Trojan Horse virus help needed please

• I f you don't know or understand something please don't hesitate to ask
• Please DO NOT run any other tools or scans whilst I am helping you.
• It is important that you reply to this thread. Do not start a new topic.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• Absence of symptoms does not mean that everything is clear.

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)

• Go to VirusTotal or Jotti's

• Copy/Paste file into the white Upload a file box.
• Click Send/Submit, and the file will upload to VirusTotal/Jotti, where it will be scanned by several anti-virus programmes.
• After a while, a window will open, with details of what the scans found.
• Repeat for all files on the list, and post me the details please

When finished, it will produce a report for you.

• Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.

File::

c:\windows\system32\9cczthief55.dll



Driver::

cpuz129

• Open Malwarebytes' Anti-Malware
• Select the Update tab
• Click Check for Updates
• After the update have been completed, Select the Scanner tab.
• Make sure the "Perform Full Scan" option is selected.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

• Right click on gmer.zip and select Extract All....
• Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
• Click on the Browse button. Click on Desktop. Then click OK.
• Click Next. It will start extracting.
• Once done, check (tick) the Show extracted files box and click Finish.
• Double click on gmer.exe to run it.
• Select the Rootkit tab.
• On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click on the Scan button.
• When the scan is finished, click Copy to save the scan log to the Windows clipboard.
• Open Notepad or a similar text editor.
• Paste the clipboard contents into the text editor.
• Save the Gmer scan log and post it in your next reply.
• Close Gmer.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  
  
  :reg
  
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
  
  
  
   

  
  
• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

• Download OTS by Oldtimer to your Desktop and double-click on it to extract the files.
  
  
  NOTE: You must be logged on to the system with an account that has Administrator privileges to run this program.
  
  
• Close ALL OTHER PROGRAMS.
• Double-click on OTS.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
• Click the Scan All Users checkbox on the toolbar.
• Do not change any other settings.
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
• Close Notepad (saving the change if necessry).

OTS logfile created on: 16/06/2009 22:08:20 - Run 1

OTS by OldTimer - Version 3.0.5.3     Folder = C:\Documents and Settings\MUM\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.11)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

 

1021.98 Mb Total Physical Memory | 623.34 Mb Available Physical Memory | 60.99% Memory free

1.28 Gb Paging File | 0.99 Gb Available in Paging File | 77.18% Paging File free

Paging file location(s): C:\pagefile.sys 384 768 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 74.53 Gb Total Space | 3.09 Gb Free Space | 4.15% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: GAYNA

Current User Name: MUM

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: Off

File Age = 30 Days

 

[Processes - Safe List]

applemobiledeviceservice.exe -> C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2009/03/26 15:31:20 | 00,132,424 | ---- | M] (Apple Inc.)

avgnsx.exe -> C:\Program Files\AVG\AVG8\avgnsx.exe -> [2009/06/08 21:13:25 | 00,594,712 | ---- | M] (AVG Technologies CZ, s.r.o.)

avgrsx.exe -> C:\Program Files\AVG\AVG8\avgrsx.exe -> [2009/06/08 21:13:25 | 00,486,680 | ---- | M] (AVG Technologies CZ, s.r.o.)

avgtray.exe -> C:\Program Files\AVG\AVG8\avgtray.exe -> [2009/06/08 21:13:23 | 01,947,928 | ---- | M] (AVG Technologies CZ, s.r.o.)

avgwdsvc.exe -> C:\Program Files\AVG\AVG8\avgwdsvc.exe -> [2009/06/08 21:13:22 | 00,298,776 | ---- | M] (AVG Technologies CZ, s.r.o.)

blueyonder-istnotifier.exe -> C:\Program Files\blueyonder IST\SmartBridge\blueyonder-istnotifier.exe -> [2005/09/22 09:05:40 | 00,438,359 | ---- | M] (Motive Communications, Inc.)

brss01a.exe -> C:\WINDOWS\System32\brss01a.exe -> [2001/12/13 00:01:00 | 00,045,056 | ---- | M] (brother Industries Ltd)

brsvc01a.exe -> C:\WINDOWS\System32\brsvc01a.exe -> [2002/04/12 00:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd)

dvpapi.exe -> C:\Program Files\Common Files\Command Software\dvpapi.exe -> [2007/04/27 19:07:52 | 00,177,688 | R--- | M] (Authentium, Inc.)

