINNT\system32\DRIVERS\AVGIDSShim.Sys
2011/08/31 16:26:21.0968 3500 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINNT\system32\DRIVERS\avgldx86.sys
2011/08/31 16:26:22.0343 3500 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINNT\system32\DRIVERS\avgmfx86.sys
2011/08/31 16:26:22.0671 3500 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINNT\system32\DRIVERS\avgrkx86.sys
2011/08/31 16:26:23.0015 3500 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINNT\system32\DRIVERS\avgtdix.sys
2011/08/31 16:26:23.0390 3500 bcm4sbxp (b60f57b4d9cdbc663cc03eb8af7ec34e) C:\WINNT\system32\DRIVERS\bcm4sbxp.sys
2011/08/31 16:26:24.0015 3500 BCMModem (41347688046d49cde0f6d138a534f73d) C:\WINNT\system32\DRIVERS\BCMSM.sys
2011/08/31 16:26:24.0640 3500 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINNT\system32\drivers\Beep.sys
2011/08/31 16:26:25.0046 3500 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINNT\system32\drivers\cbidf2k.sys
2011/08/31 16:26:25.0375 3500 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINNT\system32\DRIVERS\CCDECODE.sys
2011/08/31 16:26:26.0015 3500 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINNT\system32\drivers\Cdaudio.sys
2011/08/31 16:26:26.0437 3500 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINNT\system32\drivers\Cdfs.sys
2011/08/31 16:26:26.0718 3500 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINNT\system32\DRIVERS\cdrom.sys
2011/08/31 16:26:28.0312 3500 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINNT\system32\DRIVERS\disk.sys
2011/08/31 16:26:28.0843 3500 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINNT\system32\drivers\dmboot.sys
2011/08/31 16:26:29.0468 3500 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINNT\system32\drivers\dmio.sys
2011/08/31 16:26:29.0859 3500 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINNT\system32\drivers\dmload.sys
2011/08/31 16:26:30.0265 3500 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINNT\system32\drivers\DMusic.sys
2011/08/31 16:26:30.0703 3500 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINNT\system32\drivers\drmkaud.sys
2011/08/31 16:26:31.0000 3500 drvmcdb (7f056a52bcba3102d2d37a4a2646c807) C:\WINNT\system32\drivers\drvmcdb.sys
2011/08/31 16:26:31.0468 3500 drvnddm (d3c1e501ed42e77574b3095309dd4075) C:\WINNT\system32\drivers\drvnddm.sys
2011/08/31 16:26:31.0781 3500 Fastfat (38d332a6d56af32635675f132548343e) C:\WINNT\system32\drivers\Fastfat.sys
2011/08/31 16:26:32.0062 3500 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINNT\system32\DRIVERS\fdc.sys
2011/08/31 16:26:32.0375 3500 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINNT\system32\drivers\Fips.sys
2011/08/31 16:26:32.0812 3500 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINNT\system32\DRIVERS\flpydisk.sys
2011/08/31 16:26:33.0218 3500 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINNT\system32\drivers\fltmgr.sys
2011/08/31 16:26:33.0578 3500 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINNT\system32\drivers\Fs_Rec.sys
2011/08/31 16:26:33.0921 3500 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINNT\system32\DRIVERS\ftdisk.sys
2011/08/31 16:26:34.0281 3500 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINNT\system32\DRIVERS\GEARAspiWDM.sys
2011/08/31 16:26:34.0609 3500 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINNT\system32\DRIVERS\msgpc.sys
2011/08/31 16:26:35.0031 3500 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINNT\system32\DRIVERS\hidusb.sys
2011/08/31 16:26:35.0734 3500 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINNT\system32\Drivers\HTTP.sys
2011/08/31 16:26:36.0734 3500 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINNT\system32\DRIVERS\i8042prt.sys
2011/08/31 16:26:37.0296 3500 ialm (44b7d5a4f2bd9fe21aea0bb0bace38c4) C:\WINNT\system32\DRIVERS\ialmnt5.sys
2011/08/31 16:26:38.0031 3500 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINNT\system32\DRIVERS\imapi.sys
2011/08/31 16:26:38.0578 3500 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINNT\system32\DRIVERS\intelide.sys
2011/08/31 16:26:38.0984 3500 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINNT\system32\DRIVERS\intelppm.sys
2011/08/31 16:26:39.0312 3500 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINNT\system32\drivers\ip6fw.sys
2011/08/31 16:26:39.0640 3500 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINNT\system32\DRIVERS\ipfltdrv.sys
2011/08/31 16:26:39.0984 3500 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINNT\system32\DRIVERS\ipinip.sys
2011/08/31 16:26:40.0359 3500 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINNT\system32\DRIVERS\ipnat.sys
2011/08/31 16:26:40.0687 3500 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINNT\system32\DRIVERS\ipsec.sys
2011/08/31 16:26:41.0046 3500 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINNT\system32\DRIVERS\irenum.sys
2011/08/31 16:26:41.0375 3500 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINNT\system32\DRIVERS\isapnp.sys
2011/08/31 16:26:41.0718 3500 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINNT\system32\DRIVERS\kbdclass.sys
2011/08/31 16:26:42.0093 3500 kmixer (692bcf44383d056aed41b045a323d378) C:\WINNT\system32\drivers\kmixer.sys
2011/08/31 16:26:42.0453 3500 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINNT\system32\drivers\KSecDD.sys
2011/08/31 16:26:43.0031 3500 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\WINNT\system32\drivers\mbam.sys
2011/08/31 16:26:43.0359 3500 MBAMSwissArmy (b18225739ed9caa83ba2df966e9f43e8) C:\WINNT\system32\drivers\mbamswissarmy.sys
2011/08/31 16:26:43.0718 3500 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINNT\system32\drivers\mnmdd.sys
2011/08/31 16:26:44.0171 3500 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINNT\system32\drivers\Modem.sys
2011/08/31 16:26:44.0421 3500 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINNT\system32\drivers\MODEMCSA.sys
2011/08/31 16:26:44.0781 3500 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINNT\system32\DRIVERS\mouclass.sys
2011/08/31 16:26:45.0093 3500 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINNT\system32\DRIVERS\mouhid.sys
2011/08/31 16:26:45.0390 3500 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINNT\system32\drivers\MountMgr.sys
2011/08/31 16:26:45.0953 3500 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINNT\system32\DRIVERS\mrxdav.sys
2011/08/31 16:26:46.0390 3500 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINNT\system32\DRIVERS\mrxsmb.sys
2011/08/31 16:26:46.0828 3500 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINNT\system32\drivers\Msfs.sys
2011/08/31 16:26:47.0187 3500 MSHUSBVideo (5119ffc2a6b51089cdb0efdc75808c97) C:\WINNT\system32\Drivers\nx6000.sys
2011/08/31 16:26:47.0453 3500 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINNT\system32\drivers\MSKSSRV.sys
2011/08/31 16:26:47.0765 3500 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINNT\system32\drivers\MSPCLOCK.sys
2011/08/31 16:26:48.0046 3500 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINNT\system32\drivers\MSPQM.sys
2011/08/31 16:26:48.0265 3500 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINNT\system32\DRIVERS\mssmbios.sys
2011/08/31 16:26:48.0515 3500 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINNT\system32\drivers\MSTEE.sys
2011/08/31 16:26:48.0859 3500 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINNT\system32\drivers\Mup.sys
2011/08/31 16:26:49.0250 3500 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINNT\system32\DRIVERS\NABTSFEC.sys
2011/08/31 16:26:49.0765 3500 NDIS (1df7f42665c94b825322fae71721130d) C:\WINNT\system32\drivers\NDIS.sys
2011/08/31 16:26:50.0125 3500 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINNT\system32\DRIVERS\NdisIP.sys
2011/08/31 16:26:50.0500 3500 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINNT\system32\DRIVERS\ndistapi.sys
2011/08/31 16:26:50.0906 3500 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINNT\system32\DRIVERS\ndisuio.sys
2011/08/31 16:26:51.0218 3500 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINNT\system32\DRIVERS\ndiswan.sys
2011/08/31 16:26:51.0578 3500 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINNT\system32\drivers\NDProxy.sys
2011/08/31 16:26:51.0843 3500 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINNT\system32\DRIVERS\netbios.sys
2011/08/31 16:26:52.0140 3500 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINNT\system32\DRIVERS\netbt.sys
2011/08/31 16:26:52.0906 3500 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINNT\system32\drivers\Npfs.sys
2011/08/31 16:26:53.0468 3500 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINNT\system32\drivers\Ntfs.sys
2011/08/31 16:26:53.0953 3500 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINNT\system32\drivers\Null.sys
2011/08/31 16:26:54.0390 3500 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINNT\system32\DRIVERS\nwlnkflt.sys
2011/08/31 16:26:54.0828 3500 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINNT\system32\DRIVERS\nwlnkfwd.sys
2011/08/31 16:26:55.0359 3500 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINNT\SYSTEM32\DRIVERS\OMCI.SYS
2011/08/31 16:26:56.0187 3500 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINNT\system32\DRIVERS\parport.sys
2011/08/31 16:26:56.0640 3500 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINNT\system32\drivers\PartMgr.sys
2011/08/31 16:26:57.0046 3500 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINNT\system32\drivers\ParVdm.sys
2011/08/31 16:26:57.0296 3500 PCI (a219903ccf74233761d92bef471a07b1) C:\WINNT\system32\DRIVERS\pci.sys
2011/08/31 16:26:57.0781 3500 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINNT\system32\DRIVERS\pciide.sys
2011/08/31 16:26:58.0046 3500 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINNT\system32\drivers\Pcmcia.sys
2011/08/31 16:27:00.0515 3500 PID_PEPI (dd184d9adfe2a8a21741dbdfe9e22f5c) C:\WINNT\system32\DRIVERS\LV302V32.SYS
2011/08/31 16:27:01.0875 3500 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINNT\system32\DRIVERS\raspptp.sys
2011/08/31 16:27:02.0390 3500 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINNT\system32\DRIVERS\processr.sys
2011/08/31 16:27:02.0703 3500 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINNT\system32\DRIVERS\psched.sys
2011/08/31 16:27:03.0078 3500 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINNT\system32\DRIVERS\ptilink.sys
2011/08/31 16:27:03.0671 3500 PxHelp20 (7e1eacdecba39e0b2a35306426f0decc) C:\WINNT\system32\DRIVERS\PxHelp20.sys
2011/08/31 16:27:05.0203 3500 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINNT\system32\DRIVERS\rasacd.sys
2011/08/31 16:27:05.0562 3500 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINNT\system32\DRIVERS\rasl2tp.sys
2011/08/31 16:27:05.0812 3500 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINNT\system32\DRIVERS\raspppoe.sys
2011/08/31 16:27:06.0265 3500 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINNT\system32\DRIVERS\raspti.sys
2011/08/31 16:27:06.0609 3500 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINNT\system32\DRIVERS\rdbss.sys
2011/08/31 16:27:06.0937 3500 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINNT\system32\DRIVERS\RDPCDD.sys
2011/08/31 16:27:07.0328 3500 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINNT\system32\drivers\RDPWD.sys
2011/08/31 16:27:07.0718 3500 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINNT\system32\DRIVERS\redbook.sys
2011/08/31 16:27:08.0125 3500 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINNT\system32\DRIVERS\secdrv.sys
2011/08/31 16:27:08.0375 3500 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINNT\system32\DRIVERS\serenum.sys
2011/08/31 16:27:08.0703 3500 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINNT\system32\DRIVERS\serial.sys
2011/08/31 16:27:09.0046 3500 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINNT\system32\drivers\Sfloppy.sys
2011/08/31 16:27:09.0593 3500 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINNT\system32\DRIVERS\SLIP.sys
2011/08/31 16:27:10.0140 3500 smwdm (31fd0707c7dbe715234f2823b27214fe) C:\WINNT\system32\drivers\smwdm.sys
2011/08/31 16:27:10.0828 3500 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINNT\system32\drivers\splitter.sys
2011/08/31 16:27:11.0093 3500 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINNT\system32\DRIVERS\sr.sys
2011/08/31 16:27:11.0531 3500 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINNT\system32\DRIVERS\srv.sys
2011/08/31 16:27:11.0890 3500 sscdbhk5 (328e8bb94ec58480f60458fb4b8437a7) C:\WINNT\system32\drivers\sscdbhk5.sys
2011/08/31 16:27:12.0359 3500 ssrtln (7ec8b427cee5c0cdac066320b93f1355) C:\WINNT\system32\drivers\ssrtln.sys
2011/08/31 16:27:12.0812 3500 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINNT\system32\DRIVERS\StreamIP.sys
2011/08/31 16:27:13.0187 3500 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINNT\system32\DRIVERS\swenum.sys
2011/08/31 16:27:13.0546 3500 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINNT\system32\drivers\swmidi.sys
2011/08/31 16:27:14.0578 3500 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINNT\system32\drivers\sysaudio.sys
2011/08/31 16:27:14.0984 3500 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINNT\system32\DRIVERS\tcpip.sys
2011/08/31 16:27:15.0562 3500 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINNT\system32\drivers\TDPIPE.sys
2011/08/31 16:27:15.0921 3500 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINNT\system32\drivers\TDTCP.sys
2011/08/31 16:27:16.0265 3500 TermDD (88155247177638048422893737429d9e) C:\WINNT\system32\DRIVERS\termdd.sys
