Solved XP Antivirus 2012 fixed? Now I do not have NetBT in my registry & c/n get to Internet

[Broni]

1. Please open Notepad (Start>All Programs>Accessories>Notepad).

2. Now copy/paste the entire content of the codebox below into the Notepad window:

SecCenter::
{BCF43643-A118-4432-AEDE-D861FCBCFCDF}
{EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

ClearJavaCache::

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt

 

[jhdroge]

OK copied and dragged into Combofix. It gave me the warnings again and I had it run anyway (only took about 20 min this time). Here's the log

ComboFix 12-01-01.06 - Jade Xing 01/02/2012 11:53:58.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.467 [GMT -7:00]
Running from: c:\documents and settings\Jade Xing\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jade Xing\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sygate Personal Firewall *Disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.
.
((((((((((((((((((((((((( Files Created from 2011-12-02 to 2012-01-02 )))))))))))))))))))))))))))))))
.
.
2011-12-31 18:11 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-12-31 18:11 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-12-31 18:11 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-12-31 18:11 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-12-31 18:11 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-12-31 18:11 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-12-31 18:11 . 2011-11-28 17:51 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-12-31 18:11 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-12-31 18:11 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr
2011-12-31 18:11 . 2011-11-28 18:01 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-12-24 18:25 . 2012-01-02 07:27 -------- d-----w- C:\TechSpot Scans
2011-12-19 00:50 . 2011-12-19 00:50 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2011-12-16 04:07 . 2011-12-16 04:07 -------- d-----w- c:\documents and settings\Jade Xing\.bitrock
2011-12-16 04:02 . 2011-05-30 13:42 240640 ----a-w- c:\windows\system32\xvidvfw.dll
2011-12-16 04:02 . 2011-05-23 09:52 153088 ----a-w- c:\windows\system32\xvid.ax
2011-12-16 04:02 . 2011-05-23 07:46 645632 ----a-w- c:\windows\system32\xvidcore.dll
2011-12-16 04:02 . 2011-12-16 04:09 -------- d-----w- c:\program files\Xvid
2011-12-16 03:59 . 2011-12-16 03:59 11776 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2011-12-16 03:58 . 2011-12-16 03:58 -------- d-----w- c:\program files\Common Files\xing shared
2011-12-16 03:58 . 2011-12-16 03:58 150696 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2011-12-16 03:58 . 2011-12-16 03:58 108544 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll
2011-12-16 03:57 . 2011-12-16 03:58 -------- d-----w- c:\program files\Real
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-16 03:57 . 2003-03-19 02:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-12-16 03:57 . 2003-02-21 10:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-11-26 03:25 . 2011-05-16 21:55 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 13:25 . 2005-08-16 10:18 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2005-08-16 10:18 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2005-08-16 10:18 43520 ------w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2005-08-16 10:18 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2005-08-16 10:18 385024 ------w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2005-08-16 10:18 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2005-08-16 10:18 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2005-08-16 10:18 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-04 04:59 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-20 01:18 . 2011-10-20 01:17 21073936 ----a-w- c:\program files\vlc-1.1.11-win32.exe
2011-10-15 00:38 . 2005-08-16 10:18 456192 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2005-08-16 10:40 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-07-01 02:23 . 2011-07-01 02:23 1376832 ----a-w- c:\program files\sar_15_sfx.exe
2011-06-29 04:17 . 2011-06-29 04:03 744853 ----a-w- c:\program files\PAVARK.exe
2011-06-24 00:06 . 2011-06-24 00:05 13683064 ----a-w- c:\program files\Firefox Setup 5.0.exe
2011-11-09 03:55 . 2011-06-24 00:08 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2010-06-03 20:36 . 2011-03-21 08:38 13696 ----a-w- c:\program files\mozilla firefox\components\CntvSpeedup.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-02_07.12.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-02 16:37 . 2012-01-02 16:37 16384 c:\windows\Temp\Perflib_Perfdata_a9c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2011-08-19 16:45 790304 ----a-w- c:\program files\Yontoo Layers Runtime\YontooIEClient.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
"Desktop Software"="c:\program files\Common Files\supportsoft\bin\bcont.exe" [2009-04-24 1025320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-22 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-22 81920]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-16 2577632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-06-28 421888]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-12-16 296056]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-14 24576]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uusee\\UUSeePlayer.exe"=
"c:\\Documents and Settings\\Jade Xing\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Jade Xing\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\PPSGame\\PPSGame.exe"=
"c:\\Program Files\\cntv\\Speedup\\CNTVSpeedupper.exe"=
"c:\\Program Files\\FinalTorrent\\FinalTorrent.EXE"=
"c:\\Program Files\\FinalTorrent\\FTCheckForUpdates.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"86:TCP"= 86:TCP:BroadCam Web Server
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [12/31/2011 11:11 AM 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12/31/2011 11:11 AM 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/31/2011 11:11 AM 20568]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S1 MpKsl1851ec07;MpKsl1851ec07;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4B048E08-2BF8-42C5-96C1-BC0615091621}\MpKsl1851ec07.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4B048E08-2BF8-42C5-96C1-BC0615091621}\MpKsl1851ec07.sys [?]
S1 MpKsl258b9192;MpKsl258b9192;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE88F695-85D2-4ABC-8613-FED4030D807A}\MpKsl258b9192.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE88F695-85D2-4ABC-8613-FED4030D807A}\MpKsl258b9192.sys [?]
S1 MpKsl6e85e19b;MpKsl6e85e19b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB3031CB-9727-4F1C-B33B-376103F3AFAC}\MpKsl6e85e19b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB3031CB-9727-4F1C-B33B-376103F3AFAC}\MpKsl6e85e19b.sys [?]
S1 MpKslb353b479;MpKslb353b479;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EF93D587-B646-4B6A-938D-79A4CCD10CF6}\MpKslb353b479.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EF93D587-B646-4B6A-938D-79A4CCD10CF6}\MpKslb353b479.sys [?]
S1 MpKslc1bf2223;MpKslc1bf2223;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{704102C9-4AB2-436F-9021-A13D5757F48C}\MpKslc1bf2223.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{704102C9-4AB2-436F-9021-A13D5757F48C}\MpKslc1bf2223.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 12:16 PM 130384]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/16/2005 3:18 AM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 12:16 PM 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
bthsvc REG_MULTI_SZ btwdlns
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
2012-01-02 c:\windows\Tasks\FinalTorrent Update Checker.job
- c:\program files\FinalTorrent\FTCheckForUpdates.exe [2011-10-08 21:24]
.
2012-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2166645397-1413220193-206111531-1006Core.job
- c:\documents and settings\Jade Xing\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-31 02:45]
.
2012-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2166645397-1413220193-206111531-1006UA.job
- c:\documents and settings\Jade Xing\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-31 02:45]
.
2012-01-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 23:02]
.
2012-01-02 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 23:02]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: ??UUSee?? - c:\program files\uusee\geturltodown.htm
IE: ??UUSee???? - c:\program files\uusee\geturltoplay.htm
IE: {{998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel
Trusted Zone: intuit.com\ttlc
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
FF - ProfilePath - c:\documents and settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.search.yahoo.com/?fr=w3i&type=W3i_SP,205,0_0,StartPage,20111041,16900,0,21,0
FF - prefs.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=jiMdHzFj&q=
FF - user.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=jiMdHzFj&q=
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extentions.y2layers.installId, 1871b5a3-3fa7-43a3-b407-9b19347fdae8
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,BuzzdockTease,DropDownDeals,DropDownDeals,
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-02 12:06
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\.MpFilter]
"ImagePath"="\*"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9e,5b,0f,31,36,0a,3a,46,b3,13,04,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9e,5b,0f,31,36,0a,3a,46,b3,13,04,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3992)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-01-02 12:10:42
ComboFix-quarantined-files.txt 2012-01-02 19:10
.
Pre-Run: 33,774,264,320 bytes free
Post-Run: 33,790,410,752 bytes free
.
- - End Of File - - ADA1359DC7DED00E9E801414F855ED5C

 

[Broni]

How is computer doing?