explorer.exe -> C:\WINDOWS\Explorer.EXE -> [2008/04/14 01:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation)

fws.exe -> C:\Program Files\Virgin Broadband\PCguard\fws.exe -> [2007/01/24 19:53:22 | 00,316,920 | ---- | M] (Radialpoint Inc.)

hpqbam08.exe -> C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe -> [2007/10/19 21:46:08 | 00,610,304 | ---- | M] (Hewlett-Packard Co.)

hpqgpc01.exe -> C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe -> [2007/11/02 21:12:50 | 00,262,144 | ---- | M] (Hewlett-Packard)

hpqste08.exe -> C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe -> [2007/10/19 21:46:08 | 00,184,320 | ---- | M] (Hewlett-Packard Co.)

hpwuschd2.exe -> C:\Program Files\HP\HP Software Update\HPWuSchd2.exe -> [2007/10/14 22:17:32 | 00,049,152 | ---- | M] (Hewlett-Packard)

ipodservice.exe -> C:\Program Files\iPod\bin\iPodService.exe -> [2009/04/02 16:10:56 | 00,656,168 | ---- | M] (Apple Inc.)

ituneshelper.exe -> C:\Program Files\iTunes\iTunesHelper.exe -> [2009/04/02 16:11:02 | 00,342,312 | ---- | M] (Apple Inc.)

jusched.exe -> C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe -> [2008/06/10 04:27:04 | 00,144,784 | ---- | M] (Sun Microsystems, Inc.)

mdnsresponder.exe -> C:\Program Files\Bonjour\mDNSResponder.exe -> [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.)

ots.exe -> C:\Documents and Settings\MUM\Desktop\OTS.exe -> [2009/06/16 22:06:31 | 00,507,392 | ---- | M] (OldTimer Tools)

wlservice.exe -> C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe -> [2005/07/04 16:46:04 | 00,053,307 | ---- | M] (GEMTEKS)

wusb54gsv2.exe -> C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54GSv2.exe -> [2006/02/23 07:59:18 | 05,203,968 | ---- | M] (Linksys)

 

[Win32 Services - Safe List]

(Apple Mobile Device) Apple Mobile Device [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2009/03/26 15:31:20 | 00,132,424 | ---- | M] (Apple Inc.)

(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -> [2007/10/24 01:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation)

(avg8wd) AVG Free8 WatchDog [Win32_Own | Auto | Running] -> C:\Program Files\AVG\AVG8\avgwdsvc.exe -> [2009/06/08 21:13:22 | 00,298,776 | ---- | M] (AVG Technologies CZ, s.r.o.)

(Bonjour Service) Bonjour Service [Win32_Own | Auto | Running] -> C:\Program Files\Bonjour\mDNSResponder.exe -> [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.)

(Brother XP spl Service) BrSplService [Win32_Own | Auto | Running] -> C:\WINDOWS\System32\brsvc01a.exe -> [2002/04/12 00:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd)

(clr_optimization_v2.0.50727_32) .NET Runtime Optimization Service v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2007/10/24 01:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation)

(dvpapi) dvpapi [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\Command Software\dvpapi.exe -> [2007/04/27 19:07:52 | 00,177,688 | R--- | M] (Authentium, Inc.)

(FontCache3.0.0.0) Windows Presentation Foundation Font Cache 3.0.0.0 [Win32_Own | On_Demand | Stopped] -> c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -> [2006/10/20 21:21:24 | 00,036,864 | ---- | M] (Microsoft Corporation)

(helpsvc) Help and Support [Win32_Shared | Auto | Running] -> C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -> [2008/04/14 01:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation)

(hpqcxs08) hpqcxs08 [Win32_Shared | On_Demand | Running] -> C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -> [2007/11/06 22:16:54 | 00,217,088 | ---- | M] (Hewlett-Packard Co.)

(hpqddsvc) HP CUE DeviceDiscovery Service [Win32_Shared | Auto | Running] -> C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -> [2007/11/06 22:16:54 | 00,139,264 | ---- | M] (Hewlett-Packard Co.)