2011/08/31 16:27:16.0625 3500 tfsnboio (c229bf90443be8d3bd2b65d7f3ac0f35) C:\WINNT\system32\dla\tfsnboio.sys
2011/08/31 16:27:16.0828 3500 tfsncofs (79ee9fcd7728e54ab8fbc30962f0416f) C:\WINNT\system32\dla\tfsncofs.sys
2011/08/31 16:27:17.0031 3500 tfsndrct (9efb37e7de17d783a059b653f7e8afad) C:\WINNT\system32\dla\tfsndrct.sys
2011/08/31 16:27:17.0250 3500 tfsndres (130254995ebedcb34d62e8d78ec9dbd0) C:\WINNT\system32\dla\tfsndres.sys
2011/08/31 16:27:17.0468 3500 tfsnifs (9b40e1e4aeed849812a2e43a388a7e77) C:\WINNT\system32\dla\tfsnifs.sys
2011/08/31 16:27:17.0734 3500 tfsnopio (818047ad850b312705aa17ca96b9427d) C:\WINNT\system32\dla\tfsnopio.sys
2011/08/31 16:27:17.0937 3500 tfsnpool (4603e813bcc6dd465cd8d2afd37fa90d) C:\WINNT\system32\dla\tfsnpool.sys
2011/08/31 16:27:18.0187 3500 tfsnudf (6fc2cd904a9a55acfdfc780a611a75ed) C:\WINNT\system32\dla\tfsnudf.sys
2011/08/31 16:27:18.0437 3500 tfsnudfa (d4afa4d00f8db3fd1c15b3fe49c3a96c) C:\WINNT\system32\dla\tfsnudfa.sys
2011/08/31 16:27:19.0171 3500 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINNT\system32\drivers\Udfs.sys
2011/08/31 16:27:19.0718 3500 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINNT\system32\DRIVERS\update.sys
2011/08/31 16:27:20.0203 3500 usbaudio (e919708db44ed8543a7c017953148330) C:\WINNT\system32\drivers\usbaudio.sys
2011/08/31 16:27:20.0609 3500 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINNT\system32\DRIVERS\usbccgp.sys
2011/08/31 16:27:20.0906 3500 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINNT\system32\DRIVERS\usbehci.sys
2011/08/31 16:27:21.0328 3500 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINNT\system32\DRIVERS\usbhub.sys
2011/08/31 16:27:21.0671 3500 usbprint (a717c8721046828520c9edf31288fc00) C:\WINNT\system32\DRIVERS\usbprint.sys
2011/08/31 16:27:22.0140 3500 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINNT\system32\DRIVERS\usbscan.sys
2011/08/31 16:27:22.0453 3500 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINNT\system32\DRIVERS\USBSTOR.SYS
2011/08/31 16:27:22.0781 3500 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINNT\system32\DRIVERS\usbuhci.sys
2011/08/31 16:27:23.0203 3500 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINNT\system32\Drivers\usbvideo.sys
2011/08/31 16:27:23.0515 3500 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINNT\System32\drivers\vga.sys
2011/08/31 16:27:24.0109 3500 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINNT\system32\drivers\VolSnap.sys
2011/08/31 16:27:24.0531 3500 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINNT\system32\DRIVERS\wanarp.sys
2011/08/31 16:27:25.0000 3500 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINNT\system32\Drivers\wdf01000.sys
2011/08/31 16:27:25.0703 3500 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINNT\system32\drivers\wdmaud.sys
2011/08/31 16:27:26.0109 3500 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINNT\system32\DRIVERS\WSTCODEC.SYS
2011/08/31 16:27:26.0500 3500 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINNT\system32\DRIVERS\WudfPf.sys
2011/08/31 16:27:26.0906 3500 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINNT\system32\DRIVERS\wudfrd.sys
2011/08/31 16:27:27.0093 3500 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/08/31 16:27:27.0343 3500 Boot (0x1200) (bfda6547d4f60e282496defcfa5a50a6) \Device\Harddisk0\DR0\Partition0
2011/08/31 16:27:27.0343 3500 ================================================================================
2011/08/31 16:27:27.0343 3500 Scan finished
2011/08/31 16:27:27.0343 3500 ================================================================================
2011/08/31 16:27:27.0375 1096 Detected object count: 0
2011/08/31 16:27:27.0375 1096 Actual detected object count: 0
2011/08/31 16:29:52.0734 3864 Deinitialize success
slowride71
Posts: 24 +0
virus
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7622
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/31/2011 4:54:40 PM
mbam-log-2011-08-31 (16-54-40).txt
Scan type: Quick scan
Objects scanned: 161616
Time elapsed: 18 minute(s), 6 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINNT\system32\f3PSSavr.scr (PUP.FunWebProducts) -> Not selected for removal.
Thank you for all your help
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7622
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/31/2011 4:54:40 PM
mbam-log-2011-08-31 (16-54-40).txt
Scan type: Quick scan
Objects scanned: 161616
Time elapsed: 18 minute(s), 6 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINNT\system32\f3PSSavr.scr (PUP.FunWebProducts) -> Not selected for removal.
Thank you for all your help
slowride71
Posts: 24 +0
virus
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 3/5/2009 7:43:59 PM
System Uptime: 9/1/2011 8:30:58 AM (2 hours ago)
.
Motherboard: Dell Computer Corp. | | 0G1548
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2791/533mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 13.437 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP162: 6/4/2011 6:10:13 PM - System Checkpoint
RP163: 6/5/2011 6:46:51 PM - System Checkpoint
RP164: 6/6/2011 7:04:40 PM - System Checkpoint
RP165: 6/8/2011 7:12:17 PM - System Checkpoint
RP166: 6/10/2011 6:36:49 PM - System Checkpoint
RP167: 6/15/2011 9:44:52 AM - System Checkpoint
RP168: 6/15/2011 7:01:22 PM - Software Distribution Service 3.0
RP169: 6/16/2011 7:05:58 PM - System Checkpoint
RP170: 6/18/2011 12:53:52 PM - System Checkpoint
RP171: 6/19/2011 2:34:14 PM - System Checkpoint
RP172: 6/21/2011 6:09:25 PM - System Checkpoint
RP173: 6/24/2011 12:57:19 PM - System Checkpoint
RP174: 6/25/2011 2:24:08 PM - System Checkpoint
RP175: 6/26/2011 4:37:12 PM - System Checkpoint
RP176: 6/26/2011 6:05:42 PM - Software Distribution Service 3.0
RP177: 6/27/2011 7:13:01 PM - System Checkpoint
RP178: 6/28/2011 10:00:37 PM - Software Distribution Service 3.0
RP179: 6/30/2011 12:47:23 PM - System Checkpoint
RP180: 7/2/2011 10:52:31 AM - System Checkpoint
RP181: 7/3/2011 3:41:56 PM - System Checkpoint
RP182: 7/4/2011 4:24:37 PM - System Checkpoint
RP183: 7/5/2011 6:13:57 PM - System Checkpoint
RP184: 7/6/2011 6:15:57 PM - System Checkpoint
RP185: 7/8/2011 4:41:14 PM - System Checkpoint
RP186: 7/9/2011 6:26:31 PM - System Checkpoint
RP187: 7/10/2011 7:08:02 PM - System Checkpoint
RP188: 7/11/2011 7:22:05 PM - System Checkpoint
RP189: 7/12/2011 8:25:42 PM - Software Distribution Service 3.0
RP190: 7/13/2011 6:06:21 PM - Software Distribution Service 3.0
RP191: 7/16/2011 11:36:10 AM - System Checkpoint
RP192: 7/17/2011 2:54:42 PM - System Checkpoint
RP193: 7/18/2011 5:10:49 PM - System Checkpoint
RP194: 7/19/2011 5:52:12 PM - System Checkpoint
RP195: 7/20/2011 6:33:06 PM - System Checkpoint
RP196: 7/21/2011 6:39:32 PM - System Checkpoint
RP197: 7/22/2011 6:52:28 PM - System Checkpoint
RP198: 7/23/2011 7:34:25 PM - System Checkpoint
RP199: 7/25/2011 6:11:30 PM - System Checkpoint
RP200: 7/27/2011 6:04:08 PM - System Checkpoint
RP201: 7/28/2011 6:11:39 PM - System Checkpoint
RP202: 7/30/2011 3:12:12 PM - System Checkpoint
RP203: 8/3/2011 10:37:46 AM - System Checkpoint
RP204: 8/4/2011 5:45:01 PM - System Checkpoint
RP205: 8/5/2011 6:28:59 PM - System Checkpoint
RP206: 8/7/2011 2:12:03 PM - System Checkpoint
RP207: 8/9/2011 12:31:04 PM - System Checkpoint
RP208: 8/10/2011 6:08:14 PM - Software Distribution Service 3.0
RP209: 8/13/2011 9:27:33 AM - System Checkpoint
RP210: 8/14/2011 10:18:03 AM - System Checkpoint
RP211: 8/15/2011 6:33:12 PM - System Checkpoint
RP212: 8/16/2011 8:16:29 PM - System Checkpoint
RP213: 8/17/2011 8:42:11 PM - System Checkpoint
RP214: 8/20/2011 9:04:39 AM - System Checkpoint
RP215: 8/21/2011 2:04:44 PM - System Checkpoint
RP216: 8/22/2011 7:23:24 PM - System Checkpoint
RP217: 8/24/2011 8:29:30 PM - Software Distribution Service 3.0
RP218: 8/26/2011 4:33:21 PM - System Checkpoint
RP219: 8/27/2011 4:37:33 PM - System Checkpoint
RP220: 8/29/2011 9:14:20 AM - System Checkpoint
RP221: 8/31/2011 5:59:04 PM - System Checkpoint
.
==== Installed Programs ======================
.
.
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.4.5
Adobe Shockwave Player 11
AIM 7
AIMTunes
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
AVG 2011
BCM V.92 56K Modem
Big Fish Games: Game Manager
Bonjour
Broadcom 440x 10/100 Integrated Controller
Canon Easy-PhotoPrint EX
Canon Easy-WebPrint EX
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon MG5200 series MP Drivers
Canon MG5200 series User Registration
Canon MP Navigator EX 4.0
Canon My Printer
Canon Solution Menu EX
CCleaner (remove only)
Comcast Access
Comcast Desktop Software (v1.2.0.9)
Cursed House
Debugging Tools for Windows (x86)
Dell ResourceCD
Download Updater (AOL LLC)
Driver Performer
ffdshow
FOX News Live Stream
FrostWire 5.1.4
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) Extreme Graphics Driver
iTunes
Java(TM) 6 Update 12
Jewel Quest Mysteries: The Seventh Gate
magicJack
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Corporation
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft LifeCam
Microsoft Silverlight
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Move Media Player
Plaxo Toolbar for Windows
QuickTime
RCA Detective™ 2.0.0.98
RCA easyRip™ 1.4.6.0
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
SoundMAX
TurboTax 2010
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wrapper
TurboTax 2010 wwviper
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB955759)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Viewpoint Media Player
VLC media player 1.1.7
WebFldrs XP
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Yahoo! Software Update
Yahoo! Toolbar
.
==== Event Viewer Messages From Past Week ========
.
8/30/2011 6:14:21 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
8/30/2011 6:14:21 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/29/2011 2:08:56 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
8/29/2011 2:04:24 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
8/29/2011 1:52:34 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde
8/25/2011 5:10:55 PM, error: Service Control Manager [7000] - The AVGIDSAgent service failed to start due to the following error: Access is denied.
.
==== End Of File ===========================
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 3/5/2009 7:43:59 PM
System Uptime: 9/1/2011 8:30:58 AM (2 hours ago)
.
Motherboard: Dell Computer Corp. | | 0G1548
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2791/533mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 13.437 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP162: 6/4/2011 6:10:13 PM - System Checkpoint
RP163: 6/5/2011 6:46:51 PM - System Checkpoint
RP164: 6/6/2011 7:04:40 PM - System Checkpoint
RP165: 6/8/2011 7:12:17 PM - System Checkpoint
RP166: 6/10/2011 6:36:49 PM - System Checkpoint
RP167: 6/15/2011 9:44:52 AM - System Checkpoint
RP168: 6/15/2011 7:01:22 PM - Software Distribution Service 3.0
RP169: 6/16/2011 7:05:58 PM - System Checkpoint
RP170: 6/18/2011 12:53:52 PM - System Checkpoint
RP171: 6/19/2011 2:34:14 PM - System Checkpoint
RP172: 6/21/2011 6:09:25 PM - System Checkpoint
RP173: 6/24/2011 12:57:19 PM - System Checkpoint
RP174: 6/25/2011 2:24:08 PM - System Checkpoint
RP175: 6/26/2011 4:37:12 PM - System Checkpoint
RP176: 6/26/2011 6:05:42 PM - Software Distribution Service 3.0
RP177: 6/27/2011 7:13:01 PM - System Checkpoint
RP178: 6/28/2011 10:00:37 PM - Software Distribution Service 3.0
RP179: 6/30/2011 12:47:23 PM - System Checkpoint
RP180: 7/2/2011 10:52:31 AM - System Checkpoint
RP181: 7/3/2011 3:41:56 PM - System Checkpoint
RP182: 7/4/2011 4:24:37 PM - System Checkpoint
RP183: 7/5/2011 6:13:57 PM - System Checkpoint
RP184: 7/6/2011 6:15:57 PM - System Checkpoint
RP185: 7/8/2011 4:41:14 PM - System Checkpoint
RP186: 7/9/2011 6:26:31 PM - System Checkpoint
RP187: 7/10/2011 7:08:02 PM - System Checkpoint
RP188: 7/11/2011 7:22:05 PM - System Checkpoint
RP189: 7/12/2011 8:25:42 PM - Software Distribution Service 3.0
RP190: 7/13/2011 6:06:21 PM - Software Distribution Service 3.0
RP191: 7/16/2011 11:36:10 AM - System Checkpoint
RP192: 7/17/2011 2:54:42 PM - System Checkpoint
RP193: 7/18/2011 5:10:49 PM - System Checkpoint
RP194: 7/19/2011 5:52:12 PM - System Checkpoint
RP195: 7/20/2011 6:33:06 PM - System Checkpoint
RP196: 7/21/2011 6:39:32 PM - System Checkpoint
RP197: 7/22/2011 6:52:28 PM - System Checkpoint
RP198: 7/23/2011 7:34:25 PM - System Checkpoint
RP199: 7/25/2011 6:11:30 PM - System Checkpoint
RP200: 7/27/2011 6:04:08 PM - System Checkpoint
RP201: 7/28/2011 6:11:39 PM - System Checkpoint
RP202: 7/30/2011 3:12:12 PM - System Checkpoint
RP203: 8/3/2011 10:37:46 AM - System Checkpoint
RP204: 8/4/2011 5:45:01 PM - System Checkpoint
RP205: 8/5/2011 6:28:59 PM - System Checkpoint
RP206: 8/7/2011 2:12:03 PM - System Checkpoint
RP207: 8/9/2011 12:31:04 PM - System Checkpoint
RP208: 8/10/2011 6:08:14 PM - Software Distribution Service 3.0
RP209: 8/13/2011 9:27:33 AM - System Checkpoint
RP210: 8/14/2011 10:18:03 AM - System Checkpoint
RP211: 8/15/2011 6:33:12 PM - System Checkpoint
RP212: 8/16/2011 8:16:29 PM - System Checkpoint
RP213: 8/17/2011 8:42:11 PM - System Checkpoint
RP214: 8/20/2011 9:04:39 AM - System Checkpoint
RP215: 8/21/2011 2:04:44 PM - System Checkpoint
RP216: 8/22/2011 7:23:24 PM - System Checkpoint
RP217: 8/24/2011 8:29:30 PM - Software Distribution Service 3.0
RP218: 8/26/2011 4:33:21 PM - System Checkpoint
RP219: 8/27/2011 4:37:33 PM - System Checkpoint
RP220: 8/29/2011 9:14:20 AM - System Checkpoint
RP221: 8/31/2011 5:59:04 PM - System Checkpoint
.