Download OTL to your Desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Scan All Users checkbox.
• Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[jhdroge]

Ok dowmloaded it and ran it with your instructions (Avast d/n like it but since you d/n say to turn off the anti virus I told Avast to run it "normally") and the copy and paste but I d/n get an Extras.txt
I got a note pad that popped up and showed down in the tray(?) at the bottom of my screen this


OTL logfile created on: 1/2/2012 5:04:52 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Jade Xing\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.96 Mb Total Physical Memory | 559.69 Mb Available Physical Memory | 55.20% Memory free
2.38 Gb Paging File | 2.01 Gb Available in Paging File | 84.46% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.82 Gb Total Space | 31.16 Gb Free Space | 44.63% Space Free | Partition Type: NTFS

Computer Name: JADECOMPUTER | User Name: Jade Xing | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/01/02 17:03:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jade Xing\Desktop\OTL.exe
PRC - [2011/12/15 20:57:56 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/11/28 11:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/11/28 11:01:23 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/10/22 15:00:44 | 000,140,952 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Update\1.3.21.79\GoogleCrashHandler.exe
PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/10/19 12:17:28 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2006/07/24 16:20:00 | 000,282,624 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2006/07/06 06:15:00 | 000,151,552 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/07/06 06:14:30 | 000,090,112 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2005/09/08 04:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE
PRC - [2004/10/15 18:40:56 | 002,577,632 | ---- | M] (Sygate Technologies, Inc.) -- C:\Program Files\Sygate\SPF\Smc.exe


========== Modules (No Company Name) ==========

MOD - [2012/01/02 12:02:07 | 001,660,928 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12010201\algo.dll
MOD - [2012/01/02 01:42:39 | 001,660,928 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12010200\algo.dll
MOD - [2011/12/31 08:01:54 | 000,268,808 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12010201\aswRep.dll
MOD - [2011/12/31 08:01:54 | 000,268,808 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12010200\aswRep.dll
MOD - [2007/10/19 12:17:40 | 000,068,120 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSPS.dll
MOD - [2007/09/20 17:34:58 | 000,129,024 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2004/10/15 17:32:20 | 001,385,712 | ---- | M] () -- C:\Program Files\Sygate\SPF\tse.dll
MOD - [2004/10/15 17:32:18 | 000,832,744 | ---- | M] () -- C:\Program Files\Sygate\SPF\SyLink.dll
MOD - [2004/10/15 17:32:12 | 000,890,088 | ---- | M] () -- C:\Program Files\Sygate\SPF\SpNet.dll
MOD - [2003/07/29 09:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBCPP5C.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2011/11/28 11:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/10/19 12:21:16 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2007/10/19 12:19:22 | 000,141,848 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2007/10/19 12:17:28 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2006/07/06 06:14:30 | 000,090,112 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2004/10/15 18:40:56 | 002,577,632 | ---- | M] (Sygate Technologies, Inc.) [Auto | Running] -- C:\Program Files\Sygate\SPF\Smc.exe -- (SmcService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2011/11/28 10:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/11/28 10:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/11/28 10:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/11/28 10:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/11/28 10:52:02 | 000,111,320 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/11/28 10:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011/11/28 10:48:49 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2007/10/19 12:16:30 | 002,109,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2007/10/11 19:00:42 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/10/11 17:59:24 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2007/10/11 17:59:02 | 002,142,488 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2007/02/03 09:27:28 | 000,938,272 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2007/02/03 09:27:16 | 000,014,240 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2006/07/24 16:20:00 | 001,156,648 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2006/06/05 02:39:56 | 000,024,064 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL)
DRV - [2006/01/10 11:07:58 | 000,004,864 | ---- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2005/09/08 04:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005/09/08 04:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005/09/08 04:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005/09/08 04:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005/09/08 04:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005/09/08 04:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005/09/08 04:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005/08/25 11:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005/08/25 11:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2004/10/15 17:32:44 | 000,014,568 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\Drivers\wg6n.sys -- (wg6n)
DRV - [2004/10/15 17:32:42 | 000,014,568 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\Drivers\wg5n.sys -- (wg5n)
DRV - [2004/10/15 17:32:40 | 000,014,568 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\Drivers\wg4n.sys -- (wg4n)
DRV - [2004/10/15 17:32:38 | 000,014,568 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys -- (wg3n)
DRV - [2004/10/15 17:18:46 | 000,021,075 | ---- | M] (Sygate Technologies, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\wpsdrvnt.sys -- (wpsdrvnt)
DRV - [2004/10/15 17:17:02 | 000,060,496 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\Drivers\Teefer.sys -- (Teefer)
DRV - [2004/08/10 04:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [2003/11/17 20:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 20:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 20:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2001/08/10 03:03:00 | 000,070,084 | ---- | M] (MK Systems CO., LTD.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EPLPDX02.SYS -- (Eplpdx02)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061114
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061114


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061114
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061114
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
IE - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.search.yahoo.com/?fr=w3i&type=W3i_SP,205,0_0,StartPage,20111041,16900,0,21,0"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.2.0.2
FF - prefs.js..extensions.enabledItems: wrc@avast.com:20110101
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323
FF - prefs.js..keyword.URL: "http://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=jiMdHzFj&q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=jiMdHzFj&q="

FF - user.js..keyword.URL: "http://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=jiMdHzFj&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\Jade Xing\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\Jade Xing\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/12/15 20:58:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/12/31 11:11:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/08 20:55:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/15 20:59:12 | 000,000,000 | ---D | M]

[2009/01/02 16:34:26 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Extensions
[2011/11/18 00:11:28 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\extensions
[2011/04/02 13:49:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/11/08 15:29:29 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/18 00:11:28 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/11/08 16:37:29 | 000,000,000 | ---D | M] (ShopToWin13) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\extensions\{b9dbe2c0-031f-4cad-911a-f4a7381d79c0}
[2011/04/02 13:47:27 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2011/10/08 12:29:42 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\extensions\plugin@yontoo.com
[2010/08/24 11:44:07 | 000,002,197 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\searchplugins\google-search.xml
[2011/03/26 21:22:43 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Application Data\Mozilla\Firefox\Profiles\srzwt60x.default\searchplugins\sweetim.xml
[2011/06/23 17:08:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/12/15 20:58:31 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2011/12/31 11:11:40 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2008/12/06 01:54:56 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/11/08 20:55:55 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/06/03 13:36:18 | 000,013,696 | ---- | M] () -- C:\Program Files\mozilla firefox\components\CntvSpeedup.dll
[2011/11/08 20:55:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/08/24 11:44:07 | 000,002,197 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google-search.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java(TM) Platform SE 6 U18 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.180.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\Jade Xing\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\Jade Xing\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: avast! WebRep = C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\6.0.1374_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\

O1 HOSTS File: ([2012/01/02 00:10:44 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SmcService] C:\Program Files\Sygate\SPF\Smc.exe (Sygate Technologies, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006..\Run: [Desktop Software] C:\Program Files\Common Files\supportsoft\bin\bcont.exe (SupportSoft, Inc.)
O4 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\__aswSnx private storage\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: 使用UUSee下载 - C:\Program Files\uusee\geturltodown.htm ()
O8 - Extra context menu item: 使用UUSee加速播放 - C:\Program Files\uusee\geturltoplay.htm ()
O9 - Extra Button: 很快视频搜索 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel File not found
O9 - Extra 'Tools' menuitem : 很快视频搜索 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel File not found
O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: //@install.mar@/ ([]msni in My Computer)
O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: //@mail.mar@/ ([]msni in Local intranet)
O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: pps.tv ([]http in Trusted sites)
O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: ppstream.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1218927117921 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{800379A8-54EF-4B75-9AD9-0C845E847521}: DhcpNameServer = 75.75.75.75 75.75.76.76
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jade Xing\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 03:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\divxa32.acm (Kristal StudioD
FileDescription)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: VIDC.I420 - C:\WINDOWS\System32\LVCodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/02 17:03:33 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jade Xing\Desktop\OTL.exe
[2012/01/02 16:52:45 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/01/01 22:38:36 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/01/01 22:36:02 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/01/01 22:36:02 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/01/01 22:36:02 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/01/01 22:36:02 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/01/01 16:21:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/01/01 16:20:24 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/01/01 16:17:51 | 004,360,044 | R--- | C] (Swearware) -- C:\Documents and Settings\Jade Xing\Desktop\ComboFix.exe
[2011/12/31 11:11:54 | 000,314,456 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/12/31 11:11:54 | 000,020,568 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/12/31 11:11:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2011/12/31 11:11:53 | 000,435,032 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/12/31 11:11:53 | 000,111,320 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/12/31 11:11:53 | 000,105,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/12/31 11:11:53 | 000,052,952 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/12/31 11:11:53 | 000,034,392 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/12/31 11:11:53 | 000,030,808 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/12/31 11:11:38 | 000,041,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/12/31 11:11:37 | 000,199,816 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/12/28 21:19:22 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Jade Xing\Start Menu\Programs\Administrative Tools
[2011/12/28 21:17:14 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Jade Xing\Desktop\dds.scr
[2011/12/24 11:25:33 | 000,000,000 | ---D | C] -- C:\TechSpot Scans
[2011/12/15 21:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jade Xing\.bitrock
[2011/12/15 21:02:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Xvid
[2011/12/15 21:02:44 | 000,000,000 | ---D | C] -- C:\Program Files\Xvid
[2011/12/15 20:58:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2011/12/15 20:58:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Real
[2011/12/15 20:57:49 | 000,000,000 | ---D | C] -- C:\Program Files\Real
[2011/12/15 20:57:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Real
[2011/12/15 20:57:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jade Xing\Application Data\Real
[2011/06/23 17:05:50 | 013,683,064 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 5.0.exe
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/02 17:05:02 | 000,000,994 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2166645397-1413220193-206111531-1006UA.job
[2012/01/02 17:03:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jade Xing\Desktop\OTL.exe
[2012/01/02 16:05:01 | 000,000,942 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2166645397-1413220193-206111531-1006Core.job
[2012/01/02 13:31:05 | 000,000,376 | ---- | M] () -- C:\WINDOWS\tasks\FinalTorrent Update Checker.job
[2012/01/02 09:38:03 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
[2012/01/02 09:38:03 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
[2012/01/02 09:38:02 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/01/02 09:37:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/01/02 00:10:44 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/01/01 22:38:50 | 000,000,317 | RHS- | M] () -- C:\boot.ini
[2012/01/01 19:36:41 | 042,852,864 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.1.avi
[2012/01/01 19:18:15 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.1.2012.1.avi
[2012/01/01 19:11:27 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.1avi.avi
[2012/01/01 18:58:38 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.2.avi
[2012/01/01 18:40:31 | 010,371,584 | ---- | M] () -- C:\YahooCam-Angelie montano 1.1.2012.avi
[2012/01/01 18:35:09 | 000,002,305 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\CamGrab-2_Plus.lnk
[2012/01/01 16:17:57 | 004,360,044 | R--- | M] (Swearware) -- C:\Documents and Settings\Jade Xing\Desktop\ComboFix.exe
[2012/01/01 16:05:58 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\MBR.dat
[2012/01/01 15:46:16 | 004,702,720 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Jade Xing\Desktop\aswMBR.exe
[2012/01/01 14:58:21 | 000,241,664 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/31 11:11:54 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/12/31 11:11:53 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/12/28 21:17:15 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Jade Xing\Desktop\dds.scr
[2011/12/28 20:56:17 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\v2vijehe.exe
[2011/12/23 18:07:29 | 000,002,294 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/23 18:07:28 | 000,002,316 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\Google Chrome.lnk
[2011/12/20 12:13:52 | 000,326,647 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\FSS.exe
[2011/12/18 09:16:34 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/12/15 20:59:06 | 000,000,929 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/12/14 19:06:52 | 000,312,376 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/13 23:44:26 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 