(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -> [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation)

(idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -> [2006/10/30 03:33:58 | 00,741,376 | ---- | M] (Microsoft Corporation)

(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files\iPod\bin\iPodService.exe -> [2009/04/02 16:10:56 | 00,656,168 | ---- | M] (Apple Inc.)

(LPDSVC) TCP/IP Print Server [Win32_Shared | On_Demand | Stopped] -> C:\WINDOWS\System32\tcpsvcs.exe -> [2002/08/29 13:00:00 | 00,019,456 | ---- | M] (Microsoft Corporation)

(Net Driver HPZ12) Net Driver HPZ12 [Win32_Own | Auto | Running] -> C:\WINDOWS\System32\HPZinw12.dll -> [2008/07/18 13:13:20 | 00,044,032 | ---- | M] (Hewlett-Packard)

(NetTcpPortSharing) Net.Tcp Port Sharing Service [Win32_Shared | Disabled | Stopped] -> C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -> [2006/10/30 03:34:02 | 00,122,880 | ---- | M] (Microsoft Corporation)

(Pml Driver HPZ12) Pml Driver HPZ12 [Win32_Own | Auto | Running] -> C:\WINDOWS\System32\HPZipm12.dll -> [2008/07/18 13:13:20 | 00,053,760 | ---- | M] (Hewlett-Packard)

(RP_FWS) PCguard Firewall [Win32_Own | Auto | Running] -> C:\Program Files\Virgin Broadband\PCguard\fws.exe -> [2007/01/24 19:53:22 | 00,316,920 | ---- | M] (Radialpoint Inc.)

(usnjsvc) Messenger Sharing Folders USN Journal Reader service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\MSN Messenger\usnsvc.exe -> [2007/01/19 12:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation)

(WMPNetworkSvc) Windows Media Player Network Sharing Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Windows Media Player\WMPNetwk.exe -> [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation)

(WUSB54GSv2SVC) WUSB54GSv2SVC [Win32_Own | Auto | Running] ->  -> File not found

 

[Driver Services - Safe List]

(AegisP) AEGIS Protocol (IEEE 802.1x) v3.2.0.3 [Kernel | Auto | Running] -> C:\WINDOWS\System32\DRIVERS\AegisP.sys -> [2008/06/25 17:12:10 | 00,017,801 | ---- | M] (Meetinghouse Data Communications)

(ALCXWDM) Service for Realtek AC97 Audio (WDM) [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\ALCXWDM.SYS -> [2003/06/19 08:30:18 | 00,752,764 | ---- | M] (Realtek Semiconductor Corp.)

(ASCTRM) ASCTRM [Kernel | Auto | Running] -> C:\WINDOWS\System32\drivers\asctrm.sys -> [2002/01/01 23:27:55 | 00,008,552 | ---- | M] (Windows (R) 2000 DDK provider)

(Aspi32) Aspi32 [Kernel | Auto | Running] -> C:\WINDOWS\System32\drivers\ASPI32.sys -> [1999/09/10 12:06:00 | 00,025,244 | R--- | M] (Adaptec)

(AvgLdx86) AVG Free AVI Loader Driver x86 [Kernel | System | Running] -> C:\WINDOWS\System32\Drivers\avgldx86.sys -> [2009/06/08 21:13:45 | 00,325,896 | ---- | M] (AVG Technologies CZ, s.r.o.)

(AvgMfx86) AVG Free On-access Scanner Minifilter Driver x86 [File_System | System | Running] -> C:\WINDOWS\System32\Drivers\avgmfx86.sys -> [2009/06/08 21:13:43 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.)

(AvgTdiX) AVG Free8 Network Redirector [Kernel | System | Running] -> C:\WINDOWS\System32\Drivers\avgtdix.sys -> [2009/06/08 21:13:47 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.)

(BrScnUsb) Brother USB Still Image driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\Drivers\BrScnUsb.sys -> [2004/10/15 12:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.)

(BrSerIf) Brother MFC Serial Port Interface WDM Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\Drivers\BrSerIf.sys -> [2004/09/29 03:24:38 | 00,051,712 | ---- | M] (Brother Industries Ltd.)