==== Installed Programs ======================
.
.
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.4.5
Adobe Shockwave Player 11
AIM 7
AIMTunes
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
AVG 2011
BCM V.92 56K Modem
Big Fish Games: Game Manager
Bonjour
Broadcom 440x 10/100 Integrated Controller
Canon Easy-PhotoPrint EX
Canon Easy-WebPrint EX
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon MG5200 series MP Drivers
Canon MG5200 series User Registration
Canon MP Navigator EX 4.0
Canon My Printer
Canon Solution Menu EX
CCleaner (remove only)
Comcast Access
Comcast Desktop Software (v1.2.0.9)
Cursed House
Debugging Tools for Windows (x86)
Dell ResourceCD
Download Updater (AOL LLC)
Driver Performer
ffdshow
FOX News Live Stream
FrostWire 5.1.4
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) Extreme Graphics Driver
iTunes
Java(TM) 6 Update 12
Jewel Quest Mysteries: The Seventh Gate
magicJack
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Corporation
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft LifeCam
Microsoft Silverlight
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Move Media Player
Plaxo Toolbar for Windows
QuickTime
RCA Detective™ 2.0.0.98
RCA easyRip™ 1.4.6.0
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
SoundMAX
TurboTax 2010
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wrapper
TurboTax 2010 wwviper
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB955759)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Viewpoint Media Player
VLC media player 1.1.7
WebFldrs XP
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Yahoo! Software Update
Yahoo! Toolbar
.
==== Event Viewer Messages From Past Week ========
.
8/30/2011 6:14:21 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
8/30/2011 6:14:21 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/29/2011 2:08:56 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
8/29/2011 2:04:24 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
8/29/2011 1:52:34 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde
8/25/2011 5:10:55 PM, error: Service Control Manager [7000] - The AVGIDSAgent service failed to start due to the following error: Access is denied.
.
==== End Of File ===========================
slowride71
Posts: 24 +0
Broni, I could not find the attach.txt that was run on 8/30/11. hope this one will help.
Rusty
Rusty
slowride71
Posts: 24 +0
virus
sorry, thought I had put it in quarantine.
sorry, thought I had put it in quarantine.
slowride71
Posts: 24 +0
virus
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7655
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
9/5/2011 11:26:07 AM
mbam-log-2011-09-05 (11-26-06).txt
Scan type: Quick scan
Objects scanned: 158267
Time elapsed: 14 minute(s), 35 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
thanks again for your help, would you advise buying malwarebytes and use weekly?
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7655
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
9/5/2011 11:26:07 AM
mbam-log-2011-09-05 (11-26-06).txt
Scan type: Quick scan
Objects scanned: 158267
Time elapsed: 14 minute(s), 35 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
thanks again for your help, would you advise buying malwarebytes and use weekly?
Broni
Posts: 56,041 +516
Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan:
On completion of the scan click "Save log", save it to your desktop and post in your next reply:
NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
====================================================================
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
Make sure, you re-enable your security programs, when you're done with Combofix.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTE.
If, for some reason, Combofix refuses to run, try one of the following:
1. Run Combofix from Safe Mode.
2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
Rkill.com
Rkill.scr
Rkill.exe
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.
If normal mode still doesn't work, run BOTH tools from safe mode.
In case #2, please post BOTH logs, rKill and Combofix.
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan:
On completion of the scan click "Save log", save it to your desktop and post in your next reply:
NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
====================================================================
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE 2. If Combofix asks you to update the program, always do so.- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt"
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
Make sure, you re-enable your security programs, when you're done with Combofix.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTE.
If, for some reason, Combofix refuses to run, try one of the following:
1. Run Combofix from Safe Mode.
2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
Rkill.com
Rkill.scr
Rkill.exe
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.
If normal mode still doesn't work, run BOTH tools from safe mode.
In case #2, please post BOTH logs, rKill and Combofix.
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
slowride71
Posts: 24 +0
virus
ComboFix 11-09-05.04 - Owner 09/05/2011 14:10:59.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.564 [GMT -4:00]
Running from: c:\documents and settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\ApplicationHistory\ngen.exe.f36057ef.ini
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\ApplicationHistory\SL11.tmp.3ae087d6.ini
c:\documents and settings\Owner.HOME-5NR1RMGI5L\WINDOWS
c:\program files\messenger\msmsgsin.exe
c:\winnt\$NtUninstallKB42356$
c:\winnt\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\winnt\$NtUninstallKB42356$\1545864879\click.tlb
c:\winnt\$NtUninstallKB42356$\1545864879\L\nnqkxjfa
c:\winnt\$NtUninstallKB42356$\1545864879\loader.tlb
c:\winnt\$NtUninstallKB42356$\1545864879\U\@00000001
c:\winnt\$NtUninstallKB42356$\1545864879\U\@000000c0
c:\winnt\$NtUninstallKB42356$\1545864879\U\@000000cb
c:\winnt\$NtUninstallKB42356$\1545864879\U\@000000cf
c:\winnt\$NtUninstallKB42356$\1545864879\U\@80000000
c:\winnt\$NtUninstallKB42356$\1545864879\U\@800000c0
c:\winnt\$NtUninstallKB42356$\1545864879\U\@800000cb
c:\winnt\$NtUninstallKB42356$\1545864879\U\@800000cf
c:\winnt\$NtUninstallKB42356$\1734920488
c:\winnt\assembly\GAC_MSIL\desktop.ini
c:\winnt\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\winnt\system32\comct332.ocx
c:\winnt\system32\lvci1201278.dll
c:\winnt\system32\Thumbs.db
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_5c2406af
.
.
((((((((((((((((((((((((( Files Created from 2011-08-05 to 2011-09-05 )))))))))))))))))))))))))))))))
.
.
2011-09-04 13:48 . 2011-09-04 13:48 -------- d--h--w- c:\documents and settings\All Users.WINNT\Application Data\CanonIJEPPEX
2011-09-04 13:48 . 2011-09-05 02:37 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Canon Easy-PhotoPrint EX
2011-08-29 17:34 . 2011-08-29 17:34 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\Malwarebytes
2011-08-29 17:33 . 2011-07-06 23:52 41272 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-08-29 17:33 . 2011-08-29 17:33 -------- d-----w- c:\documents and settings\All Users.WINNT\Application Data\Malwarebytes
2011-08-29 17:33 . 2011-08-30 22:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-29 17:33 . 2011-07-06 23:52 22712 ----a-w- c:\winnt\system32\drivers\mbam.sys
2011-08-25 13:29 . 2011-09-05 01:25 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\.frostwire5
2011-08-25 13:27 . 2011-08-25 13:30 -------- d-----w- c:\program files\FrostWire 5
2011-08-10 22:00 . 2011-06-24 14:10 139656 -c----w- c:\winnt\system32\dllcache\rdpwd.sys
2011-08-10 21:59 . 2011-07-08 14:02 10496 -c----w- c:\winnt\system32\dllcache\ndistapi.sys
2011-08-09 20:11 . 2011-08-09 20:11 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\BigFish
2011-08-09 20:11 . 2011-08-09 20:11 -------- d-----w- c:\documents and settings\All Users.WINNT\Application Data\BigFish
2011-08-09 20:09 . 2011-08-09 20:10 -------- d-----w- c:\program files\Jewel Quest Mysteries - The Seventh Gate
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-25 12:53 . 2011-05-15 15:44 404640 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2003-07-16 20:34 456320 ----a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2003-07-16 20:37 10496 ----a-w- c:\winnt\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2009-03-06 00:30 139656 ----a-w- c:\winnt\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-06-23 16:33 916480 ----a-w- c:\winnt\system32\wininet.dll
2011-06-23 18:36 . 2003-07-16 20:32 43520 ----a-w- c:\winnt\system32\licmgr10.dll
2011-06-23 18:36 . 2003-07-16 20:30 1469440 ----a-w- c:\winnt\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-04 05:59 385024 ----a-w- c:\winnt\system32\html.iec
2011-06-20 17:44 . 2003-07-16 20:51 293376 ----a-w- c:\winnt\system32\winsrv.dll
2009-03-27 13:00 . 2009-03-27 12:59 13440584 -c--a-w- c:\program files\Install_AIM.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-30 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-07-30 02:05 1515688 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-30 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-30 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\mjusbsp\cdloader2.exe" [2011-05-16 50592]
"Aim"="c:\program files\AIM\aim.exe" [2011-01-05 4321112]
"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"IgfxTray"="c:\winnt\System32\igfxtray.exe" [2005-10-19 155648]
"dla"="c:\winnt\system32\dla\tfswctrl.exe" [2003-08-06 114741]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-07-30 887976]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Owner.HOME-5NR1RMGI5L^Start Menu^Programs^Startup^RCA Detective.lnk]
path=c:\documents and settings\Owner.HOME-5NR1RMGI5L\Start Menu\Programs\Startup\RCA Detective.lnk
backup=c:\winnt\pss\RCA Detective.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\winnt\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 01:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 14:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Software]
2009-04-24 07:57 1025320 ----a-w- c:\program files\Common Files\SupportSoft\bin\bcont.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-10-19 13:59 126976 ----a-w- c:\winnt\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 22:16 421160 -c--a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2010-05-20 19:27 119152 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoSysTray]
2010-04-13 14:12 15688 -c--a-w- c:\program files\Plaxo\3.24.0.82\plaxosystray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
2010-04-13 14:12 762184 -c--a-w- c:\program files\Plaxo\3.24.0.82\PlaxoHelper_en.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
2003-02-13 05:01 155648 -c--a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-08 22:38 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-11-28 01:37 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINNT\\system32\\sessmgr.exe"=
"c:\\WINNT\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Documents and Settings\\Owner.HOME-5NR1RMGI5L\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\FrostWire 5\\FrostWire.exe"=
"c:\\Program Files\\Google\\Update\\GoogleUpdate.exe"=
"c:\\WINNT\\system32\\msfeedssync.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/29/2011 1:33 PM 366640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/29/2009 8:21 PM 24652]
R3 MBAMProtector;MBAMProtector;c:\winnt\system32\drivers\mbam.sys [8/29/2011 1:33 PM 22712]
S0 nielprt;Nielsen Patch Service;c:\winnt\system32\DRIVERS\nielprt.sys --> c:\winnt\system32\DRIVERS\nielprt.sys [?]
S2 gupdate1c9bddd41123d4a;Google Update Service (gupdate1c9bddd41123d4a);c:\program files\Google\Update\GoogleUpdate.exe [4/15/2009 11:17 AM 133104]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3/13/2011 4:12 PM 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/15/2009 11:17 AM 133104]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\winnt\system32\drivers\nx6000.sys [9/30/2010 8:40 PM 30576]
S3 NielGfx;Nielsen USB GFX;c:\winnt\system32\drivers\nielgfx.sys --> c:\winnt\system32\drivers\nielgfx.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-17 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]
.
2011-09-05 c:\winnt\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-30 15:16]
.
2011-09-05 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 15:16]
.
2011-09-05 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 15:16]
.
2011-09-05 c:\winnt\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-07-30 02:05]
.