[jhdroge]

CONTINUED

========== Files Created - No Company Name ==========

[2012/01/01 22:38:49 | 000,000,201 | ---- | C] () -- C:\Boot.bak
[2012/01/01 22:38:44 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/01/01 22:36:02 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/01/01 22:36:02 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/01/01 22:36:02 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/01/01 22:36:02 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/01/01 22:36:02 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/01/01 19:18:15 | 000,000,000 | ---- | C] () -- C:\YahooCam-Angelie montano1.1.2012.1.avi
[2012/01/01 19:14:08 | 042,852,864 | ---- | C] () -- C:\YahooCam-Angelie montano1.2.2012.1.avi
[2012/01/01 19:11:27 | 000,000,000 | ---- | C] () -- C:\YahooCam-Angelie montano1.2.2012.1avi.avi
[2012/01/01 18:58:38 | 000,000,000 | ---- | C] () -- C:\YahooCam-Angelie montano1.2.2012.2.avi
[2012/01/01 18:35:26 | 010,371,584 | ---- | C] () -- C:\YahooCam-Angelie montano 1.1.2012.avi
[2012/01/01 16:05:58 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\MBR.dat
[2011/12/31 11:11:54 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/12/28 20:56:12 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\v2vijehe.exe
[2011/12/24 11:23:42 | 000,326,647 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\FSS.exe
[2011/12/23 17:53:09 | 000,011,244 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\netbt.reg
[2011/12/15 22:04:41 | 000,000,286 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
[2011/12/15 22:04:40 | 000,000,294 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
[2011/12/15 21:02:47 | 000,645,632 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/12/15 21:02:47 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/12/15 21:02:47 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax
[2011/12/15 20:59:06 | 000,000,929 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/11/21 00:11:53 | 000,188,488 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/19 18:17:25 | 021,073,936 | ---- | C] () -- C:\Program Files\vlc-1.1.11-win32.exe
[2011/07/13 17:08:46 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2011/06/30 19:23:27 | 001,376,832 | ---- | C] () -- C:\Program Files\sar_15_sfx.exe
[2011/06/28 21:03:28 | 000,744,853 | ---- | C] () -- C:\Program Files\PAVARK.exe
[2011/06/24 19:48:06 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/11 10:29:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Osetakoboxag.bin
[2010/09/11 10:29:25 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Wqelaruyuqidefay.dat
[2009/10/18 15:51:28 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Application Data\setup_ldm.iss
[2008/06/12 19:36:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/05/26 20:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 20:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/07 18:07:30 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Application Data\wklnhst.dat
[2008/02/04 17:23:10 | 000,693,792 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2008/01/22 19:44:30 | 000,000,318 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2007/10/17 23:15:44 | 000,008,704 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Application Data\dvd.bmk
[2007/10/11 17:59:24 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/09/27 09:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 09:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 09:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/06/16 21:08:50 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT4.DAT
[2007/06/16 21:08:49 | 000,000,051 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI
[2007/06/16 21:08:34 | 000,000,045 | ---- | C] () -- C:\WINDOWS\EPSONC86.ini
[2007/06/02 21:27:25 | 000,241,664 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/03/28 19:37:58 | 000,000,047 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/03/25 19:56:49 | 000,050,127 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2007/03/25 17:30:06 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2007/03/25 17:16:49 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Local Settings\Application Data\fusioncache.dat
[2007/02/05 19:05:26 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2006/11/14 14:13:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/11/14 14:06:40 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/11/14 14:00:02 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/11/14 13:54:52 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/11/14 13:29:04 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006/11/14 13:28:54 | 000,348,880 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll
[2006/11/14 13:28:54 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4642.dll
[2006/11/14 13:28:30 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/09/13 04:06:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\gtapi.dll
[2005/11/10 07:56:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/16 03:48:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/08/16 03:38:45 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/08/16 03:37:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 03:33:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/08/16 03:27:59 | 000,312,376 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/16 03:18:35 | 000,282,112 | ---- | C] () -- C:\WINDOWS\System32\sbe(2).dll
[2005/08/16 03:18:35 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/08/16 03:18:33 | 001,287,680 | ---- | C] () -- C:\WINDOWS\System32\quartz(2).dll
[2005/08/16 03:18:33 | 000,496,308 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/08/16 03:18:33 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2005/08/16 03:18:33 | 000,083,976 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/08/16 03:18:33 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2005/08/16 03:18:32 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2005/08/16 03:18:30 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/08/16 03:18:28 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/08/16 03:18:23 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2005/08/16 03:18:23 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2005/08/16 03:18:15 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2005/08/16 03:18:08 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2005/08/05 13:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/10/15 17:31:56 | 000,218,264 | ---- | C] () -- C:\WINDOWS\System32\SetAid.dll
[2004/02/10 15:08:00 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini
[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/13 15:40:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll
[2001/09/04 03:04:00 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT

========== LOP Check ==========

[2011/12/31 11:11:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/05/26 01:01:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2011/01/04 21:15:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2005/08/16 19:54:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
[2011/10/08 12:30:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fighters
[2009/04/14 18:31:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kingsoft
[2011/02/26 03:35:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\lOpDhPg05200
[2007/07/07 12:37:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2010/06/15 22:57:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Qwest
[2007/03/25 18:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2006/11/14 13:55:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/09/13 17:16:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VistaCodecs
[2009/01/02 15:06:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
[2008/12/06 01:42:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
[2010/12/14 17:12:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\33A3E635C4EC1D1876E3149E3EFDE0AA
[2010/04/15 19:12:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\AddressBar
[2009/01/02 16:34:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Babylon
[2009/01/24 14:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\CCTV
[2011/10/08 14:28:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\FinalTorrent
[2010/06/09 23:27:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\ImgBurn
[2009/06/07 15:01:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Kingsoft
[2007/06/16 21:10:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Leadertech
[2007/03/25 19:02:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\MSNInstaller
[2010/06/17 20:52:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\OpenOffice.org
[2011/02/09 13:35:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\PPStream
[2008/04/07 18:07:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Template
[2010/03/06 16:26:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Tencent
[2010/05/23 11:46:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Uniblue
[2010/07/04 14:15:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\VSRevoGroup
[2007/06/02 20:09:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Walgreens
[2011/04/02 15:17:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Windows Desktop Search
[2011/04/16 19:56:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Windows Search
[2012/01/02 13:31:05 | 000,000,376 | ---- | M] () -- C:\WINDOWS\Tasks\FinalTorrent Update Checker.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/05/25 09:29:07 | 000,131,932 | ---- | M] () -- C:\aaw7boot.log
[2011/03/30 11:47:12 | 000,000,387 | ---- | M] () -- C:\application001
[2005/08/16 03:43:04 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/02/03 18:23:49 | 000,000,201 | ---- | M] () -- C:\Boot.bak
[2012/01/01 22:38:50 | 000,000,317 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2012/01/02 12:10:44 | 000,015,841 | ---- | M] () -- C:\ComboFix.txt
[2005/08/16 03:43:04 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/11/14 13:33:22 | 000,006,782 | RH-- | M] () -- C:\dell.sdr
[2010/02/10 18:21:57 | 000,000,144 | ---- | M] () -- C:\delrepxp.log
[2007/03/25 19:58:17 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2005/08/16 03:43:04 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2006/11/14 13:55:47 | 000,000,832 | -H-- | M] () -- C:\IPH.PH
[2007/07/07 12:37:18 | 000,000,777 | ---- | M] () -- C:\log.txt
[2005/08/16 03:43:04 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2008/01/01 20:14:50 | 000,000,991 | ---- | M] () -- C:\net_save.dna
[2004/08/10 04:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/07/30 16:43:32 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2012/01/02 09:37:24 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2011/03/21 01:37:26 | 000,169,344 | ---- | M] () -- C:\SpeedupOnlineInstall.exe
[2011/03/21 02:02:42 | 001,402,824 | ---- | M] (中国网络电视台-CNTV ) -- C:\speedup_setup_1.0.2.0.exe
[2011/10/01 15:35:00 | 000,002,154 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_16.33.15_log.txt
[2011/10/01 15:36:11 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_16.36.08_log.txt
[2011/10/01 16:52:52 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_17.52.37_log.txt
[2011/10/01 16:58:33 | 000,113,250 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_17.56.59_log.txt
[2011/12/08 22:59:58 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_08.12.2011_22.59.54_log.txt
[2011/12/08 23:01:26 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_08.12.2011_23.01.12_log.txt
[2011/12/08 23:03:26 | 000,056,854 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_08.12.2011_23.02.55_log.txt
[2011/07/16 18:35:15 | 000,057,582 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_16.07.2011_19.33.37_log.txt
[2011/12/18 15:03:34 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_18.12.2011_15.03.07_log.txt
[2011/12/18 16:21:23 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_18.12.2011_16.20.58_log.txt
[2011/12/18 16:48:19 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_18.12.2011_16.47.58_log.txt
[2011/12/19 19:45:16 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_19.12.2011_19.44.53_log.txt
[2011/10/01 15:36:00 | 000,068,150 | ---- | M] () -- C:\TDSSKiller.2.6.2.0_01.10.2011_16.35.10_log.txt
[2011/10/01 15:37:23 | 000,068,150 | ---- | M] () -- C:\TDSSKiller.2.6.2.0_01.10.2011_16.36.48_log.txt
[2011/10/01 16:56:53 | 000,068,150 | ---- | M] () -- C:\TDSSKiller.2.6.2.0_01.10.2011_17.53.53_log.txt
[2011/12/08 23:01:01 | 000,067,080 | ---- | M] () -- C:\TDSSKiller.2.6.22.0_08.12.2011_23.00.33_log.txt
[2012/01/01 18:40:31 | 010,371,584 | ---- | M] () -- C:\YahooCam-Angelie montano 1.1.2012.avi
[2012/01/01 19:18:15 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.1.2012.1.avi
[2012/01/01 19:36:41 | 042,852,864 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.1.avi
[2012/01/01 19:11:27 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.1avi.avi
[2012/01/01 18:58:38 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.2.avi

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/08/16 03:42:12 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/09/12 20:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD83.DLL
[2006/09/12 20:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP83.DLL
[2003/07/29 09:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBCPP5C.DLL
[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 12:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/11/28 11:01:25 | 000,041,184 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2007/10/23 17:04:43 | 000,001,634 | -H-- | M] () -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2011/06/23 17:06:39 | 013,683,064 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 5.0.exe
[2011/06/28 21:17:30 | 000,744,853 | ---- | M] () -- C:\Program Files\PAVARK.exe
[2011/06/30 19:23:16 | 001,376,832 | ---- | M] () -- C:\Program Files\sar_15_sfx.exe
[2011/10/19 18:18:24 | 021,073,936 | ---- | M] () -- C:\Program Files\vlc-1.1.11-win32.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/08/16 03:27:08 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005/08/16 03:27:08 | 000,659,456 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005/08/16 03:27:08 | 000,876,544 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/07/30 16:49:14 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >
[2006/11/14 13:52:44 | 000,493,214 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\TRANSFORMS=1033.mst

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/03/25 17:16:59 | 000,000,170 | -HS- | M] () -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/01/01 15:46:16 | 004,702,720 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Jade Xing\Desktop\aswMBR.exe
[2012/01/01 16:17:57 | 004,360,044 | R--- | M] (Swearware) -- C:\Documents and Settings\Jade Xing\Desktop\ComboFix.exe
[2011/12/20 12:13:52 | 000,326,647 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\FSS.exe
[2010/07/09 12:48:14 | 156,607,328 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\OOo_3.2.0_Win32Intel_install_wJRE_en-US.exe
[2010/08/07 16:29:07 | 140,467,400 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\OOo_3.2.1_Win_x86_install_en-US.exe
[2012/01/02 17:03:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jade Xing\Desktop\OTL.exe
[2011/07/16 18:31:27 | 001,436,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Jade Xing\Desktop\tdsskiller.exe
[2011/12/28 20:56:17 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\v2vijehe.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/10 04:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/03/25 17:16:58 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Jade Xing\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/11/17 23:44:50 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Jade Xing\Cookies\desktop.ini
[2012/01/02 17:04:02 | 001,884,160 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 17:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 00:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 00:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 07:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 10:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 17:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 00:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 00:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 00:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 00:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 00:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