(BrUsbSer) Brother MFC USB Serial WDM Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\Drivers\BrUsbSer.sys -> [2004/01/10 04:28:18 | 00,011,648 | ---- | M] (Brother Industries Ltd.)

(Cdr4_xp) Cdr4_xp [Kernel | System | Running] -> C:\WINDOWS\System32\drivers\cdr4_xp.sys -> [2005/09/07 13:29:44 | 00,044,288 | ---- | M] (Sonic Solutions)

(Cdralw2k) Cdralw2k [Kernel | System | Running] -> C:\WINDOWS\System32\drivers\cdralw2k.sys -> [2005/09/07 13:32:58 | 00,024,960 | ---- | M] (Sonic Solutions)

(CSS DVP) CSS DVP [Kernel | Auto | Running] -> C:\WINDOWS\System32\DRIVERS\css-dvp.sys -> [2007/04/27 18:49:12 | 00,840,352 | R--- | M] (Authentium, Inc.)

(Freedom) Freedom Miniport [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\FREEDOM.SYS -> [2003/09/24 09:23:56 | 00,033,408 | ---- | M] (Zero-Knowledge Systems Inc.)

(FreeTdi) Radialpoint Filter (RPS-12798) [Kernel | Auto | Running] -> C:\WINDOWS\System32\Drivers\FreeTdi.sys -> [2006/01/11 14:58:38 | 00,054,840 | ---- | M] (Radialpoint Inc.)

(gbalink) GBA Link Driver (gbalink.sys) [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\Drivers\gbalink.sys -> [2001/03/08 11:15:10 | 00,019,677 | R--- | M] (Thesycon GmbH, Germany)

(GEARAspiWDM) GEAR ASPI Filter Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys -> [2009/03/19 16:32:48 | 00,023,400 | ---- | M] (GEAR Software Inc.)

(HPZid412) IEEE-1284.4 Driver HPZid412 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\HPZid412.sys -> [2007/10/30 03:25:53 | 00,049,920 | R--- | M] (HP)

(HPZipr12) Print Class Driver for IEEE-1284.4 HPZipr12 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\HPZipr12.sys -> [2007/10/30 03:25:54 | 00,016,496 | R--- | M] (HP)

(HPZius12) USB to IEEE-1284.4 Translation Driver HPZius12 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\HPZius12.sys -> [2007/10/30 03:25:55 | 00,021,568 | R--- | M] (HP)

(HSFHWBS2) HSFHWBS2 [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys -> [2002/02/13 19:27:30 | 00,166,419 | ---- | M] (Conexant Systems)

(HSF_DP) HSF_DP [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\HSF_DP.sys -> [2002/02/13 19:26:54 | 01,171,584 | ---- | M] (Conexant Systems)

(ialm) ialm [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\ialmnt5.sys -> [2003/04/15 03:39:46 | 00,090,907 | ---- | M] (Intel Corporation)

(mdmxsdk) mdmxsdk [Kernel | Auto | Running] -> C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys -> [2001/10/22 22:46:42 | 00,009,855 | ---- | M] (Conexant)

(MRENDIS5) MRENDIS5 NDIS Protocol Driver [Kernel | On_Demand | Stopped] -> C:\Program Files\Common Files\Motive\MRENDIS5.sys -> [2004/11/22 17:36:40 | 00,018,003 | ---- | M] (Motive, Inc.)

(Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\ptilink.sys -> [2002/08/29 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.)

(PxHelp20) PxHelp20 [Kernel | Boot | Running] -> C:\WINDOWS\system32\DRIVERS\PxHelp20.sys -> [2003/10/28 11:02:00 | 00,020,016 | ---- | M] (Sonic Solutions)

(rtl8139) Realtek RTL8139/810X Family PCI Fast Ethernet NIC NT Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\RTL8139.SYS -> [2003/07/11 03:37:00 | 00,025,434 | ---- | M] (Realtek Semiconductor Corporation                                                )

(Secdrv) Secdrv [Kernel | Auto | Running] -> C:\WINDOWS\System32\DRIVERS\secdrv.sys -> [2007/11/13 11:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