2011-09-05 c:\winnt\Tasks\User_Feed_Synchronization-{54D4DDA0-6D57-415C-9F9D-F0DA38B79C92}.job
- c:\winnt\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uInternet Settings,ProxyOverride = *.local
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 192.168.1.1
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{657E195F-066D-435C-92DB-7C261E6FE832} - (no file)
HKLM-Run-TaskTray - (no file)
MSConfigStartUp-Aim6 - c:\program files\AIM6\aim6.exe
MSConfigStartUp-Dell AIO Printer A920 - c:\program files\Dell AIO Printer A920\dlbkbmgr.exe
MSConfigStartUp-Logitech Vid - c:\program files\Logitech\Logitech Vid\vid.exe
MSConfigStartUp-LogitechQuickCamRibbon - c:\program files\Logitech\Logitech WebCam Software\LWS.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-NielsenOnline - c:\program files\NetRatingsNetSight\NetSight\NielsenOnline.exe
MSConfigStartUp-Weather - c:\program files\AWS\WeatherBug\Weather.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-05 14:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3216)
c:\winnt\system32\WININET.dll
c:\winnt\system32\ieframe.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\winnt\system32\LEXBCES.EXE
c:\winnt\system32\LEXPPS.EXE
c:\program files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\winnt\BCMSMMSG.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\winnt\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-09-05 14:34:14 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-05 18:34
.
Pre-Run: 15,142,924,288 bytes free
Post-Run: 15,232,069,632 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINNT="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 0BD94BBFDA947BB5349758F6EB515197
ComboFix 11-09-05.04 - Owner 09/05/2011 14:10:59.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.564 [GMT -4:00]
Running from: c:\documents and settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\ApplicationHistory\ngen.exe.f36057ef.ini
c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\ApplicationHistory\SL11.tmp.3ae087d6.ini
c:\documents and settings\Owner.HOME-5NR1RMGI5L\WINDOWS
c:\program files\messenger\msmsgsin.exe
c:\winnt\$NtUninstallKB42356$
c:\winnt\$NtUninstallKB42356$\1545864879\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\winnt\$NtUninstallKB42356$\1545864879\click.tlb
c:\winnt\$NtUninstallKB42356$\1545864879\L\nnqkxjfa
c:\winnt\$NtUninstallKB42356$\1545864879\loader.tlb
c:\winnt\$NtUninstallKB42356$\1545864879\U\@00000001
c:\winnt\$NtUninstallKB42356$\1545864879\U\@000000c0
c:\winnt\$NtUninstallKB42356$\1545864879\U\@000000cb
c:\winnt\$NtUninstallKB42356$\1545864879\U\@000000cf
c:\winnt\$NtUninstallKB42356$\1545864879\U\@80000000
c:\winnt\$NtUninstallKB42356$\1545864879\U\@800000c0
c:\winnt\$NtUninstallKB42356$\1545864879\U\@800000cb
c:\winnt\$NtUninstallKB42356$\1545864879\U\@800000cf
c:\winnt\$NtUninstallKB42356$\1734920488
c:\winnt\assembly\GAC_MSIL\desktop.ini
c:\winnt\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\winnt\system32\comct332.ocx
c:\winnt\system32\lvci1201278.dll
c:\winnt\system32\Thumbs.db
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_5c2406af
.
.
((((((((((((((((((((((((( Files Created from 2011-08-05 to 2011-09-05 )))))))))))))))))))))))))))))))
.
.
2011-09-04 13:48 . 2011-09-04 13:48 -------- d--h--w- c:\documents and settings\All Users.WINNT\Application Data\CanonIJEPPEX
2011-09-04 13:48 . 2011-09-05 02:37 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Canon Easy-PhotoPrint EX
2011-08-29 17:34 . 2011-08-29 17:34 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\Malwarebytes
2011-08-29 17:33 . 2011-07-06 23:52 41272 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-08-29 17:33 . 2011-08-29 17:33 -------- d-----w- c:\documents and settings\All Users.WINNT\Application Data\Malwarebytes
2011-08-29 17:33 . 2011-08-30 22:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-29 17:33 . 2011-07-06 23:52 22712 ----a-w- c:\winnt\system32\drivers\mbam.sys
2011-08-25 13:29 . 2011-09-05 01:25 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\.frostwire5
2011-08-25 13:27 . 2011-08-25 13:30 -------- d-----w- c:\program files\FrostWire 5
2011-08-10 22:00 . 2011-06-24 14:10 139656 -c----w- c:\winnt\system32\dllcache\rdpwd.sys
2011-08-10 21:59 . 2011-07-08 14:02 10496 -c----w- c:\winnt\system32\dllcache\ndistapi.sys
2011-08-09 20:11 . 2011-08-09 20:11 -------- d-----w- c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\BigFish
2011-08-09 20:11 . 2011-08-09 20:11 -------- d-----w- c:\documents and settings\All Users.WINNT\Application Data\BigFish
2011-08-09 20:09 . 2011-08-09 20:10 -------- d-----w- c:\program files\Jewel Quest Mysteries - The Seventh Gate
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-25 12:53 . 2011-05-15 15:44 404640 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2003-07-16 20:34 456320 ----a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2003-07-16 20:37 10496 ----a-w- c:\winnt\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2009-03-06 00:30 139656 ----a-w- c:\winnt\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-06-23 16:33 916480 ----a-w- c:\winnt\system32\wininet.dll
2011-06-23 18:36 . 2003-07-16 20:32 43520 ----a-w- c:\winnt\system32\licmgr10.dll
2011-06-23 18:36 . 2003-07-16 20:30 1469440 ----a-w- c:\winnt\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-04 05:59 385024 ----a-w- c:\winnt\system32\html.iec
2011-06-20 17:44 . 2003-07-16 20:51 293376 ----a-w- c:\winnt\system32\winsrv.dll
2009-03-27 13:00 . 2009-03-27 12:59 13440584 -c--a-w- c:\program files\Install_AIM.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-30 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-07-30 02:05 1515688 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-30 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-30 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Owner.HOME-5NR1RMGI5L\Application Data\mjusbsp\cdloader2.exe" [2011-05-16 50592]
"Aim"="c:\program files\AIM\aim.exe" [2011-01-05 4321112]
"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"IgfxTray"="c:\winnt\System32\igfxtray.exe" [2005-10-19 155648]
"dla"="c:\winnt\system32\dla\tfswctrl.exe" [2003-08-06 114741]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-07-30 887976]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Owner.HOME-5NR1RMGI5L^Start Menu^Programs^Startup^RCA Detective.lnk]
path=c:\documents and settings\Owner.HOME-5NR1RMGI5L\Start Menu\Programs\Startup\RCA Detective.lnk
backup=c:\winnt\pss\RCA Detective.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\winnt\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 01:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 14:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Software]
2009-04-24 07:57 1025320 ----a-w- c:\program files\Common Files\SupportSoft\bin\bcont.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-10-19 13:59 126976 ----a-w- c:\winnt\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 22:16 421160 -c--a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2010-05-20 19:27 119152 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoSysTray]
2010-04-13 14:12 15688 -c--a-w- c:\program files\Plaxo\3.24.0.82\plaxosystray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
2010-04-13 14:12 762184 -c--a-w- c:\program files\Plaxo\3.24.0.82\PlaxoHelper_en.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
2003-02-13 05:01 155648 -c--a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-08 22:38 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-11-28 01:37 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINNT\\system32\\sessmgr.exe"=
"c:\\WINNT\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Documents and Settings\\Owner.HOME-5NR1RMGI5L\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\FrostWire 5\\FrostWire.exe"=
"c:\\Program Files\\Google\\Update\\GoogleUpdate.exe"=
"c:\\WINNT\\system32\\msfeedssync.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/29/2011 1:33 PM 366640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/29/2009 8:21 PM 24652]
R3 MBAMProtector;MBAMProtector;c:\winnt\system32\drivers\mbam.sys [8/29/2011 1:33 PM 22712]
S0 nielprt;Nielsen Patch Service;c:\winnt\system32\DRIVERS\nielprt.sys --> c:\winnt\system32\DRIVERS\nielprt.sys [?]
S2 gupdate1c9bddd41123d4a;Google Update Service (gupdate1c9bddd41123d4a);c:\program files\Google\Update\GoogleUpdate.exe [4/15/2009 11:17 AM 133104]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3/13/2011 4:12 PM 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/15/2009 11:17 AM 133104]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\winnt\system32\drivers\nx6000.sys [9/30/2010 8:40 PM 30576]
S3 NielGfx;Nielsen USB GFX;c:\winnt\system32\drivers\nielgfx.sys --> c:\winnt\system32\drivers\nielgfx.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-17 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]
.
2011-09-05 c:\winnt\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-30 15:16]
.
2011-09-05 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 15:16]
.
2011-09-05 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 15:16]
.
2011-09-05 c:\winnt\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-07-30 02:05]
.
2011-09-05 c:\winnt\Tasks\User_Feed_Synchronization-{54D4DDA0-6D57-415C-9F9D-F0DA38B79C92}.job
- c:\winnt\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.aol.com/?icid=acm50mtmhpunauthgreeting#
uInternet Settings,ProxyOverride = *.local
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 192.168.1.1
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{657E195F-066D-435C-92DB-7C261E6FE832} - (no file)
HKLM-Run-TaskTray - (no file)
MSConfigStartUp-Aim6 - c:\program files\AIM6\aim6.exe
MSConfigStartUp-Dell AIO Printer A920 - c:\program files\Dell AIO Printer A920\dlbkbmgr.exe
MSConfigStartUp-Logitech Vid - c:\program files\Logitech\Logitech Vid\vid.exe
MSConfigStartUp-LogitechQuickCamRibbon - c:\program files\Logitech\Logitech WebCam Software\LWS.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-NielsenOnline - c:\program files\NetRatingsNetSight\NetSight\NielsenOnline.exe
MSConfigStartUp-Weather - c:\program files\AWS\WeatherBug\Weather.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-05 14:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3216)
c:\winnt\system32\WININET.dll
c:\winnt\system32\ieframe.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\winnt\system32\LEXBCES.EXE
c:\winnt\system32\LEXPPS.EXE
c:\program files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\winnt\BCMSMMSG.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\winnt\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-09-05 14:34:14 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-05 18:34
.
Pre-Run: 15,142,924,288 bytes free
Post-Run: 15,232,069,632 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINNT="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 0BD94BBFDA947BB5349758F6EB515197
slowride71
Posts: 24 +0
virus
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-05 13:03:41
-----------------------------
13:03:41.984 OS Version: Windows 5.1.2600 Service Pack 3
13:03:41.984 Number of processors: 1 586 0x209
13:03:41.984 ComputerName: BLACKIE UserName: Owner
13:03:47.921 Initialize success
13:07:30.625 AVAST engine defs: 11090500
13:07:48.187 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:07:48.187 Disk 0 Vendor: WDC_WD400EB-75CPF0 06.04G06 Size: 38166MB BusType: 3
13:07:48.250 Disk 0 MBR read successfully
13:07:48.250 Disk 0 MBR scan
13:07:48.828 Disk 0 Windows XP default MBR code
13:07:48.859 Disk 0 scanning sectors +78156225
13:07:49.203 Disk 0 scanning C:\WINNT\system32\drivers
13:08:26.843 Service scanning
13:08:33.046 Modules scanning
13:09:01.281 Disk 0 trace - called modules:
13:09:01.312 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys
13:09:01.312 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82fcdab8]
13:09:01.312 3 CLASSPNP.SYS[f75c5fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82fcfd98]
13:09:04.328 AVAST engine scan C:\WINNT
13:09:16.812 AVAST engine scan C:\WINNT\system32
13:15:47.265 AVAST engine scan C:\WINNT\system32\drivers
13:16:20.453 AVAST engine scan C:\Documents and Settings\Owner.HOME-5NR1RMGI5L
13:23:54.859 AVAST engine scan C:\Documents and Settings\All Users.WINNT
13:27:36.453 Scan finished successfully
13:39:06.578 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\MBR.dat"
13:39:06.578 The log file has been saved successfully to "C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.txt"
Did I get all of them?
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-05 13:03:41
-----------------------------
13:03:41.984 OS Version: Windows 5.1.2600 Service Pack 3
13:03:41.984 Number of processors: 1 586 0x209
13:03:41.984 ComputerName: BLACKIE UserName: Owner
13:03:47.921 Initialize success
13:07:30.625 AVAST engine defs: 11090500
13:07:48.187 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:07:48.187 Disk 0 Vendor: WDC_WD400EB-75CPF0 06.04G06 Size: 38166MB BusType: 3
13:07:48.250 Disk 0 MBR read successfully
13:07:48.250 Disk 0 MBR scan
13:07:48.828 Disk 0 Windows XP default MBR code
13:07:48.859 Disk 0 scanning sectors +78156225
13:07:49.203 Disk 0 scanning C:\WINNT\system32\drivers
13:08:26.843 Service scanning
13:08:33.046 Modules scanning
13:09:01.281 Disk 0 trace - called modules:
13:09:01.312 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys
13:09:01.312 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82fcdab8]
13:09:01.312 3 CLASSPNP.SYS[f75c5fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82fcfd98]
13:09:04.328 AVAST engine scan C:\WINNT
13:09:16.812 AVAST engine scan C:\WINNT\system32
13:15:47.265 AVAST engine scan C:\WINNT\system32\drivers
13:16:20.453 AVAST engine scan C:\Documents and Settings\Owner.HOME-5NR1RMGI5L
13:23:54.859 AVAST engine scan C:\Documents and Settings\All Users.WINNT
13:27:36.453 Scan finished successfully
13:39:06.578 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\MBR.dat"
13:39:06.578 The log file has been saved successfully to "C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.txt"
Did I get all of them?
Broni
Posts: 56,041 +516
Uninstall Ask Toolbar, known foistware.
Unless you installed Viewpoint Manager knowledgeably...
Go Start>Control Panel>Add\Remove (Programs and Features in Vista), and...
Uninstall any of the following programs associated with Viewpoint:
* Viewpoint Manager
* Viewpoint Media Player
* Viewpoint Toolbar
This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware ("drive-by-install") as it is installed without your consent through programs like AOL, AIM, Compuserve, etc.