========== Files - Unicode (All) ==========
[2011/03/21 02:03:59 | 000,000,738 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV 网页点播加速器.lnk
[2011/03/21 02:03:59 | 000,000,720 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Desktop\CNTV 网页点播加速器.lnk
[2011/03/21 01:38:31 | 000,000,000 | ---D | M](C:\Documents and Settings\Jade Xing\My Documents\CBox???) -- C:\Documents and Settings\Jade Xing\My Documents\CBox加速器
[2011/03/21 01:38:31 | 000,000,000 | ---D | C](C:\Documents and Settings\Jade Xing\My Documents\CBox???) -- C:\Documents and Settings\Jade Xing\My Documents\CBox加速器
[2011/03/21 01:38:16 | 000,000,738 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV 网页点播加速器.lnk
[2011/03/21 01:38:16 | 000,000,720 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Desktop\CNTV 网页点播加速器.lnk
[2011/02/21 01:41:09 | 000,000,196 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\PPS????????? - ????PPS????.url) -- C:\Documents and Settings\Jade Xing\Desktop\PPS网络电视官方下载站 - 免费下载PPS最新版本.url
[2011/02/14 09:03:32 | 000,002,970 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????.url) -- C:\Documents and Settings\Jade Xing\Desktop\世界新聞網.url
[2011/02/07 06:58:44 | 000,007,898 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国电视和录影饲料.url
[2011/01/24 00:15:13 | 000,003,904 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????? www.sinovision.net.url) -- C:\Documents and Settings\Jade Xing\Desktop\美国中文网 www.sinovision.net.url
[2011/01/24 00:14:17 | 000,000,208 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??? - ?? - ?? - ??????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\土豆网 - 视频 - 播客 - 每个人都是生活的导演.url
[2010/12/20 21:17:43 | 000,000,130 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\百度.url
[2010/10/09 16:03:16 | 000,000,130 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\百度.url
[2010/05/26 03:02:49 | 000,008,420 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??????? CCTV.com.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国中央电视台 CCTV.com.url
[2010/05/26 02:44:27 | 000,010,933 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\网易.url
[2010/05/26 02:19:52 | 000,000,234 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\雅虎首页.url
[2010/05/10 19:50:52 | 000,000,760 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS??.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS影音.lnk
[2010/04/24 22:40:12 | 000,002,970 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????.url) -- C:\Documents and Settings\Jade Xing\Desktop\世界新聞網.url
[2009/10/22 17:52:28 | 000,000,760 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS??.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS影音.lnk
[2009/07/10 17:36:24 | 000,000,119 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?? Internet Explorer ???.url) -- C:\Documents and Settings\Jade Xing\Desktop\启动 Internet Explorer 浏览器.url
[2009/03/04 21:34:35 | 000,001,216 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\迅雷在线.url
[2009/02/13 17:32:27 | 000,000,119 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?? Internet Explorer ???.url) -- C:\Documents and Settings\Jade Xing\Desktop\启动 Internet Explorer 浏览器.url
[2009/01/31 22:43:26 | 000,003,904 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????? www.sinovision.net.url) -- C:\Documents and Settings\Jade Xing\Desktop\美国中文网 www.sinovision.net.url
[2009/01/31 22:41:38 | 000,000,196 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\PPS????????? - ????PPS????.url) -- C:\Documents and Settings\Jade Xing\Desktop\PPS网络电视官方下载站 - 免费下载PPS最新版本.url
[2009/01/25 17:10:21 | 000,001,216 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\迅雷在线.url
[2009/01/25 16:05:41 | 000,008,420 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??????? CCTV.com.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国中央电视台 CCTV.com.url
[2009/01/23 21:40:34 | 000,000,208 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??? - ?? - ?? - ??????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\土豆网 - 视频 - 播客 - 每个人都是生活的导演.url
[2009/01/18 20:17:10 | 000,000,158 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\???? - ??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中文论坛 - 东西南北论坛.url
[2009/01/18 20:11:14 | 000,003,983 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\搜狐首页.url
[2009/01/17 22:46:35 | 000,001,380 | ---- | M] ()(C:\Documents and Settings\All Users\Desktop\??????.lnk) -- C:\Documents and Settings\All Users\Desktop\很快视频搜索.lnk
[2009/01/17 22:46:35 | 000,001,380 | ---- | C] ()(C:\Documents and Settings\All Users\Desktop\??????.lnk) -- C:\Documents and Settings\All Users\Desktop\很快视频搜索.lnk
[2009/01/17 22:46:35 | 000,000,720 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,720 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,702 | ---- | M] ()(C:\Documents and Settings\All Users\Desktop\UUSee ????.lnk) -- C:\Documents and Settings\All Users\Desktop\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,702 | ---- | C] ()(C:\Documents and Settings\All Users\Desktop\UUSee ????.lnk) -- C:\Documents and Settings\All Users\Desktop\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,534 | ---- | M] ()(C:\Documents and Settings\All Users\Favorites\??????.lnk) -- C:\Documents and Settings\All Users\Favorites\很快视频搜索.lnk
[2008/11/12 18:56:36 | 000,430,560 | ---- | M] (ADA Software)(C:\WINDOWS\System32\pps????.scr) -- C:\WINDOWS\System32\pps影讯屏保.scr
[2008/11/12 18:56:36 | 000,430,560 | ---- | C] (ADA Software)(C:\WINDOWS\System32\pps????.scr) -- C:\WINDOWS\System32\pps影讯屏保.scr
[2008/09/06 20:56:16 | 000,000,861 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????-???????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国英语网－中国人学英语第一门户网.url
[2008/09/06 20:48:34 | 000,000,152 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????? .WWW.NETAT.NET..url) -- C:\Documents and Settings\Jade Xing\Desktop\金桥翻译中心 .WWW.NETAT.NET..url
[2008/01/03 19:36:19 | 000,004,981 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\Sivoo-??.url) -- C:\Documents and Settings\Jade Xing\Desktop\Sivoo-中文.url
[2007/07/28 18:22:56 | 000,000,861 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????-???????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国英语网－中国人学英语第一门户网.url
[2007/07/15 01:46:29 | 000,000,158 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\???? - ??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中文论坛 - 东西南北论坛.url
[2007/07/07 18:38:56 | 000,000,170 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????---???????(??????????????)-???????--??????--??????--??????--???????-????--????---????---????.url) -- C:\Documents and Settings\Jade Xing\Desktop\翻译公司---中国专家翻译网(北京、上海、广州、西安、重庆)-华译网翻译公司--专业翻译公司--英文翻译公司--日文翻译公司--多语种翻译公司-英语翻译--日语翻译---德语翻译---法语翻译.url
[2007/06/23 22:11:36 | 000,000,152 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????? .WWW.NETAT.NET..url) -- C:\Documents and Settings\Jade Xing\Desktop\金桥翻译中心 .WWW.NETAT.NET..url
[2007/06/23 21:58:42 | 000,000,188 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\北京专家翻译.url
[2007/06/23 21:58:10 | 000,000,188 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\北京专家翻译.url
[2007/06/23 21:19:06 | 000,000,170 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????---???????(??????????????)-???????--??????--??????--??????--???????-????--????---????---????.url) -- C:\Documents and Settings\Jade Xing\Desktop\翻译公司---中国专家翻译网(北京、上海、广州、西安、重庆)-华译网翻译公司--专业翻译公司--英文翻译公司--日文翻译公司--多语种翻译公司-英语翻译--日语翻译---德语翻译---法语翻译.url
[2007/04/01 18:04:30 | 000,004,981 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\Sivoo-??.url) -- C:\Documents and Settings\Jade Xing\Desktop\Sivoo-中文.url
[2007/04/01 17:52:09 | 000,000,282 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\???????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国互联网电视.url
[2007/04/01 17:52:09 | 000,000,282 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\???????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国互联网电视.url
[2007/04/01 17:42:57 | 000,007,898 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国电视和录影饲料.url
[2007/03/28 20:11:27 | 000,010,933 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\网易.url
[2007/03/28 20:10:55 | 000,003,983 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\搜狐首页.url
[2007/03/25 17:26:02 | 000,000,234 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\雅虎首页.url
(C:\Documents and Settings\All Users\Start Menu\Programs\UUSee ????) -- C:\Documents and Settings\All Users\Start Menu\Programs\UUSee 网络电视
(C:\Documents and Settings\All Users\Start Menu\Programs\???????-CNTV) -- C:\Documents and Settings\All Users\Start Menu\Programs\中国网络电视台-CNTV
(C:\Documents and Settings\All Users\Start Menu\Programs\?????) -- C:\Documents and Settings\All Users\Start Menu\Programs\百度地址栏

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Jade Xing\Desktop\OTL.com:SummaryInformation
@Alternate Data Stream - 20 bytes -> C:\Program Files\PAVARK.exe:License

< End of report >

 

[jhdroge]

The second? CONTINUED

========== Files Created - No Company Name ==========

[2012/01/01 22:38:49 | 000,000,201 | ---- | C] () -- C:\Boot.bak
[2012/01/01 22:38:44 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/01/01 22:36:02 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/01/01 22:36:02 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/01/01 22:36:02 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/01/01 22:36:02 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/01/01 22:36:02 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/01/01 19:18:15 | 000,000,000 | ---- | C] () -- C:\YahooCam-Angelie montano1.1.2012.1.avi
[2012/01/01 19:14:08 | 042,852,864 | ---- | C] () -- C:\YahooCam-Angelie montano1.2.2012.1.avi
[2012/01/01 19:11:27 | 000,000,000 | ---- | C] () -- C:\YahooCam-Angelie montano1.2.2012.1avi.avi
[2012/01/01 18:58:38 | 000,000,000 | ---- | C] () -- C:\YahooCam-Angelie montano1.2.2012.2.avi
[2012/01/01 18:35:26 | 010,371,584 | ---- | C] () -- C:\YahooCam-Angelie montano 1.1.2012.avi
[2012/01/01 16:05:58 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\MBR.dat
[2011/12/31 11:11:54 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/12/28 20:56:12 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\v2vijehe.exe
[2011/12/24 11:23:42 | 000,326,647 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\FSS.exe
[2011/12/23 17:53:09 | 000,011,244 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Desktop\netbt.reg
[2011/12/15 22:04:41 | 000,000,286 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
[2011/12/15 22:04:40 | 000,000,294 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2166645397-1413220193-206111531-1006.job
[2011/12/15 21:02:47 | 000,645,632 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/12/15 21:02:47 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/12/15 21:02:47 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax
[2011/12/15 20:59:06 | 000,000,929 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2011/11/21 00:11:53 | 000,188,488 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/19 18:17:25 | 021,073,936 | ---- | C] () -- C:\Program Files\vlc-1.1.11-win32.exe
[2011/07/13 17:08:46 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2011/06/30 19:23:27 | 001,376,832 | ---- | C] () -- C:\Program Files\sar_15_sfx.exe
[2011/06/28 21:03:28 | 000,744,853 | ---- | C] () -- C:\Program Files\PAVARK.exe
[2011/06/24 19:48:06 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/11 10:29:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Osetakoboxag.bin
[2010/09/11 10:29:25 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Wqelaruyuqidefay.dat
[2009/10/18 15:51:28 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Application Data\setup_ldm.iss
[2008/06/12 19:36:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/05/26 20:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 20:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/07 18:07:30 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Application Data\wklnhst.dat
[2008/02/04 17:23:10 | 000,693,792 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2008/01/22 19:44:30 | 000,000,318 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2007/10/17 23:15:44 | 000,008,704 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Application Data\dvd.bmk
[2007/10/11 17:59:24 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/09/27 09:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 09:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 09:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/06/16 21:08:50 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT4.DAT
[2007/06/16 21:08:49 | 000,000,051 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI
[2007/06/16 21:08:34 | 000,000,045 | ---- | C] () -- C:\WINDOWS\EPSONC86.ini
[2007/06/02 21:27:25 | 000,241,664 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/03/28 19:37:58 | 000,000,047 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/03/25 19:56:49 | 000,050,127 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2007/03/25 17:30:06 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2007/03/25 17:16:49 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Jade Xing\Local Settings\Application Data\fusioncache.dat
[2007/02/05 19:05:26 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2006/11/14 14:13:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/11/14 14:06:40 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/11/14 14:00:02 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/11/14 13:54:52 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/11/14 13:29:04 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006/11/14 13:28:54 | 000,348,880 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll
[2006/11/14 13:28:54 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4642.dll
[2006/11/14 13:28:30 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/09/13 04:06:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\gtapi.dll
[2005/11/10 07:56:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/16 03:48:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/08/16 03:38:45 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/08/16 03:37:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 03:33:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/08/16 03:27:59 | 000,312,376 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/16 03:18:35 | 000,282,112 | ---- | C] () -- C:\WINDOWS\System32\sbe(2).dll
[2005/08/16 03:18:35 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/08/16 03:18:33 | 001,287,680 | ---- | C] () -- C:\WINDOWS\System32\quartz(2).dll
[2005/08/16 03:18:33 | 000,496,308 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/08/16 03:18:33 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2005/08/16 03:18:33 | 000,083,976 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/08/16 03:18:33 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2005/08/16 03:18:32 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2005/08/16 03:18:30 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/08/16 03:18:28 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/08/16 03:18:23 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2005/08/16 03:18:23 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2005/08/16 03:18:15 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2005/08/16 03:18:08 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2005/08/05 13:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/10/15 17:31:56 | 000,218,264 | ---- | C] () -- C:\WINDOWS\System32\SetAid.dll
[2004/02/10 15:08:00 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini
[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/13 15:40:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll
[2001/09/04 03:04:00 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT

========== LOP Check ==========

[2011/12/31 11:11:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/05/26 01:01:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2011/01/04 21:15:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2005/08/16 19:54:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
[2011/10/08 12:30:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fighters
[2009/04/14 18:31:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kingsoft
[2011/02/26 03:35:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\lOpDhPg05200
[2007/07/07 12:37:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2010/06/15 22:57:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Qwest
[2007/03/25 18:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2006/11/14 13:55:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/09/13 17:16:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VistaCodecs
[2009/01/02 15:06:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
[2008/12/06 01:42:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
[2010/12/14 17:12:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\33A3E635C4EC1D1876E3149E3EFDE0AA
[2010/04/15 19:12:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\AddressBar
[2009/01/02 16:34:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Babylon
[2009/01/24 14:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\CCTV
[2011/10/08 14:28:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\FinalTorrent
[2010/06/09 23:27:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\ImgBurn
[2009/06/07 15:01:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Kingsoft
[2007/06/16 21:10:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Leadertech
[2007/03/25 19:02:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\MSNInstaller
[2010/06/17 20:52:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\OpenOffice.org
[2011/02/09 13:35:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\PPStream
[2008/04/07 18:07:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Template
[2010/03/06 16:26:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Tencent
[2010/05/23 11:46:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Uniblue
[2010/07/04 14:15:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\VSRevoGroup
[2007/06/02 20:09:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Walgreens
[2011/04/02 15:17:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Windows Desktop Search
[2011/04/16 19:56:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Windows Search
[2012/01/02 13:31:05 | 000,000,376 | ---- | M] () -- C:\WINDOWS\Tasks\FinalTorrent Update Checker.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/05/25 09:29:07 | 000,131,932 | ---- | M] () -- C:\aaw7boot.log
[2011/03/30 11:47:12 | 000,000,387 | ---- | M] () -- C:\application001
[2005/08/16 03:43:04 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/02/03 18:23:49 | 000,000,201 | ---- | M] () -- C:\Boot.bak
[2012/01/01 22:38:50 | 000,000,317 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2012/01/02 12:10:44 | 000,015,841 | ---- | M] () -- C:\ComboFix.txt
[2005/08/16 03:43:04 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/11/14 13:33:22 | 000,006,782 | RH-- | M] () -- C:\dell.sdr
[2010/02/10 18:21:57 | 000,000,144 | ---- | M] () -- C:\delrepxp.log
[2007/03/25 19:58:17 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2005/08/16 03:43:04 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2006/11/14 13:55:47 | 000,000,832 | -H-- | M] () -- C:\IPH.PH
[2007/07/07 12:37:18 | 000,000,777 | ---- | M] () -- C:\log.txt
[2005/08/16 03:43:04 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2008/01/01 20:14:50 | 000,000,991 | ---- | M] () -- C:\net_save.dna
[2004/08/10 04:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/07/30 16:43:32 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2012/01/02 09:37:24 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2011/03/21 01:37:26 | 000,169,344 | ---- | M] () -- C:\SpeedupOnlineInstall.exe
[2011/03/21 02:02:42 | 001,402,824 | ---- | M] (中国网络电视台-CNTV ) -- C:\speedup_setup_1.0.2.0.exe
[2011/10/01 15:35:00 | 000,002,154 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_16.33.15_log.txt
[2011/10/01 15:36:11 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_16.36.08_log.txt
[2011/10/01 16:52:52 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_17.52.37_log.txt
[2011/10/01 16:58:33 | 000,113,250 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_01.10.2011_17.56.59_log.txt
[2011/12/08 22:59:58 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_08.12.2011_22.59.54_log.txt
[2011/12/08 23:01:26 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_08.12.2011_23.01.12_log.txt
[2011/12/08 23:03:26 | 000,056,854 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_08.12.2011_23.02.55_log.txt
[2011/07/16 18:35:15 | 000,057,582 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_16.07.2011_19.33.37_log.txt
[2011/12/18 15:03:34 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_18.12.2011_15.03.07_log.txt
[2011/12/18 16:21:23 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_18.12.2011_16.20.58_log.txt
[2011/12/18 16:48:19 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_18.12.2011_16.47.58_log.txt
[2011/12/19 19:45:16 | 000,056,368 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_19.12.2011_19.44.53_log.txt
[2011/10/01 15:36:00 | 000,068,150 | ---- | M] () -- C:\TDSSKiller.2.6.2.0_01.10.2011_16.35.10_log.txt
[2011/10/01 15:37:23 | 000,068,150 | ---- | M] () -- C:\TDSSKiller.2.6.2.0_01.10.2011_16.36.48_log.txt
[2011/10/01 16:56:53 | 000,068,150 | ---- | M] () -- C:\TDSSKiller.2.6.2.0_01.10.2011_17.53.53_log.txt
[2011/12/08 23:01:01 | 000,067,080 | ---- | M] () -- C:\TDSSKiller.2.6.22.0_08.12.2011_23.00.33_log.txt
[2012/01/01 18:40:31 | 010,371,584 | ---- | M] () -- C:\YahooCam-Angelie montano 1.1.2012.avi
[2012/01/01 19:18:15 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.1.2012.1.avi
[2012/01/01 19:36:41 | 042,852,864 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.1.avi
[2012/01/01 19:11:27 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.1avi.avi
[2012/01/01 18:58:38 | 000,000,000 | ---- | M] () -- C:\YahooCam-Angelie montano1.2.2012.2.avi

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/08/16 03:42:12 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/09/12 20:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD83.DLL
[2006/09/12 20:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP83.DLL
[2003/07/29 09:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBCPP5C.DLL
[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 12:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/11/28 11:01:25 | 000,041,184 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2007/10/23 17:04:43 | 000,001,634 | -H-- | M] () -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2011/06/23 17:06:39 | 013,683,064 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 5.0.exe
[2011/06/28 21:17:30 | 000,744,853 | ---- | M] () -- C:\Program Files\PAVARK.exe
[2011/06/30 19:23:16 | 001,376,832 | ---- | M] () -- C:\Program Files\sar_15_sfx.exe
[2011/10/19 18:18:24 | 021,073,936 | ---- | M] () -- C:\Program Files\vlc-1.1.11-win32.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/08/16 03:27:08 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005/08/16 03:27:08 | 000,659,456 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005/08/16 03:27:08 | 000,876,544 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/07/30 16:49:14 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >
[2006/11/14 13:52:44 | 000,493,214 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\TRANSFORMS=1033.mst