(STEC3) STEC3 [Kernel | Auto | Running] -> C:\WINDOWS\System32\STEC3.sys -> [2004/06/24 13:10:16 | 00,002,368 | ---- | M] (AntiCracking)

(USB_RNDIS) Linksys Wireless-G USB Network Adapter with SpeedBooster Driver v2 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\usb8023.sys -> [2008/04/13 19:56:49 | 00,012,800 | ---- | M] (Microsoft Corporation)

(winachsf) winachsf [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys -> [2002/02/13 19:20:46 | 00,594,032 | ---- | M] (Conexant Systems)

({6080A529-897E-4629-A488-ABA0C29B635E}) Intel(R) Graphics Platform (SoftBIOS) Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\ialmsbw.sys -> [2003/04/15 03:40:54 | 00,113,504 | ---- | M] (Intel Corporation)

({D31A0762-0CEB-444e-ACFF-B049A1F6FE91}) Intel(R) Graphics Chipset (KCH) Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\ialmkchw.sys -> [2003/04/15 03:40:46 | 00,078,752 | ---- | M] (Intel Corporation)

(GTNDIS5) GTNDIS5 NDIS Protocol Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\GTNDIS5.SYS -> [2003/09/26 13:15:32 | 00,015,872 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA))

 

[Registry - Safe List]

< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 

HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 

HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 

HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" ->  [binary data] -> 

HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> 

HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 

HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 

HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> 

HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 

HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 

HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> 

< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> 

HKEY_USERS\.DEFAULT\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 

HKEY_USERS\.DEFAULT\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> 

HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> 

HKEY_USERS\S-1-5-18\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 

HKEY_USERS\S-1-5-18\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> 

HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> 

HKEY_USERS\S-1-5-19\: Main\\"Start Page" -> http://www.freeserve.co.uk -> 

HKEY_USERS\S-1-5-19\: "ProxyEnable" -> 0 -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> 

HKEY_USERS\S-1-5-20\: Main\\"Start Page" -> http://www.freeserve.co.uk -> 

HKEY_USERS\S-1-5-20\: "ProxyEnable" -> 0 -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\] > -> -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: Main\\"Page_Transitions" -> 1 -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: Main\\"SearchMigratedDefaultName" -> Google -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: Main\\"SearchMigratedDefaultURL" -> http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: Main\\"Start Page" -> http://www.medway-magic.org/ -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: SearchURL\\"" -> http://home.microsoft.com/access/autosearch.asp?p=%s -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: "ProxyEnable" -> 0 -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\: "ProxyOverride" -> 127.0.0.1;localhost;*.local -> 

< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla

HKLM\software\mozilla\Firefox\Extensions ->  -> 

< FireFox Extensions [User Folders] > -> 

< HOSTS File > (27 bytes and 1 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 

Reset Hosts

127.0.0.1       localhost

< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 

{0347C33E-8762-4905-BF09-768834316C61} [HKLM] -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [HP Print Enhancer] -> [2007/11/06 02:50:44 | 00,322,880 | ---- | M] (Hewlett-Packard Co.)

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [Adobe PDF Link Helper] -> [2008/06/11 23:33:16 | 00,075,128 | ---- | M] (Adobe Systems Incorporated)

{243B17DE-77C7-46BF-B94B-0B5F309A0E64} [HKLM] -> C:\Program Files\Microsoft Money\System\mnyside.dll [Reg Error: Value error.] -> [2002/07/17 12:00:00 | 00,163,906 | ---- | M] (Microsoft Corporation)

{3C060EA2-E6A9-4E49-A530-D4657B8C449A} [HKLM] -> C:\Program Files\Virgin Broadband\PCguard\pkR.dll [PopKill Class] -> [2007/01/24 19:51:24 | 00,049,152 | ---- | M] (Radialpoint Inc.)

{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} [HKLM] -> C:\Program Files\AVG\AVG8\avgssie.dll [AVG Safe Search] -> [2009/06/08 21:13:27 | 01,107,224 | ---- | M] (AVG Technologies CZ, s.r.o.)

{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [] -> [2004/05/12 01:03:00 | 00,744,960 | ---- | M] (Safer Networking Limited)

{56071E0D-C61B-11D3-B41C-00E02927A304} [HKLM] -> C:\Program Files\Virgin Broadband\PCguard\FBHR.dll [ZKBho Class] -> [2007/01/24 19:51:24 | 00,135,168 | ---- | M] (Radialpoint Inc.)