=================================================================
Combofix log looks good now.
How is computer doing?
Download OTL to your Desktop.
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop
Unless you installed Viewpoint Manager knowledgeably...
Go Start>Control Panel>Add\Remove (Programs and Features in Vista), and...
Uninstall any of the following programs associated with Viewpoint:
* Viewpoint Manager
* Viewpoint Media Player
* Viewpoint Toolbar
This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware ("drive-by-install") as it is installed without your consent through programs like AOL, AIM, Compuserve, etc.
=================================================================
Combofix log looks good now.
How is computer doing?
Download OTL to your Desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Click the Scan All Users checkbox.
- Under the Custom Scan box paste this in:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
slowride71
Posts: 24 +0
virus
OTL logfile created on: 9/5/2011 6:56:26 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
766.00 Mb Total Physical Memory | 271.61 Mb Available Physical Memory | 35.46% Memory free
2.96 Gb Paging File | 2.55 Gb Available in Paging File | 86.28% Paging File free
Paging file location(s): C:\pagefile.sys 2304 2304 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 13.99 Gb Free Space | 37.58% Space Free | Partition Type: NTFS
Computer Name: BLACKIE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/09/05 18:51:35 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
PRC - [2011/08/06 21:34:47 | 000,140,952 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/07/04 07:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2010/04/05 15:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINNT\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2011/09/05 05:08:25 | 001,384,960 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11090500\algo.dll
MOD - [2011/09/05 04:17:50 | 000,208,544 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11090500\aswRep.dll
MOD - [2011/08/11 18:01:19 | 000,212,992 | ---- | M] () -- C:\WINNT\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\70a1400affdc775d7c7398e036359286\System.ServiceProcess.ni.dll
MOD - [2011/08/10 18:34:46 | 007,950,848 | ---- | M] () -- C:\WINNT\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll
MOD - [2011/08/10 18:32:36 | 002,048,000 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2011/08/10 18:32:33 | 003,182,592 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2011/08/10 18:32:26 | 002,933,248 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2011/08/10 18:32:25 | 000,425,984 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2011/08/10 18:31:58 | 000,626,688 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2011/08/10 18:31:56 | 000,303,104 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2011/08/10 18:31:49 | 000,258,048 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
MOD - [2011/08/10 18:31:45 | 000,261,632 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2011/08/10 18:31:31 | 000,114,688 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
MOD - [2011/08/10 18:30:59 | 005,025,792 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2011/06/26 18:14:38 | 011,490,816 | ---- | M] () -- C:\WINNT\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2011/02/26 16:49:16 | 000,854,016 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll
MOD - [2011/02/26 16:49:11 | 000,270,336 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\log4net\1.2.10.0__1b44e1d426115821\log4net.dll
MOD - [2011/02/26 16:49:09 | 000,409,960 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2011/02/26 16:49:07 | 000,476,520 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2011/02/26 16:48:55 | 000,046,952 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2011/02/26 16:48:54 | 000,023,912 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.dll
MOD - [2011/02/26 16:48:54 | 000,018,792 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2011/02/26 16:48:54 | 000,012,136 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract.dll
MOD - [2011/02/26 16:48:53 | 000,421,224 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2011/02/26 16:48:52 | 000,269,672 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\3.1.26.0__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2011/02/26 16:48:51 | 000,120,168 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2011/02/26 16:48:51 | 000,070,504 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2011/02/26 16:48:50 | 000,121,704 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2010/04/05 15:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
MOD - [2008/04/13 20:11:59 | 000,014,336 | ---- | M] () -- C:\WINNT\system32\msdmo.dll
MOD - [2008/04/13 20:11:51 | 000,059,904 | ---- | M] () -- C:\WINNT\system32\devenum.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- -- (wuauserv)
SRV - File not found [Disabled | Stopped] -- -- (AppMgmt)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010/04/05 15:55:01 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINNT\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/07/04 07:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINNT\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/07/04 07:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/07/04 07:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/07/04 07:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINNT\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/07/04 07:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/07/04 07:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/07/04 07:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINNT\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/05/20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/04/30 23:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2003/08/29 05:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\BCMSM.sys -- (BCMModem)
DRV - [2003/06/30 19:11:52 | 000,043,136 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2001/08/22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINNT\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/?icid=acm50mtmhpunauthgreeting#
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINNT\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINNT\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Move Networks\plugins\npqmp071706000001.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Move Networks\plugins\npqmp071706000001.dll (Move Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\
O1 HOSTS File: ([2011/09/05 14:24:46 | 000,000,027 | ---- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-823518204-2025429265-839522115-1003..\Run: [Aim] C:\Program Files\AIM\aim.exe (AOL Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} https://lowes.2020.net/Core/Player/2020PlayerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236304913634 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236305120181 (MUWebControl Class)
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} http://www.gamehouse.com/games/gamehouse/ghplayer.cab (GameHouse Games Player)
O16 - DPF: {775879E2-7309-4619-BB02-AADE41F4B690} http://webgames.d.tmsrv.com/c=51ebb...ronicles/dreamchronicles/dreamweb.1.0.0.9.cab (CPlayFirstdreamControl Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://dl8-cdn-01.sun.com/s/ESD7/JS...5/&filename=jinstall-6u12-windows-i586-jc.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: PackageCab http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC6DEB69-355C-480C-9408-580DCD42E9C3}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINNT\system32\userinit.exe) - C:\WINNT\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINNT\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/25 13:57:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: wuauserv - File not found
Drivers32: msacm.iac2 - C:\WINNT\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINNT\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINNT\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINNT\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINNT\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINNT\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINNT\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINNT\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINNT\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINNT\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave - C:\WINNT\System32\serwvdrv.dll (Microsoft Corporation)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/09/05 18:51:19 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
[2011/09/05 15:59:07 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/09/05 14:49:51 | 000,019,544 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswFsBlk.sys
[2011/09/05 14:49:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\avast! Free Antivirus
[2011/09/05 14:49:50 | 000,309,848 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswSP.sys
[2011/09/05 14:49:45 | 000,025,432 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswRdr.sys
[2011/09/05 14:49:44 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswSnx.sys
[2011/09/05 14:49:44 | 000,043,608 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswTdi.sys
[2011/09/05 14:49:42 | 000,102,616 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswmon2.sys
[2011/09/05 14:49:42 | 000,096,344 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswmon.sys
[2011/09/05 14:49:41 | 000,030,808 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aavmker4.sys
[2011/09/05 14:48:02 | 000,040,112 | ---- | C] (AVAST Software) -- C:\WINNT\avastSS.scr
[2011/09/05 14:48:00 | 000,199,304 | ---- | C] (AVAST Software) -- C:\WINNT\System32\aswBoot.exe
[2011/09/05 14:47:11 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011/09/05 14:47:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\AVAST Software
[2011/09/05 14:00:47 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/09/05 13:57:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINNT\SWREG.exe
[2011/09/05 13:57:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINNT\SWSC.exe
[2011/09/05 13:57:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINNT\SWXCACLS.exe
[2011/09/05 13:57:53 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINNT\NIRCMD.exe
[2011/09/05 13:56:48 | 000,000,000 | ---D | C] -- C:\WINNT\ERDNT
[2011/09/05 13:56:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/09/05 13:40:36 | 004,195,245 | R--- | C] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
[2011/09/05 13:03:08 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.exe
[2011/09/05 11:07:26 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Recent
[2011/09/04 21:31:23 | 001,249,696 | ---- | C] (Alactro LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\BestVideoDownloaderSetup.exe
[2011/09/04 09:48:43 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEPPEX
[2011/09/04 09:48:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Canon Easy-PhotoPrint EX
[2011/08/31 16:24:20 | 001,406,768 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\tdsskiller.exe
[2011/08/29 15:18:28 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\dds.scr
[2011/08/29 13:34:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Malwarebytes
[2011/08/29 13:33:59 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbamswissarmy.sys
[2011/08/29 13:33:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/29 13:33:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\Malwarebytes
[2011/08/29 13:33:55 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbam.sys
[2011/08/29 13:33:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/29 13:32:09 | 009,466,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\mbam-setup-1.51.1.1800.exe
[2011/08/25 09:29:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\.frostwire5
[2011/08/25 09:28:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Start Menu\Programs\FrostWire 5
[2011/08/25 09:27:37 | 000,000,000 | ---D | C] -- C:\Program Files\FrostWire 5
[2011/08/09 16:11:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\BigFish
[2011/08/09 16:11:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\BigFish
[2011/08/09 16:09:39 | 000,000,000 | ---D | C] -- C:\Program Files\Jewel Quest Mysteries - The Seventh Gate
[2011/08/09 16:09:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\Jewel Quest Mysteries - The Seventh Gate
[2009/03/27 08:59:52 | 013,440,584 | ---- | C] (AOL LLC.) -- C:\Program Files\Install_AIM.exe
[5 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[3 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/09/05 18:51:35 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
[2011/09/05 18:40:00 | 000,000,886 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/05 18:27:44 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/09/05 15:47:10 | 000,000,418 | -H-- | M] () -- C:\WINNT\tasks\User_Feed_Synchronization-{54D4DDA0-6D57-415C-9F9D-F0DA38B79C92}.job
[2011/09/05 14:49:52 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\avast! Free Antivirus.lnk
[2011/09/05 14:49:42 | 000,002,625 | ---- | M] () -- C:\WINNT\System32\CONFIG.NT
[2011/09/05 14:45:34 | 056,167,608 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\setup_av_free.exe
[2011/09/05 14:24:55 | 000,000,868 | ---- | M] () -- C:\WINNT\tasks\Google Software Updater.job
[2011/09/05 14:24:46 | 000,000,027 | ---- | M] () -- C:\WINNT\System32\drivers\etc\hosts
[2011/09/05 14:24:31 | 000,000,882 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/05 14:24:23 | 000,002,048 | --S- | M] () -- C:\WINNT\bootstat.dat
[2011/09/05 14:00:57 | 000,000,323 | RHS- | M] () -- C:\boot.ini
[2011/09/05 13:57:09 | 004,195,245 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
[2011/09/05 13:39:06 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\MBR.dat
[2011/09/05 13:03:27 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.exe
[2011/09/04 21:31:30 | 001,249,696 | ---- | M] (Alactro LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\BestVideoDownloaderSetup.exe
[2011/09/02 18:45:37 | 000,002,206 | ---- | M] () -- C:\WINNT\System32\wpa.dbl
[2011/09/01 18:35:00 | 000,158,653 | ---- | M] () -- C:\WINNT\System32\drivers\AVG\iavichjg.avm
[2011/08/31 16:24:25 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\tdsskiller.exe
[2011/08/29 15:18:29 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\dds.scr
[2011/08/29 14:00:56 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\bdoinouq.exe
[2011/08/29 13:33:59 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/29 13:32:11 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\mbam-setup-1.51.1.1800.exe
[2011/08/29 09:49:00 | 000,006,122 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\rootkitscan.csv
[2011/08/25 11:34:59 | 000,126,112 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\cc_20110825_113451.reg
[2011/08/25 09:37:26 | 000,000,000 | ---- | M] () -- C:\WINNT\2936415324
[2011/08/25 09:28:49 | 000,000,902 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\FrostWire 5.1.4.lnk
[2011/08/19 17:06:03 | 000,001,070 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\magicJack.lnk
[2011/08/17 10:38:03 | 000,000,284 | ---- | M] () -- C:\WINNT\tasks\AppleSoftwareUpdate.job
[2011/08/10 18:33:05 | 000,441,546 | ---- | M] () -- C:\WINNT\System32\perfh009.dat
[2011/08/10 18:33:05 | 000,071,482 | ---- | M] () -- C:\WINNT\System32\perfc009.dat
[2011/08/09 16:10:50 | 000,001,870 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Play Jewel Quest Mysteries - The Seventh Gate.lnk
[2011/08/09 16:10:50 | 000,001,246 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\More Great Games.lnk
[5 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[3 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/09/05 14:49:52 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\avast! Free Antivirus.lnk
[2011/09/05 14:45:09 | 056,167,608 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\setup_av_free.exe
[2011/09/05 14:00:57 | 000,000,206 | ---- | C] () -- C:\Boot.bak
[2011/09/05 14:00:52 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/09/05 13:57:53 | 000,256,000 | ---- | C] () -- C:\WINNT\PEV.exe
[2011/09/05 13:57:53 | 000,208,896 | ---- | C] () -- C:\WINNT\MBR.exe
[2011/09/05 13:57:53 | 000,098,816 | ---- | C] () -- C:\WINNT\sed.exe
[2011/09/05 13:57:53 | 000,080,412 | ---- | C] () -- C:\WINNT\grep.exe
[2011/09/05 13:57:53 | 000,068,096 | ---- | C] () -- C:\WINNT\zip.exe