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/03/25 17:16:59 | 000,000,170 | -HS- | M] () -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/01/01 15:46:16 | 004,702,720 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Jade Xing\Desktop\aswMBR.exe
[2012/01/01 16:17:57 | 004,360,044 | R--- | M] (Swearware) -- C:\Documents and Settings\Jade Xing\Desktop\ComboFix.exe
[2011/12/20 12:13:52 | 000,326,647 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\FSS.exe
[2010/07/09 12:48:14 | 156,607,328 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\OOo_3.2.0_Win32Intel_install_wJRE_en-US.exe
[2010/08/07 16:29:07 | 140,467,400 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\OOo_3.2.1_Win_x86_install_en-US.exe
[2012/01/02 17:03:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jade Xing\Desktop\OTL.exe
[2011/07/16 18:31:27 | 001,436,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Jade Xing\Desktop\tdsskiller.exe
[2011/12/28 20:56:17 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Desktop\v2vijehe.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/10 04:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/03/25 17:16:58 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Jade Xing\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/11/17 23:44:50 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Jade Xing\Cookies\desktop.ini
[2012/01/02 17:04:02 | 001,884,160 | ---- | M] () -- C:\Documents and Settings\Jade Xing\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 17:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 00:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 00:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 07:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 10:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 17:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 00:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 00:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 00:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 00:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 00:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

========== Files - Unicode (All) ==========
[2011/03/21 02:03:59 | 000,000,738 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV 网页点播加速器.lnk
[2011/03/21 02:03:59 | 000,000,720 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Desktop\CNTV 网页点播加速器.lnk
[2011/03/21 01:38:31 | 000,000,000 | ---D | M](C:\Documents and Settings\Jade Xing\My Documents\CBox???) -- C:\Documents and Settings\Jade Xing\My Documents\CBox加速器
[2011/03/21 01:38:31 | 000,000,000 | ---D | C](C:\Documents and Settings\Jade Xing\My Documents\CBox???) -- C:\Documents and Settings\Jade Xing\My Documents\CBox加速器
[2011/03/21 01:38:16 | 000,000,738 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\CNTV 网页点播加速器.lnk
[2011/03/21 01:38:16 | 000,000,720 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\CNTV ???????.lnk) -- C:\Documents and Settings\Jade Xing\Desktop\CNTV 网页点播加速器.lnk
[2011/02/21 01:41:09 | 000,000,196 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\PPS????????? - ????PPS????.url) -- C:\Documents and Settings\Jade Xing\Desktop\PPS网络电视官方下载站 - 免费下载PPS最新版本.url
[2011/02/14 09:03:32 | 000,002,970 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????.url) -- C:\Documents and Settings\Jade Xing\Desktop\世界新聞網.url
[2011/02/07 06:58:44 | 000,007,898 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国电视和录影饲料.url
[2011/01/24 00:15:13 | 000,003,904 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????? www.sinovision.net.url) -- C:\Documents and Settings\Jade Xing\Desktop\美国中文网 www.sinovision.net.url
[2011/01/24 00:14:17 | 000,000,208 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??? - ?? - ?? - ??????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\土豆网 - 视频 - 播客 - 每个人都是生活的导演.url
[2010/12/20 21:17:43 | 000,000,130 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\百度.url
[2010/10/09 16:03:16 | 000,000,130 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\百度.url
[2010/05/26 03:02:49 | 000,008,420 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??????? CCTV.com.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国中央电视台 CCTV.com.url
[2010/05/26 02:44:27 | 000,010,933 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\网易.url
[2010/05/26 02:19:52 | 000,000,234 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\雅虎首页.url
[2010/05/10 19:50:52 | 000,000,760 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS??.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS影音.lnk
[2010/04/24 22:40:12 | 000,002,970 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????.url) -- C:\Documents and Settings\Jade Xing\Desktop\世界新聞網.url
[2009/10/22 17:52:28 | 000,000,760 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS??.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\PPS影音.lnk
[2009/07/10 17:36:24 | 000,000,119 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?? Internet Explorer ???.url) -- C:\Documents and Settings\Jade Xing\Desktop\启动 Internet Explorer 浏览器.url
[2009/03/04 21:34:35 | 000,001,216 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\迅雷在线.url
[2009/02/13 17:32:27 | 000,000,119 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?? Internet Explorer ???.url) -- C:\Documents and Settings\Jade Xing\Desktop\启动 Internet Explorer 浏览器.url
[2009/01/31 22:43:26 | 000,003,904 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????? www.sinovision.net.url) -- C:\Documents and Settings\Jade Xing\Desktop\美国中文网 www.sinovision.net.url
[2009/01/31 22:41:38 | 000,000,196 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\PPS????????? - ????PPS????.url) -- C:\Documents and Settings\Jade Xing\Desktop\PPS网络电视官方下载站 - 免费下载PPS最新版本.url
[2009/01/25 17:10:21 | 000,001,216 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\迅雷在线.url
[2009/01/25 16:05:41 | 000,008,420 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??????? CCTV.com.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国中央电视台 CCTV.com.url
[2009/01/23 21:40:34 | 000,000,208 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??? - ?? - ?? - ??????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\土豆网 - 视频 - 播客 - 每个人都是生活的导演.url
[2009/01/18 20:17:10 | 000,000,158 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\???? - ??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中文论坛 - 东西南北论坛.url
[2009/01/18 20:11:14 | 000,003,983 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\搜狐首页.url
[2009/01/17 22:46:35 | 000,001,380 | ---- | M] ()(C:\Documents and Settings\All Users\Desktop\??????.lnk) -- C:\Documents and Settings\All Users\Desktop\很快视频搜索.lnk
[2009/01/17 22:46:35 | 000,001,380 | ---- | C] ()(C:\Documents and Settings\All Users\Desktop\??????.lnk) -- C:\Documents and Settings\All Users\Desktop\很快视频搜索.lnk
[2009/01/17 22:46:35 | 000,000,720 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,720 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) -- C:\Documents and Settings\Jade Xing\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,702 | ---- | M] ()(C:\Documents and Settings\All Users\Desktop\UUSee ????.lnk) -- C:\Documents and Settings\All Users\Desktop\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,702 | ---- | C] ()(C:\Documents and Settings\All Users\Desktop\UUSee ????.lnk) -- C:\Documents and Settings\All Users\Desktop\UUSee 网络电视.lnk
[2009/01/17 22:46:35 | 000,000,534 | ---- | M] ()(C:\Documents and Settings\All Users\Favorites\??????.lnk) -- C:\Documents and Settings\All Users\Favorites\很快视频搜索.lnk
[2008/11/12 18:56:36 | 000,430,560 | ---- | M] (ADA Software)(C:\WINDOWS\System32\pps????.scr) -- C:\WINDOWS\System32\pps影讯屏保.scr
[2008/11/12 18:56:36 | 000,430,560 | ---- | C] (ADA Software)(C:\WINDOWS\System32\pps????.scr) -- C:\WINDOWS\System32\pps影讯屏保.scr
[2008/09/06 20:56:16 | 000,000,861 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????-???????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国英语网－中国人学英语第一门户网.url
[2008/09/06 20:48:34 | 000,000,152 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\?????? .WWW.NETAT.NET..url) -- C:\Documents and Settings\Jade Xing\Desktop\金桥翻译中心 .WWW.NETAT.NET..url
[2008/01/03 19:36:19 | 000,004,981 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\Sivoo-??.url) -- C:\Documents and Settings\Jade Xing\Desktop\Sivoo-中文.url
[2007/07/28 18:22:56 | 000,000,861 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????-???????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国英语网－中国人学英语第一门户网.url
[2007/07/15 01:46:29 | 000,000,158 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\???? - ??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中文论坛 - 东西南北论坛.url
[2007/07/07 18:38:56 | 000,000,170 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\????---???????(??????????????)-???????--??????--??????--??????--???????-????--????---????---????.url) -- C:\Documents and Settings\Jade Xing\Desktop\翻译公司---中国专家翻译网(北京、上海、广州、西安、重庆)-华译网翻译公司--专业翻译公司--英文翻译公司--日文翻译公司--多语种翻译公司-英语翻译--日语翻译---德语翻译---法语翻译.url
[2007/06/23 22:11:36 | 000,000,152 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????? .WWW.NETAT.NET..url) -- C:\Documents and Settings\Jade Xing\Desktop\金桥翻译中心 .WWW.NETAT.NET..url
[2007/06/23 21:58:42 | 000,000,188 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\北京专家翻译.url
[2007/06/23 21:58:10 | 000,000,188 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??????.url) -- C:\Documents and Settings\Jade Xing\Desktop\北京专家翻译.url
[2007/06/23 21:19:06 | 000,000,170 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????---???????(??????????????)-???????--??????--??????--??????--???????-????--????---????---????.url) -- C:\Documents and Settings\Jade Xing\Desktop\翻译公司---中国专家翻译网(北京、上海、广州、西安、重庆)-华译网翻译公司--专业翻译公司--英文翻译公司--日文翻译公司--多语种翻译公司-英语翻译--日语翻译---德语翻译---法语翻译.url
[2007/04/01 18:04:30 | 000,004,981 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\Sivoo-??.url) -- C:\Documents and Settings\Jade Xing\Desktop\Sivoo-中文.url
[2007/04/01 17:52:09 | 000,000,282 | ---- | M] ()(C:\Documents and Settings\Jade Xing\Desktop\???????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国互联网电视.url
[2007/04/01 17:52:09 | 000,000,282 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\???????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国互联网电视.url
[2007/04/01 17:42:57 | 000,007,898 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\?????????.url) -- C:\Documents and Settings\Jade Xing\Desktop\中国电视和录影饲料.url
[2007/03/28 20:11:27 | 000,010,933 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\??.url) -- C:\Documents and Settings\Jade Xing\Desktop\网易.url
[2007/03/28 20:10:55 | 000,003,983 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\搜狐首页.url
[2007/03/25 17:26:02 | 000,000,234 | ---- | C] ()(C:\Documents and Settings\Jade Xing\Desktop\????.url) -- C:\Documents and Settings\Jade Xing\Desktop\雅虎首页.url
(C:\Documents and Settings\All Users\Start Menu\Programs\UUSee ????) -- C:\Documents and Settings\All Users\Start Menu\Programs\UUSee 网络电视
(C:\Documents and Settings\All Users\Start Menu\Programs\???????-CNTV) -- C:\Documents and Settings\All Users\Start Menu\Programs\中国网络电视台-CNTV
(C:\Documents and Settings\All Users\Start Menu\Programs\?????) -- C:\Documents and Settings\All Users\Start Menu\Programs\百度地址栏