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [SSVHelper Class] -> [2008/06/10 04:27:02 | 00,509,328 | ---- | M] (Sun Microsystems, Inc.)

{7E853D72-626A-48EC-A868-BA8D5E23E045} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

{9030D464-4C02-4ABF-8ECC-5164760863C6} [HKLM] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Windows Live Sign-in Helper] -> [2006/08/31 20:33:06 | 00,322,368 | ---- | M] (Microsoft Corporation)

{FDD3B846-8D59-4ffb-8758-209B6AD74ACC} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} [HKLM] -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [HP Smart BHO Class] -> [2007/11/06 02:50:44 | 00,542,016 | ---- | M] (Hewlett-Packard Co.)

< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 

"SITEguard" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

< Internet Explorer ToolBars [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\ -> 

WebBrowser\\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

WebBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

< Internet Explorer ToolBars [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\ -> 

WebBrowser\\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

WebBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\Software\Microsoft\Internet Explorer\Toolbar\ -> 

ShellBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

WebBrowser\\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

WebBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 

"Adobe Reader Speed Launcher" -> C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe ["C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"] -> [2008/06/12 03:38:00 | 00,034,672 | ---- | M] (Adobe Systems Incorporated)

"AppleSyncNotifier" -> C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe] -> [2008/09/03 20:12:50 | 00,111,936 | ---- | M] (Apple Inc.)

"AVG8_TRAY" -> C:\Program Files\AVG\AVG8\avgtray.exe [C:\PROGRA~1\AVG\AVG8\avgtray.exe] -> [2009/06/08 21:13:23 | 01,947,928 | ---- | M] (AVG Technologies CZ, s.r.o.)

"BluetoothAuthenticationAgent" -> C:\WINDOWS\System32\bthprops.cpl [rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent] -> [2008/04/14 02:12:42 | 00,110,592 | ---- | M] (Microsoft Corporation)

"ControlCenter2.0" -> C:\Program Files\Brother\ControlCenter2\brctrcen.exe [C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun] -> [2005/05/17 17:42:32 | 00,933,888 | ---- | M] (Brother Industries, Ltd.)

"HP Software Update" -> C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [C:\Program Files\HP\HP Software Update\HPWuSchd2.exe] -> [2007/10/14 22:17:32 | 00,049,152 | ---- | M] (Hewlett-Packard)

"hpqSRMon" -> C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe] -> [2007/08/22 17:31:16 | 00,080,896 | ---- | M] (Hewlett-Packard)

"IndexSearch" -> C:\Program Files\Scansoft\PaperPort\IndexSearch.exe [C:\Program Files\Scansoft\PaperPort\IndexSearch.exe] -> [2005/03/17 14:45:52 | 00,040,960 | ---- | M] (ScanSoft, Inc.)

"iTunesHelper" -> C:\Program Files\iTunes\iTunesHelper.exe ["C:\Program Files\iTunes\iTunesHelper.exe"] -> [2009/04/02 16:11:02 | 00,342,312 | ---- | M] (Apple Inc.)

"Motive SmartBridge" -> C:\Program Files\blueyonder IST\SmartBridge\blueyonder-istnotifier.exe [C:\PROGRA~1\BLUEYO~1\SMARTB~1\blueyonder-istnotifier.exe] -> [2005/09/22 09:05:40 | 00,438,359 | ---- | M] (Motive Communications, Inc.)

"NeroFilterCheck" -> C:\WINDOWS\System32\NeroCheck.exe [C:\WINDOWS\system32\NeroCheck.exe] -> [2001/07/09 12:50:42 | 00,155,648 | ---- | M] (Ahead Software Gmbh)

"OneTouch Monitor" -> C:\Program Files\Xerox One Touch\OneTouchMon.exe ["C:\Program Files\Xerox One Touch\OneTouchMon.exe"] -> [2003/06/12 16:14:00 | 00,086,016 | ---- | M] (Visioneer Inc)

"QuickTime Task" -> C:\Program Files\QuickTime\qttask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> [2009/05/26 17:18:30 | 00,413,696 | ---- | M] (Apple Inc.)