[2011/09/05 13:39:06 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\MBR.dat
[2011/08/29 14:00:54 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\bdoinouq.exe
[2011/08/29 13:33:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/25 15:54:28 | 000,006,122 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\rootkitscan.csv
[2011/08/25 11:34:55 | 000,126,112 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\cc_20110825_113451.reg
[2011/08/25 09:37:26 | 000,000,000 | ---- | C] () -- C:\WINNT\2936415324
[2011/08/25 09:28:46 | 000,000,902 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\FrostWire 5.1.4.lnk
[2011/08/09 16:10:50 | 000,001,870 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Play Jewel Quest Mysteries - The Seventh Gate.lnk
[2011/08/09 16:10:50 | 000,001,246 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\More Great Games.lnk
[2011/02/22 17:41:16 | 000,007,168 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/15 20:55:50 | 000,000,000 | ---- | C] () -- C:\WINNT\pcfriend.INI
[2010/12/08 23:22:44 | 000,000,000 | ---- | C] () -- C:\WINNT\Curses.INI
[2010/06/17 11:36:24 | 000,015,420 | -H-- | C] () -- C:\WINNT\System32\mlfcache.dat
[2010/03/29 14:36:06 | 000,085,504 | ---- | C] () -- C:\WINNT\System32\ff_vfw.dll
[2009/12/25 15:16:05 | 000,000,478 | ---- | C] () -- C:\Program Files\Shortcut to FrostWire.lnk
[2009/12/02 19:23:43 | 000,004,096 | ---- | C] () -- C:\WINNT\d3dx.dat
[2009/09/25 11:21:35 | 000,000,049 | ---- | C] () -- C:\WINNT\lexstat.ini
[2009/04/30 23:39:36 | 000,082,289 | ---- | C] () -- C:\WINNT\System32\lvcoinst.ini
[2009/04/13 13:25:51 | 000,000,138 | ---- | C] () -- C:\WINNT\wininit.ini
[2009/03/29 20:21:23 | 000,000,021 | ---- | C] () -- C:\WINNT\atid.ini
[2009/03/08 19:21:35 | 000,000,445 | ---- | C] () -- C:\WINNT\dellstat.ini
[2009/03/06 08:12:36 | 000,004,569 | ---- | C] () -- C:\WINNT\System32\secupd.dat
[2009/03/05 20:44:04 | 000,002,048 | --S- | C] () -- C:\WINNT\bootstat.dat
[2009/03/05 20:32:42 | 000,021,640 | ---- | C] () -- C:\WINNT\System32\emptyregdb.dat
[2009/03/05 15:00:01 | 000,004,073 | ---- | C] () -- C:\WINNT\ODBCINST.INI
[2009/03/05 14:58:33 | 000,110,192 | ---- | C] () -- C:\WINNT\System32\FNTCACHE.DAT
[2008/03/25 13:59:04 | 000,021,249 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Outlook.NK2
[2008/02/25 18:03:48 | 000,193,742 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Owner.wab~
[2008/02/25 17:56:25 | 000,213,882 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Owner.wab
[2003/11/20 17:39:58 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\px.ini
[2003/07/16 16:54:55 | 000,004,594 | ---- | C] () -- C:\WINNT\System32\oembios.dat
[2003/07/16 16:54:54 | 013,107,200 | ---- | C] () -- C:\WINNT\System32\oembios.bin
[2003/07/16 16:41:25 | 000,441,546 | ---- | C] () -- C:\WINNT\System32\perfh009.dat
[2003/07/16 16:41:25 | 000,272,128 | ---- | C] () -- C:\WINNT\System32\perfi009.dat
[2003/07/16 16:41:23 | 000,028,626 | ---- | C] () -- C:\WINNT\System32\perfd009.dat
[2003/07/16 16:41:21 | 000,071,482 | ---- | C] () -- C:\WINNT\System32\perfc009.dat
[2003/07/16 16:39:07 | 000,000,741 | ---- | C] () -- C:\WINNT\System32\noise.dat
[2003/07/16 16:33:50 | 000,673,088 | ---- | C] () -- C:\WINNT\System32\mlang.dat
[2003/07/16 16:33:39 | 000,046,258 | ---- | C] () -- C:\WINNT\System32\mib.bin
[2003/07/16 16:27:41 | 000,218,003 | ---- | C] () -- C:\WINNT\System32\dssec.dat
[2003/07/16 16:26:37 | 000,001,804 | ---- | C] () -- C:\WINNT\System32\dcache.bin
========== LOP Check ==========
[2009/03/29 20:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\acccore
[2010/05/11 19:58:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\AIM
[2011/09/05 14:47:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\AVAST Software
[2010/11/22 15:28:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\avg9
[2011/08/09 16:02:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Big Fish Games
[2011/03/02 15:20:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonBJ
[2011/03/02 15:59:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonEPP
[2011/04/15 11:20:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJ
[2011/03/02 18:55:28 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEGV
[2011/09/04 09:48:44 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEPPEX
[2011/03/02 15:59:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEPPEX2
[2011/03/02 15:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJMSetup
[2011/03/15 14:41:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJMyPrinter
[2011/09/04 10:19:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJPLM
[2011/04/15 11:19:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJScan
[2011/03/02 15:59:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJSolutionMenuEX
[2011/03/02 15:25:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJWSpt
[2009/12/07 20:05:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Christmasville
[2010/07/15 15:17:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\com.comcast.access
[2010/11/22 15:39:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Common Files
[2011/04/21 20:50:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Exorcist DS 1
[2011/04/20 20:14:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\GameHouse
[2009/11/13 16:32:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Gogii
[2010/12/25 10:54:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\magicJack
[2009/10/27 18:45:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Merscom
[2011/04/13 20:43:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\MumboJumbo
[2011/03/31 20:10:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\NeoEdge Networks
[2011/09/04 22:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\TEMP
[2011/03/31 20:12:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\TERMINAL Studio
[2011/09/05 18:46:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Viewpoint
[2011/04/20 20:14:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Zylom
[2010/06/17 11:29:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/03/30 21:33:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\acccore
[2009/12/02 19:24:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Aisle 5 Games, Inc
[2011/07/22 21:35:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Artogon
[2011/01/29 20:18:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Big Fish Games
[2011/09/04 10:12:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Canon
[2011/04/30 09:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Canon Easy-WebPrint EX
[2009/12/06 20:30:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\cerasus.media
[2010/07/15 15:43:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\com.comcast.access.13A1FA90F0FC9DC009FB0956ADD0F13F8608561B.1
[2011/05/31 20:57:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\EnchantedCavern
[2011/01/31 22:02:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\ERS Game Studios
[2009/09/20 08:17:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\FoxPlayerAIR.01F2E49DE175CC541F416F2DF78BDD5E63AD0096.1
[2011/06/29 19:45:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Friday's games
[2011/08/25 09:54:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\FrostWire
[2011/01/06 20:09:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\GameHousev1002
[2010/01/04 16:29:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\GhostFleet
[2011/07/17 18:48:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Jewel Match 3
[2010/11/26 20:49:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Lazy Turtle Games
[2009/04/14 19:04:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Leadertech
[2009/07/25 21:47:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Magic Academy
[2009/10/27 18:45:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Merscom
[2011/08/19 17:06:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\mjusbsp
[2010/02/07 17:01:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\uniblue
[2011/06/29 20:12:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\URSE Games
[2010/03/29 14:36:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\WeatherBug
[2011/09/05 15:47:10 | 000,000,418 | -H-- | M] () -- C:\WINNT\Tasks\User_Feed_Synchronization-{54D4DDA0-6D57-415C-9F9D-F0DA38B79C92}.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2008/02/25 13:57:44 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/03/06 17:05:50 | 000,000,206 | ---- | M] () -- C:\Boot.bak
[2011/09/05 14:00:57 | 000,000,323 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/09/05 14:34:15 | 000,019,675 | ---- | M] () -- C:\ComboFix.txt
[2008/02/25 13:57:44 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/02/25 13:57:44 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/02/13 09:38:13 | 000,002,658 | -H-- | M] () -- C:\IPH.PH
[2008/03/27 19:10:43 | 000,000,064 | ---- | M] () -- C:\jetscan.log
[2008/07/30 17:28:15 | 000,006,769 | ---- | M] () -- C:\lvcoinst.log
[2008/04/11 19:57:45 | 000,000,200 | ---- | M] () -- C:\lxbm.log
[2008/02/25 13:57:44 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/07/09 18:51:37 | 000,000,999 | ---- | M] () -- C:\net_save.dna
[2011/01/19 14:06:23 | 000,000,439 | ---- | M] () -- C:\nsinst.log
[2009/03/06 08:21:44 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/03/06 14:03:22 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/09/05 14:24:13 | 2415,919,104 | -HS- | M] () -- C:\pagefile.sys
[2010/04/25 10:38:10 | 000,006,179 | ---- | M] () -- C:\plaxo.log
[2010/02/10 12:08:31 | 000,001,292 | ---- | M] () -- C:\Player Loader_log.txt
[2009/02/16 21:11:23 | 000,000,959 | ---- | M] () -- C:\rollback.ini
[2008/02/25 17:18:19 | 000,000,168 | ---- | M] () -- C:\setupfax.log
[2011/08/31 16:29:52 | 000,041,878 | ---- | M] () -- C:\TDSSKiller.2.5.17.0_31.08.2011_16.25.09_log.txt
< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINNT\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINNT\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINNT\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINNT\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2009/03/05 20:35:44 | 000,000,067 | -HS- | M] () -- C:\WINNT\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2010/04/07 06:00:00 | 000,027,648 | ---- | M] (CANON INC.) -- C:\WINNT\system32\spool\prtprocs\w32x86\CNMPDAE.DLL
[2010/04/07 06:00:00 | 000,073,216 | ---- | M] (CANON INC.) -- C:\WINNT\system32\spool\prtprocs\w32x86\CNMPPAE.DLL
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
[2011/07/04 07:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINNT\avastSS.scr
[5 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
[2009/03/09 14:03:46 | 000,001,738 | -H-- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\LastFlashConfig.WFC
< %PROGRAMFILES%\*.* >
[2009/03/27 09:00:22 | 013,440,584 | ---- | M] (AOL LLC.) -- C:\Program Files\Install_AIM.exe
[2009/12/25 15:16:05 | 000,000,478 | ---- | M] () -- C:\Program Files\Shortcut to FrostWire.lnk
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2009/03/05
OTL logfile created on: 9/5/2011 6:56:26 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
766.00 Mb Total Physical Memory | 271.61 Mb Available Physical Memory | 35.46% Memory free
2.96 Gb Paging File | 2.55 Gb Available in Paging File | 86.28% Paging File free
Paging file location(s): C:\pagefile.sys 2304 2304 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 13.99 Gb Free Space | 37.58% Space Free | Partition Type: NTFS
Computer Name: BLACKIE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/09/05 18:51:35 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
PRC - [2011/08/06 21:34:47 | 000,140,952 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/07/04 07:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2010/04/05 15:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINNT\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2011/09/05 05:08:25 | 001,384,960 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11090500\algo.dll
MOD - [2011/09/05 04:17:50 | 000,208,544 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11090500\aswRep.dll
MOD - [2011/08/11 18:01:19 | 000,212,992 | ---- | M] () -- C:\WINNT\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\70a1400affdc775d7c7398e036359286\System.ServiceProcess.ni.dll
MOD - [2011/08/10 18:34:46 | 007,950,848 | ---- | M] () -- C:\WINNT\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll
MOD - [2011/08/10 18:32:36 | 002,048,000 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2011/08/10 18:32:33 | 003,182,592 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2011/08/10 18:32:26 | 002,933,248 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2011/08/10 18:32:25 | 000,425,984 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2011/08/10 18:31:58 | 000,626,688 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2011/08/10 18:31:56 | 000,303,104 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2011/08/10 18:31:49 | 000,258,048 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
MOD - [2011/08/10 18:31:45 | 000,261,632 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2011/08/10 18:31:31 | 000,114,688 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
MOD - [2011/08/10 18:30:59 | 005,025,792 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2011/06/26 18:14:38 | 011,490,816 | ---- | M] () -- C:\WINNT\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2011/02/26 16:49:16 | 000,854,016 | ---- | M] () -- C:\WINNT\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll
MOD - [2011/02/26 16:49:11 | 000,270,336 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\log4net\1.2.10.0__1b44e1d426115821\log4net.dll
MOD - [2011/02/26 16:49:09 | 000,409,960 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2011/02/26 16:49:07 | 000,476,520 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2011/02/26 16:48:55 | 000,046,952 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2011/02/26 16:48:54 | 000,023,912 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.dll
MOD - [2011/02/26 16:48:54 | 000,018,792 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2011/02/26 16:48:54 | 000,012,136 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract.dll
MOD - [2011/02/26 16:48:53 | 000,421,224 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2011/02/26 16:48:52 | 000,269,672 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\3.1.26.0__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2011/02/26 16:48:51 | 000,120,168 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2011/02/26 16:48:51 | 000,070,504 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2011/02/26 16:48:50 | 000,121,704 | ---- | M] () -- C:\WINNT\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2010/04/05 15:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
MOD - [2008/04/13 20:11:59 | 000,014,336 | ---- | M] () -- C:\WINNT\system32\msdmo.dll
MOD - [2008/04/13 20:11:51 | 000,059,904 | ---- | M] () -- C:\WINNT\system32\devenum.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- -- (wuauserv)
SRV - File not found [Disabled | Stopped] -- -- (AppMgmt)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010/04/05 15:55:01 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINNT\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/07/04 07:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINNT\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/07/04 07:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/07/04 07:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/07/04 07:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINNT\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/07/04 07:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/07/04 07:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINNT\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/07/04 07:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINNT\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/05/20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/04/30 23:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2003/08/29 05:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\BCMSM.sys -- (BCMModem)
DRV - [2003/06/30 19:11:52 | 000,043,136 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2001/08/22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINNT\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/?icid=acm50mtmhpunauthgreeting#