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Jade Xing\Desktop\OTL.com:SummaryInformation
@Alternate Data Stream - 20 bytes -> C:\Program Files\PAVARK.exe:License

< End of report >

 

[Broni]

I still need Extras.txt.

You didn't say if you're having any current issues.

 

[jhdroge]

I did a search on my computer (Extra) and no extras.txt
Tjhere is still that MSE as far as I know lurking out there but I am not having any issues currently that I can see. My computer has really speeded up since I have been doing as you direct. I downloaded the OTL and clicked the "scan all users" copied and pasted what was on you post in the "custom scan" and d/n change anything else like you said and clicked "qiuck scan" and otl'txt is all that popped open and the file on mu desk top and I sent them both even though to me they looked the same. No Extras.txt, Should I delete OTL redownload and run again with the same settings and same paste to "custom scan"??

 

[Broni]

Good news

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
  IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
  IE - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
  O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
  O9 - Extra Button: 很快视频搜索 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel File not found
  O9 - Extra 'Tools' menuitem : 很快视频搜索 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel File not found
  O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: //@install.mar@/ ([]msni in My Computer)
  O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: //@mail.mar@/ ([]msni in Local intranet)
  O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
  O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: pps.tv ([]http in Trusted sites)
  O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: ppstream.com ([]http in Trusted sites)
  O15 - HKU\S-1-5-21-2166645397-1413220193-206111531-1006\..Trusted Domains: webscache.com ([]http in Trusted sites)
  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
  [2010/09/11 10:29:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Osetakoboxag.bin
  [2010/09/11 10:29:25 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Wqelaruyuqidefay.dat
  [2010/05/26 01:01:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
  [2011/02/26 03:35:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\lOpDhPg05200
  [2006/11/14 13:55:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
  [2010/05/23 11:46:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jade Xing\Application Data\Uniblue
  @Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Jade Xing\Desktop\OTL.com:SummaryInformation
  @Alternate Data Stream - 20 bytes -> C:\Program Files\PAVARK.exe:License
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.

=============================================================

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.

=============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  
  NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Tick the box next to YES, I accept the Terms of Use
• Click Start
• Accept any security warnings from your browser.
• Check Scan archives
• Click Start
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click on List of found threats
• Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• NOTE. If Eset won't find any threats, it won't produce any log.

 

[jhdroge]

On OTL do I click the Scan All Users again?
Do I close all windows again?
I assume I would do so but you did not specify.
Since Avast d/n like OTL should I disable Avast?
If I disable Avast Is it OK if I unplug my pc from the internet (I d/n like disabling my antivirus and being connected)

 

[Broni]

It's a good idea to disable Avast.
Close other open programs as well.
You click on "Fix" button, not "Scan" button.

 

[jhdroge]

pYeah but what about the "scan all users" in the upeer settings? or does this not apply when doing the "fix"

 

[Broni]

Don't change anything.
Simply run the "Fix".

 

[jhdroge]

OK
With the copied in the custom

 

[Broni]

Yes................

 

[jhdroge]

Hers's the OTL Log and I will continue from here probably tomorrow

All processes killed
========== OTL ==========
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
HKU\S-1-5-21-2166645397-1413220193-206111531-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{998A88A0-A355-809B-831C-B83A80000991}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{998A88A0-A355-809B-831C-B83A80000991}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{998A88A0-A355-809B-831C-B83A80000991}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{998A88A0-A355-809B-831C-B83A80000991}\ not found.
Registry key HKEY_USERS\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//@install.mar@/\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//@mail.mar@/\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ttlc\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\pps.tv\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ppstream.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2166645397-1413220193-206111531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webscache.com\ deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\WINDOWS\Osetakoboxag.bin moved successfully.
C:\WINDOWS\Wqelaruyuqidefay.dat moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9 folder moved successfully.
Folder C:\Documents and Settings\All Users\Application Data\lOpDhPg05200\ not found.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome\BH00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
C:\Documents and Settings\Jade Xing\Application Data\Uniblue\RegistryBooster folder moved successfully.
C:\Documents and Settings\Jade Xing\Application Data\Uniblue\Registry Booster2 folder moved successfully.
C:\Documents and Settings\Jade Xing\Application Data\Uniblue folder moved successfully.
ADS C:\Documents and Settings\Jade Xing\Desktop\OTL.com:SummaryInformation deleted successfully.
ADS C:\Program Files\PAVARK.exe:License deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Flash cache emptied: 470 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Jade Xing
->Temp folder emptied: 530791 bytes
->Temporary Internet Files folder emptied: 332495958 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 53488502 bytes
->Google Chrome cache emptied: 217740923 bytes
->Flash cache emptied: 38738 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 8175750 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 49768 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 112094 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 35293 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18397 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
RecycleBin emptied: 743214 bytes

Total Files Cleaned = 585.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: Jade Xing
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 01052012_194444

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

 

[jhdroge]

JavaRa Log

 

[jhdroge]

logs

Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
avast! Free Antivirus
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Sophos Anti-Rootkit 1.5.4
Java(TM) 6 Update 16
Out of date Java installed!
Adobe Flash Player ( 10.3.183.5) Flash Player Out of Date!
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastUI.exe
``````````End of Log````````````

ESET

C:\Documents and Settings\Jade Xing\Application Data\33A3E635C4EC1D1876E3149E3EFDE0AA\enemies-names.txt Win32/Adware.AntimalwareDoctor.AE.Gen application
C:\Documents and Settings\Jade Xing\Application Data\33A3E635C4EC1D1876E3149E3EFDE0AA\local.ini Win32/Adware.AntimalwareDoctor.AE.Gen application
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\_Setupx.dll.vir a variant of Win32/Adware.Yontoo.B application
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1831\A0274359.exe a variant of Win32/Kryptik.XOZ trojan
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1831\A0274360.exe a variant of Win32/Kryptik.XOZ trojan
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1851\A0279395.dll a variant of Win32/Adware.Yontoo.B application
C:\WINDOWS\system32\234.js JS/TrojanDownloader.Agent.NWG trojan
C:\WINDOWS\system32\235.js JS/TrojanDownloader.Agent.NWG trojan

 

[Broni]

It doesn't look like you update Java.
Please do it now.

Also....

Update Adobe Flash Player
Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/...-flash-for-firefox-and-ie-without-any-extras/

 

[jhdroge]

I'll do the JAVA Update again. I did do it before and I was surprised when in the process it did not have any of those "extras" that I would have to uncheck - maybe I d/n get a good update. What about the warnings that ESAT reported??

 

[Broni]

If you haven't changed Eset settings those entries would be removed.
Now you have to remove them manually.
Empty Recycle Bin afterwards.

it did not have any of those "extras"

They won't have to be there. I say this "just in case" there are some.

 

[jhdroge]

I did the java update again and again it gave me java 6. I did the remover for old java again also and deleted those files Eset found and emptied the recycle bin

 

[Broni]

Post new Security Check log.

 

[jhdroge]

Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
avast! Free Antivirus
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Sophos Anti-Rootkit 1.5.4
Java(TM) 6 Update 16
Out of date Java installed!
Adobe Flash Player ( 10.3.183.5) Flash Player Out of Date!
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastUI.exe
``````````End of Log``````````

 

[Broni]

Go here: https://www.techspot.com/downloads/6463-java-se.html, download standalone Java installer - Windows Offline .
See if it'll install.
Post new Security Check log.