"SetDefPrt" -> C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe [C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe] -> [2005/01/26 18:02:22 | 00,049,152 | ---- | M] (Brother Industories, Ltd.)

"SSBkgdUpdate" -> C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe ["C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot] -> [2003/10/14 10:22:30 | 00,155,648 | R--- | M] (Scansoft, Inc.)

"SunJavaUpdateSched" -> C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"] -> [2008/06/10 04:27:04 | 00,144,784 | ---- | M] (Sun Microsystems, Inc.)

< Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 

"Symantec NetDriver Warning" -> C:\Program Files\SymNetDrv\SNDWarn.exe [C:\PROGRA~1\SYMNET~1\SNDWarn.exe] -> [2004/10/29 09:52:14 | 00,218,232 | ---- | M] (Symantec Corporation)

< Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 

"Symantec NetDriver Warning" -> C:\Program Files\SymNetDrv\SNDWarn.exe [C:\PROGRA~1\SYMNET~1\SNDWarn.exe] -> [2004/10/29 09:52:14 | 00,218,232 | ---- | M] (Symantec Corporation)

< Run [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 

"Microsoft Works Update Detection" -> c:\Program Files\Microsoft Works\WkDetect.exe [c:\Program Files\Microsoft Works\WkDetect.exe] -> [2000/07/13 21:00:00 | 00,028,739 | ---- | M] (Microsoft® Corporation)

< Administrator Startup Folder > -> C:\Documents and Settings\Administrator\Start Menu\Programs\Startup -> 

< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk -> C:\Program Files\BigFix\BigFix.exe -> [2002/07/31 11:22:26 | 01,742,384 | ---- | M] (BigFix Inc.)

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe -> [2007/10/14 21:38:52 | 00,214,360 | ---- | M] (Hewlett-Packard Co.)

< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup -> 

< HEIDI Startup Folder > -> C:\Documents and Settings\HEIDI\Start Menu\Programs\Startup -> 

< MUM Startup Folder > -> C:\Documents and Settings\MUM\Start Menu\Programs\Startup -> 

C:\Documents and Settings\MUM\Start Menu\Programs\Startup\WordWeb.lnk -> C:\Program Files\WordWeb\wweb32.exe -> [2005/08/29 16:10:34 | 00,019,968 | ---- | M] (Antony Lewis)

< OLIVER Startup Folder > -> C:\Documents and Settings\OLIVER\Start Menu\Programs\Startup -> 

< Software Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer -> 

< Software Policy Settings [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Policies\Microsoft\Internet Explorer -> 

< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"HonorAutoRunSetting" ->  [1] -> File not found

\\"NoDriveAutoRun" ->  [67108863] -> File not found

\\"NoDriveTypeAutoRun" ->  [323] -> File not found

\\"NoDrives" ->  [0] -> File not found

< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System

\\"dontdisplaylastusername" ->  [0] -> File not found

\\"legalnoticecaption" ->  [] -> File not found

\\"legalnoticetext" ->  [] -> File not found

\\"shutdownwithoutlogon" ->  [1] -> File not found

\\"undockwithoutlogon" ->  [1] -> File not found

\\"DisableRegistryTools" ->  [0] -> File not found

< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"NoDriveTypeAutoRun" ->  [323] -> File not found

\\"CDRAutoRun" ->  [0] -> File not found

\\"NoDriveAutoRun" ->  [67108863] -> File not found

< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"NoDriveTypeAutoRun" ->  [323] -> File not found

\\"CDRAutoRun" ->  [0] -> File not found

\\"NoDriveAutoRun" ->  [67108863] -> File not found

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"NoDriveTypeAutoRun" ->  [145] -> File not found

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"NoDriveTypeAutoRun" ->  [145] -> File not found

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"NoDriveTypeAutoRun" ->  [323] -> File not found

\\"NoDriveAutoRun" ->  [67108863] -> File not found

\\"NoDrives" ->  [0] -> File not found

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} [HKLM] -> C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll [Menu: Sun Java Console] -> [2008/06/10 04:27:02 | 00,132,496 | ---- | M] (Sun Microsystems, Inc.)