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-823518204-2025429265-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINNT\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINNT\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Move Networks\plugins\npqmp071706000001.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Move Networks\plugins\npqmp071706000001.dll (Move Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\
O1 HOSTS File: ([2011/09/05 14:24:46 | 000,000,027 | ---- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-823518204-2025429265-839522115-1003..\Run: [Aim] C:\Program Files\AIM\aim.exe (AOL Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-823518204-2025429265-839522115-1003\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} https://lowes.2020.net/Core/Player/2020PlayerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236304913634 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1236305120181 (MUWebControl Class)
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} http://www.gamehouse.com/games/gamehouse/ghplayer.cab (GameHouse Games Player)
O16 - DPF: {775879E2-7309-4619-BB02-AADE41F4B690} http://webgames.d.tmsrv.com/c=51ebb...ronicles/dreamchronicles/dreamweb.1.0.0.9.cab (CPlayFirstdreamControl Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://dl8-cdn-01.sun.com/s/ESD7/JS...5/&filename=jinstall-6u12-windows-i586-jc.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: PackageCab http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC6DEB69-355C-480C-9408-580DCD42E9C3}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINNT\system32\userinit.exe) - C:\WINNT\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINNT\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/25 13:57:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: wuauserv - File not found
Drivers32: msacm.iac2 - C:\WINNT\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINNT\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINNT\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINNT\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINNT\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINNT\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINNT\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINNT\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINNT\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINNT\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave - C:\WINNT\System32\serwvdrv.dll (Microsoft Corporation)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/09/05 18:51:19 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
[2011/09/05 15:59:07 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/09/05 14:49:51 | 000,019,544 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswFsBlk.sys
[2011/09/05 14:49:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\avast! Free Antivirus
[2011/09/05 14:49:50 | 000,309,848 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswSP.sys
[2011/09/05 14:49:45 | 000,025,432 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswRdr.sys
[2011/09/05 14:49:44 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswSnx.sys
[2011/09/05 14:49:44 | 000,043,608 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswTdi.sys
[2011/09/05 14:49:42 | 000,102,616 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswmon2.sys
[2011/09/05 14:49:42 | 000,096,344 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aswmon.sys
[2011/09/05 14:49:41 | 000,030,808 | ---- | C] (AVAST Software) -- C:\WINNT\System32\drivers\aavmker4.sys
[2011/09/05 14:48:02 | 000,040,112 | ---- | C] (AVAST Software) -- C:\WINNT\avastSS.scr
[2011/09/05 14:48:00 | 000,199,304 | ---- | C] (AVAST Software) -- C:\WINNT\System32\aswBoot.exe
[2011/09/05 14:47:11 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011/09/05 14:47:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\AVAST Software
[2011/09/05 14:00:47 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/09/05 13:57:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINNT\SWREG.exe
[2011/09/05 13:57:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINNT\SWSC.exe
[2011/09/05 13:57:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINNT\SWXCACLS.exe
[2011/09/05 13:57:53 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINNT\NIRCMD.exe
[2011/09/05 13:56:48 | 000,000,000 | ---D | C] -- C:\WINNT\ERDNT
[2011/09/05 13:56:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/09/05 13:40:36 | 004,195,245 | R--- | C] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
[2011/09/05 13:03:08 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.exe
[2011/09/05 11:07:26 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Recent
[2011/09/04 21:31:23 | 001,249,696 | ---- | C] (Alactro LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\BestVideoDownloaderSetup.exe
[2011/09/04 09:48:43 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEPPEX
[2011/09/04 09:48:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\Canon Easy-PhotoPrint EX
[2011/08/31 16:24:20 | 001,406,768 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\tdsskiller.exe
[2011/08/29 15:18:28 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\dds.scr
[2011/08/29 13:34:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Malwarebytes
[2011/08/29 13:33:59 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbamswissarmy.sys
[2011/08/29 13:33:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/29 13:33:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\Malwarebytes
[2011/08/29 13:33:55 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbam.sys
[2011/08/29 13:33:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/29 13:32:09 | 009,466,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\mbam-setup-1.51.1.1800.exe
[2011/08/25 09:29:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\.frostwire5
[2011/08/25 09:28:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Start Menu\Programs\FrostWire 5
[2011/08/25 09:27:37 | 000,000,000 | ---D | C] -- C:\Program Files\FrostWire 5
[2011/08/09 16:11:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\BigFish
[2011/08/09 16:11:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Application Data\BigFish
[2011/08/09 16:09:39 | 000,000,000 | ---D | C] -- C:\Program Files\Jewel Quest Mysteries - The Seventh Gate
[2011/08/09 16:09:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\Jewel Quest Mysteries - The Seventh Gate
[2009/03/27 08:59:52 | 013,440,584 | ---- | C] (AOL LLC.) -- C:\Program Files\Install_AIM.exe
[5 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[3 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/09/05 18:51:35 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
[2011/09/05 18:40:00 | 000,000,886 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/05 18:27:44 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/09/05 15:47:10 | 000,000,418 | -H-- | M] () -- C:\WINNT\tasks\User_Feed_Synchronization-{54D4DDA0-6D57-415C-9F9D-F0DA38B79C92}.job
[2011/09/05 14:49:52 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\avast! Free Antivirus.lnk
[2011/09/05 14:49:42 | 000,002,625 | ---- | M] () -- C:\WINNT\System32\CONFIG.NT
[2011/09/05 14:45:34 | 056,167,608 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\setup_av_free.exe
[2011/09/05 14:24:55 | 000,000,868 | ---- | M] () -- C:\WINNT\tasks\Google Software Updater.job
[2011/09/05 14:24:46 | 000,000,027 | ---- | M] () -- C:\WINNT\System32\drivers\etc\hosts
[2011/09/05 14:24:31 | 000,000,882 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/05 14:24:23 | 000,002,048 | --S- | M] () -- C:\WINNT\bootstat.dat
[2011/09/05 14:00:57 | 000,000,323 | RHS- | M] () -- C:\boot.ini
[2011/09/05 13:57:09 | 004,195,245 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
[2011/09/05 13:39:06 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\MBR.dat
[2011/09/05 13:03:27 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.exe
[2011/09/04 21:31:30 | 001,249,696 | ---- | M] (Alactro LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\BestVideoDownloaderSetup.exe
[2011/09/02 18:45:37 | 000,002,206 | ---- | M] () -- C:\WINNT\System32\wpa.dbl
[2011/09/01 18:35:00 | 000,158,653 | ---- | M] () -- C:\WINNT\System32\drivers\AVG\iavichjg.avm
[2011/08/31 16:24:25 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\tdsskiller.exe
[2011/08/29 15:18:29 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\dds.scr
[2011/08/29 14:00:56 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\bdoinouq.exe
[2011/08/29 13:33:59 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/29 13:32:11 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\mbam-setup-1.51.1.1800.exe
[2011/08/29 09:49:00 | 000,006,122 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\rootkitscan.csv
[2011/08/25 11:34:59 | 000,126,112 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\cc_20110825_113451.reg
[2011/08/25 09:37:26 | 000,000,000 | ---- | M] () -- C:\WINNT\2936415324
[2011/08/25 09:28:49 | 000,000,902 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\FrostWire 5.1.4.lnk
[2011/08/19 17:06:03 | 000,001,070 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\magicJack.lnk
[2011/08/17 10:38:03 | 000,000,284 | ---- | M] () -- C:\WINNT\tasks\AppleSoftwareUpdate.job
[2011/08/10 18:33:05 | 000,441,546 | ---- | M] () -- C:\WINNT\System32\perfh009.dat
[2011/08/10 18:33:05 | 000,071,482 | ---- | M] () -- C:\WINNT\System32\perfc009.dat
[2011/08/09 16:10:50 | 000,001,870 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Play Jewel Quest Mysteries - The Seventh Gate.lnk
[2011/08/09 16:10:50 | 000,001,246 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Desktop\More Great Games.lnk
[5 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[3 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/09/05 14:49:52 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\avast! Free Antivirus.lnk
[2011/09/05 14:45:09 | 056,167,608 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\setup_av_free.exe
[2011/09/05 14:00:57 | 000,000,206 | ---- | C] () -- C:\Boot.bak
[2011/09/05 14:00:52 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/09/05 13:57:53 | 000,256,000 | ---- | C] () -- C:\WINNT\PEV.exe
[2011/09/05 13:57:53 | 000,208,896 | ---- | C] () -- C:\WINNT\MBR.exe
[2011/09/05 13:57:53 | 000,098,816 | ---- | C] () -- C:\WINNT\sed.exe
[2011/09/05 13:57:53 | 000,080,412 | ---- | C] () -- C:\WINNT\grep.exe
[2011/09/05 13:57:53 | 000,068,096 | ---- | C] () -- C:\WINNT\zip.exe
[2011/09/05 13:39:06 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\MBR.dat
[2011/08/29 14:00:54 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\bdoinouq.exe
[2011/08/29 13:33:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/25 15:54:28 | 000,006,122 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\rootkitscan.csv
[2011/08/25 11:34:55 | 000,126,112 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\cc_20110825_113451.reg
[2011/08/25 09:37:26 | 000,000,000 | ---- | C] () -- C:\WINNT\2936415324
[2011/08/25 09:28:46 | 000,000,902 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\FrostWire 5.1.4.lnk
[2011/08/09 16:10:50 | 000,001,870 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\Play Jewel Quest Mysteries - The Seventh Gate.lnk
[2011/08/09 16:10:50 | 000,001,246 | ---- | C] () -- C:\Documents and Settings\All Users.WINNT\Desktop\More Great Games.lnk
[2011/02/22 17:41:16 | 000,007,168 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/15 20:55:50 | 000,000,000 | ---- | C] () -- C:\WINNT\pcfriend.INI
[2010/12/08 23:22:44 | 000,000,000 | ---- | C] () -- C:\WINNT\Curses.INI
[2010/06/17 11:36:24 | 000,015,420 | -H-- | C] () -- C:\WINNT\System32\mlfcache.dat
[2010/03/29 14:36:06 | 000,085,504 | ---- | C] () -- C:\WINNT\System32\ff_vfw.dll
[2009/12/25 15:16:05 | 000,000,478 | ---- | C] () -- C:\Program Files\Shortcut to FrostWire.lnk
[2009/12/02 19:23:43 | 000,004,096 | ---- | C] () -- C:\WINNT\d3dx.dat
[2009/09/25 11:21:35 | 000,000,049 | ---- | C] () -- C:\WINNT\lexstat.ini
[2009/04/30 23:39:36 | 000,082,289 | ---- | C] () -- C:\WINNT\System32\lvcoinst.ini
[2009/04/13 13:25:51 | 000,000,138 | ---- | C] () -- C:\WINNT\wininit.ini
[2009/03/29 20:21:23 | 000,000,021 | ---- | C] () -- C:\WINNT\atid.ini
[2009/03/08 19:21:35 | 000,000,445 | ---- | C] () -- C:\WINNT\dellstat.ini
[2009/03/06 08:12:36 | 000,004,569 | ---- | C] () -- C:\WINNT\System32\secupd.dat
[2009/03/05 20:44:04 | 000,002,048 | --S- | C] () -- C:\WINNT\bootstat.dat
[2009/03/05 20:32:42 | 000,021,640 | ---- | C] () -- C:\WINNT\System32\emptyregdb.dat
[2009/03/05 15:00:01 | 000,004,073 | ---- | C] () -- C:\WINNT\ODBCINST.INI
[2009/03/05 14:58:33 | 000,110,192 | ---- | C] () -- C:\WINNT\System32\FNTCACHE.DAT
[2008/03/25 13:59:04 | 000,021,249 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Outlook.NK2
[2008/02/25 18:03:48 | 000,193,742 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Owner.wab~
[2008/02/25 17:56:25 | 000,213,882 | ---- | C] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Owner.wab
[2003/11/20 17:39:58 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\px.ini
[2003/07/16 16:54:55 | 000,004,594 | ---- | C] () -- C:\WINNT\System32\oembios.dat
[2003/07/16 16:54:54 | 013,107,200 | ---- | C] () -- C:\WINNT\System32\oembios.bin
[2003/07/16 16:41:25 | 000,441,546 | ---- | C] () -- C:\WINNT\System32\perfh009.dat
[2003/07/16 16:41:25 | 000,272,128 | ---- | C] () -- C:\WINNT\System32\perfi009.dat
[2003/07/16 16:41:23 | 000,028,626 | ---- | C] () -- C:\WINNT\System32\perfd009.dat
[2003/07/16 16:41:21 | 000,071,482 | ---- | C] () -- C:\WINNT\System32\perfc009.dat
[2003/07/16 16:39:07 | 000,000,741 | ---- | C] () -- C:\WINNT\System32\noise.dat
[2003/07/16 16:33:50 | 000,673,088 | ---- | C] () -- C:\WINNT\System32\mlang.dat
[2003/07/16 16:33:39 | 000,046,258 | ---- | C] () -- C:\WINNT\System32\mib.bin
[2003/07/16 16:27:41 | 000,218,003 | ---- | C] () -- C:\WINNT\System32\dssec.dat
[2003/07/16 16:26:37 | 000,001,804 | ---- | C] () -- C:\WINNT\System32\dcache.bin
========== LOP Check ==========
[2009/03/29 20:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\acccore
[2010/05/11 19:58:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\AIM
[2011/09/05 14:47:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\AVAST Software
[2010/11/22 15:28:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\avg9
[2011/08/09 16:02:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Big Fish Games
[2011/03/02 15:20:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonBJ
[2011/03/02 15:59:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonEPP
[2011/04/15 11:20:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJ
[2011/03/02 18:55:28 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEGV
[2011/09/04 09:48:44 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEPPEX
[2011/03/02 15:59:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJEPPEX2
[2011/03/02 15:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJMSetup
[2011/03/15 14:41:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJMyPrinter
[2011/09/04 10:19:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJPLM
[2011/04/15 11:19:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJScan
[2011/03/02 15:59:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJSolutionMenuEX
[2011/03/02 15:25:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\CanonIJWSpt
[2009/12/07 20:05:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Christmasville
[2010/07/15 15:17:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\com.comcast.access
[2010/11/22 15:39:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Common Files
[2011/04/21 20:50:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Exorcist DS 1
[2011/04/20 20:14:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\GameHouse
[2009/11/13 16:32:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Gogii
[2010/12/25 10:54:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\magicJack
[2009/10/27 18:45:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Merscom
[2011/04/13 20:43:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\MumboJumbo
[2011/03/31 20:10:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\NeoEdge Networks
[2011/09/04 22:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\TEMP
[2011/03/31 20:12:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\TERMINAL Studio
[2011/09/05 18:46:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Viewpoint
[2011/04/20 20:14:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\Zylom
[2010/06/17 11:29:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINNT\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/03/30 21:33:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\acccore
[2009/12/02 19:24:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Aisle 5 Games, Inc
[2011/07/22 21:35:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Artogon
[2011/01/29 20:18:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Big Fish Games
[2011/09/04 10:12:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Canon
[2011/04/30 09:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Canon Easy-WebPrint EX
[2009/12/06 20:30:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\cerasus.media
[2010/07/15 15:43:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\com.comcast.access.13A1FA90F0FC9DC009FB0956ADD0F13F8608561B.1
[2011/05/31 20:57:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\EnchantedCavern
[2011/01/31 22:02:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\ERS Game Studios
[2009/09/20 08:17:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\FoxPlayerAIR.01F2E49DE175CC541F416F2DF78BDD5E63AD0096.1
[2011/06/29 19:45:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Friday's games
[2011/08/25 09:54:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\FrostWire
[2011/01/06 20:09:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\GameHousev1002
[2010/01/04 16:29:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\GhostFleet
[2011/07/17 18:48:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Jewel Match 3
[2010/11/26 20:49:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Lazy Turtle Games
[2009/04/14 19:04:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Leadertech
[2009/07/25 21:47:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Magic Academy
[2009/10/27 18:45:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Merscom
[2011/08/19 17:06:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\mjusbsp
[2010/02/07 17:01:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\uniblue
[2011/06/29 20:12:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\URSE Games
[2010/03/29 14:36:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\WeatherBug
[2011/09/05 15:47:10 | 000,000,418 | -H-- | M] () -- C:\WINNT\Tasks\User_Feed_Synchronization-{54D4DDA0-6D57-415C-9F9D-F0DA38B79C92}.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2008/02/25 13:57:44 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/03/06 17:05:50 | 000,000,206 | ---- | M] () -- C:\Boot.bak
[2011/09/05 14:00:57 | 000,000,323 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/09/05 14:34:15 | 000,019,675 | ---- | M] () -- C:\ComboFix.txt
[2008/02/25 13:57:44 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/02/25 13:57:44 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/02/13 09:38:13 | 000,002,658 | -H-- | M] () -- C:\IPH.PH
[2008/03/27 19:10:43 | 000,000,064 | ---- | M] () -- C:\jetscan.log
[2008/07/30 17:28:15 | 000,006,769 | ---- | M] () -- C:\lvcoinst.log
[2008/04/11 19:57:45 | 000,000,200 | ---- | M] () -- C:\lxbm.log
[2008/02/25 13:57:44 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/07/09 18:51:37 | 000,000,999 | ---- | M] () -- C:\net_save.dna
[2011/01/19 14:06:23 | 000,000,439 | ---- | M] () -- C:\nsinst.log
[2009/03/06 08:21:44 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/03/06 14:03:22 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/09/05 14:24:13 | 2415,919,104 | -HS- | M] () -- C:\pagefile.sys
[2010/04/25 10:38:10 | 000,006,179 | ---- | M] () -- C:\plaxo.log
[2010/02/10 12:08:31 | 000,001,292 | ---- | M] () -- C:\Player Loader_log.txt
[2009/02/16 21:11:23 | 000,000,959 | ---- | M] () -- C:\rollback.ini
[2008/02/25 17:18:19 | 000,000,168 | ---- | M] () -- C:\setupfax.log
[2011/08/31 16:29:52 | 000,041,878 | ---- | M] () -- C:\TDSSKiller.2.5.17.0_31.08.2011_16.25.09_log.txt
< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINNT\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINNT\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINNT\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINNT\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2009/03/05 20:35:44 | 000,000,067 | -HS- | M] () -- C:\WINNT\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2010/04/07 06:00:00 | 000,027,648 | ---- | M] (CANON INC.) -- C:\WINNT\system32\spool\prtprocs\w32x86\CNMPDAE.DLL
[2010/04/07 06:00:00 | 000,073,216 | ---- | M] (CANON INC.) -- C:\WINNT\system32\spool\prtprocs\w32x86\CNMPPAE.DLL
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
[2011/07/04 07:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINNT\avastSS.scr
[5 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
[2009/03/09 14:03:46 | 000,001,738 | -H-- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\LastFlashConfig.WFC
< %PROGRAMFILES%\*.* >
[2009/03/27 09:00:22 | 013,440,584 | ---- | M] (AOL LLC.) -- C:\Program Files\Install_AIM.exe
[2009/12/25 15:16:05 | 000,000,478 | ---- | M] () -- C:\Program Files\Shortcut to FrostWire.lnk
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2009/03/05
slowride71
Posts: 24 +0
14:57:32 | 000,094,208 | ---- | M] () -- C:\WINNT\System32\config\default.sav
[2009/03/05 14:57:32 | 000,602,112 | ---- | M] () -- C:\WINNT\System32\config\software.sav
[2009/03/05 14:57:32 | 000,389,120 | ---- | M] () -- C:\WINNT\System32\config\system.sav
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/04/08 22:11:42 | 000,000,212 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Start Menu\Create & Print Home.url
[2009/03/06 14:11:16 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users.WINNT\Start Menu\desktop.ini
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/03/06 15:18:35 | 000,000,175 | -HS- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/03/05 20:50:07 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
< %USERPROFILE%\Desktop\*.exe >
[2011/09/05 13:03:27 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.exe
[2011/08/29 14:00:56 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\bdoinouq.exe
[2011/09/04 21:31:30 | 001,249,696 | ---- | M] (Alactro LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\BestVideoDownloaderSetup.exe
[2011/09/05 13:57:09 | 004,195,245 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
[2011/08/29 13:32:11 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\mbam-setup-1.51.1.1800.exe
[2011/09/05 18:51:35 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
[2011/09/05 14:45:34 | 056,167,608 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\setup_av_free.exe
[2011/08/31 16:24:25 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\tdsskiller.exe
[2009/03/24 17:35:40 | 007,882,936 | ---- | M] (magicJack L.P.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\upgrade.exemagic jack.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
[2011/06/03 21:47:47 | 000,208,928 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p107748926_s1_l1.exe
[2010/03/13 23:15:55 | 000,207,888 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p67008553_s1_l1.exe
[2011/02/03 22:34:28 | 000,208,072 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p95917157_s1_l1.exe
[2011/03/11 21:58:56 | 000,208,928 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p99442785_s1_l1.exe
[2008/09/24 19:37:45 | 002,928,600 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\ccleaner new.exe
[2009/07/10 19:52:28 | 003,252,640 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\ccsetup221.exe
[2009/12/25 15:17:59 | 009,636,184 | ---- | M] (FrostWire, LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\frostwire-4.18.5.windows.exe
[2010/06/17 11:17:38 | 096,768,824 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\iTunesSetup.exe
[2008/08/10 17:45:30 | 015,261,368 | ---- | M] (LightScribe ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\lightScribeSimpleLabeler-1.4.128.1.exe
[2008/08/10 17:50:45 | 008,783,904 | ---- | M] (LightScribe ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\LS_Update_1.14.19.1_.exe
[2010/04/25 10:36:07 | 003,414,080 | ---- | M] (Plaxo, Inc.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\PlaxoInstall_en.exe
[2008/11/13 20:38:43 | 008,733,344 | ---- | M] (magicJack L.P.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\upgrade.exe
[2011/02/13 11:57:53 | 002,216,056 | ---- | M] (W3i, LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\VLC_32.exe
[2010/02/07 17:12:33 | 025,740,144 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\wmp11-windowsxp-x86-enu.exe
< %USERPROFILE%\*.exe >
< %systemroot%\ADDINS\*.* >
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
[2009/03/06 15:18:35 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Favorites\Desktop.ini
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
< dir /b "%systemroot%\*.exe" | find /i " " /c >
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
[2011/09/05 18:49:32 | 000,065,536 | -HS- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Cookies\index.dat
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINNT\inf\unregmp2.exe
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.* >
[2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2003/07/16 16:32:13 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/08/20 13:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/08/20 13:32:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 20:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2003/07/16 16:38:45 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2003/07/16 16:38:46 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2003/07/16 16:40:43 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2002/08/20 13:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/07/17 12:41:06 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< >
========== Alternate Data Streams ==========
@Alternate Data Stream - 240 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMPDF112BD
@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:EB4FEEF5
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:C22674B6
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:4CA05B44
@Alternate Data Stream - 223 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:A02025CE
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:1709732A
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:8E5EA40F
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:57B374AB
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:9BAC4211
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:9E4F05ED
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:436BE28C
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:A4E7D25F
< End of report >
[2009/03/05 14:57:32 | 000,602,112 | ---- | M] () -- C:\WINNT\System32\config\software.sav
[2009/03/05 14:57:32 | 000,389,120 | ---- | M] () -- C:\WINNT\System32\config\system.sav
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/04/08 22:11:42 | 000,000,212 | ---- | M] () -- C:\Documents and Settings\All Users.WINNT\Start Menu\Create & Print Home.url
[2009/03/06 14:11:16 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users.WINNT\Start Menu\desktop.ini
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/03/06 15:18:35 | 000,000,175 | -HS- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/03/05 20:50:07 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
< %USERPROFILE%\Desktop\*.exe >
[2011/09/05 13:03:27 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\aswMBR.exe
[2011/08/29 14:00:56 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\bdoinouq.exe
[2011/09/04 21:31:30 | 001,249,696 | ---- | M] (Alactro LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\BestVideoDownloaderSetup.exe
[2011/09/05 13:57:09 | 004,195,245 | R--- | M] (Swearware) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\ComboFix.exe
[2011/08/29 13:32:11 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\mbam-setup-1.51.1.1800.exe
[2011/09/05 18:51:35 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\OTL.exe
[2011/09/05 14:45:34 | 056,167,608 | ---- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\setup_av_free.exe
[2011/08/31 16:24:25 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\tdsskiller.exe
[2009/03/24 17:35:40 | 007,882,936 | ---- | M] (magicJack L.P.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Desktop\upgrade.exemagic jack.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
[2011/06/03 21:47:47 | 000,208,928 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p107748926_s1_l1.exe
[2010/03/13 23:15:55 | 000,207,888 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p67008553_s1_l1.exe
[2011/02/03 22:34:28 | 000,208,072 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p95917157_s1_l1.exe
[2011/03/11 21:58:56 | 000,208,928 | ---- | M] (Big Fish Games) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\bigfishgames_p99442785_s1_l1.exe
[2008/09/24 19:37:45 | 002,928,600 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\ccleaner new.exe
[2009/07/10 19:52:28 | 003,252,640 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\ccsetup221.exe
[2009/12/25 15:17:59 | 009,636,184 | ---- | M] (FrostWire, LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\frostwire-4.18.5.windows.exe
[2010/06/17 11:17:38 | 096,768,824 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\iTunesSetup.exe
[2008/08/10 17:45:30 | 015,261,368 | ---- | M] (LightScribe ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\lightScribeSimpleLabeler-1.4.128.1.exe
[2008/08/10 17:50:45 | 008,783,904 | ---- | M] (LightScribe ) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\LS_Update_1.14.19.1_.exe
[2010/04/25 10:36:07 | 003,414,080 | ---- | M] (Plaxo, Inc.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\PlaxoInstall_en.exe
[2008/11/13 20:38:43 | 008,733,344 | ---- | M] (magicJack L.P.) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\upgrade.exe
[2011/02/13 11:57:53 | 002,216,056 | ---- | M] (W3i, LLC) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\VLC_32.exe
[2010/02/07 17:12:33 | 025,740,144 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\My Documents\wmp11-windowsxp-x86-enu.exe
< %USERPROFILE%\*.exe >
< %systemroot%\ADDINS\*.* >
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
[2009/03/06 15:18:35 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Favorites\Desktop.ini
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
< dir /b "%systemroot%\*.exe" | find /i " " /c >
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
[2011/09/05 18:49:32 | 000,065,536 | -HS- | M] () -- C:\Documents and Settings\Owner.HOME-5NR1RMGI5L\Cookies\index.dat
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINNT\inf\unregmp2.exe
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.* >
[2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2003/07/16 16:32:13 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/08/20 13:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/08/20 13:32:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 20:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2003/07/16 16:38:45 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2003/07/16 16:38:46 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2003/07/16 16:40:43 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2002/08/20 13:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/07/17 12:41:06 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< >
========== Alternate Data Streams ==========
@Alternate Data Stream - 240 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP
DF112BD@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:EB4FEEF5
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:C22674B6
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:4CA05B44
@Alternate Data Stream - 223 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:A02025CE
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:1709732A
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:8E5EA40F
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:57B374AB
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:9BAC4211
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:9E4F05ED
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:436BE28C
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINNT\Application Data\TEMP:A4E7D25F
< End of report >
- Status
Similar threads
Latest posts
-
US TikTok ban could begin next year as Biden signs law, but legal battle looms- GodisanAtheist replied
-
Upgraded 4K Chromecast with Google TV set to launch soon with improved hardware- hahahanoobs replied
-
Nintendo DMCA lawyers shut down everything Mario on Garry's Mod- Uncle Al replied
-
BlizzGone: Blizzard cancels 2024 convention but promises an eventual return
- GodisanAtheist replied