{DDE87865-83C5-48c4-8357-2F5B1AA84522}:{DDE87865-83C5-48c4-8357-2F5B1AA84522} [HKLM] -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [Button: HP Smart Select] -> [2007/11/06 02:50:44 | 00,542,016 | ---- | M] (Hewlett-Packard Co.)

{E023F504-0C5A-4750-A1E7-A9046DEA8A21}:{DD6687B5-CB43-4211-BFC9-2942CCBDCB3E} [HKLM] -> C:\Program Files\Microsoft Money\System\mnyside.dll [Button: Money Viewer] -> [2002/07/17 12:00:00 | 00,163,906 | ---- | M] (Microsoft Corporation)

{e2e2dd38-d088-4134-82b7-f2ba38496583}:Exec [HKLM] -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [Menu: @xpsp3res.dll,-20001] -> [2008/04/13 19:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)

{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2008/04/14 01:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)

{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2008/04/14 01:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)

< Internet Explorer Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\ -> 

CmdMapping\\"{E023F504-0C5A-4750-A1E7-A9046DEA8A21}" [HKLM] -> C:\Program Files\Microsoft Money\System\mnyside.dll [Money Viewer] -> [2002/07/17 12:00:00 | 00,163,906 | ---- | M] (Microsoft Corporation)

CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2008/04/14 01:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)

< Internet Explorer Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\ -> 

CmdMapping\\"{E023F504-0C5A-4750-A1E7-A9046DEA8A21}" [HKLM] -> C:\Program Files\Microsoft Money\System\mnyside.dll [Money Viewer] -> [2002/07/17 12:00:00 | 00,163,906 | ---- | M] (Microsoft Corporation)

CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2008/04/14 01:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)

< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\Software\Microsoft\Internet Explorer\Extensions\ -> 

CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> C:\WINDOWS\System32\msjava.dll [Web Browser Applet Control] -> [2003/02/28 19:26:26 | 00,947,472 | ---- | M] (Microsoft Corporation)

CmdMapping\\"{E023F504-0C5A-4750-A1E7-A9046DEA8A21}" [HKLM] -> C:\Program Files\Microsoft Money\System\mnyside.dll [Money Viewer] -> [2002/07/17 12:00:00 | 00,163,906 | ---- | M] (Microsoft Corporation)

CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2008/04/14 01:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)

< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 

PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 

PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 

< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix

"" -> http://

< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\] > -> HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-21-2891841606-1732997126-3898492533-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 

{00B71CFB-6864-4346-A978-C0A14556272C} [HKLM] -> http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab [Checkers Class] -> 

{02BCC737-B171-4746-94C9-0D8A0B2C0089} [HKLM] -> http://office.microsoft.com/templates/ieawsdc.cab [Microsoft Office Template and Media Control] -> 

{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [HKLM] -> http://www.apple.com/qtactivex/qtplugin.cab [QuickTime Object] -> 

{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} [HKLM] -> http://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab [Office Genuine Advantage Validation Tool] -> 

{0CCA191D-13A6-4E29-B746-314DEE697D83} [HKLM] -> http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab [Facebook Photo Uploader 5 Control] -> 

{166B1BCA-3F9C-11CF-8075-444553540000} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [Shockwave ActiveX Control] -> 

{233C1507-6A77-46A4-9443-F871F945D258} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [Shockwave ActiveX Control] -> 

{2917297F-F02B-4B9D-81DF-494B6333150B} [HKLM] -> http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab [Minesweeper Flags Class] -> 

{33564D57-0000-0010-8000-00AA00389B71} [HKLM] -> http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB [Reg Error: Key error.] -> 

{5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} [HKLM] -> http://upload.facebook.com/controls/FacebookPhotoUploader3.cab [Facebook Photo Uploader 4 Control] -> 

{5ED80217-570B-4DA9-BF44-BE107C0EC166} [HKLM] -> http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab [Windows Live Safety Center Base Module] -> 

{5F8469B4-B055-49DD-83F7-62B522420ECC} [HKLM] -> http://upload.facebook.com/controls/FacebookPhotoUploader.cab [Facebook Photo Uploader Control] -> 

{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab [Java Plug-in 1.6.0_07] -> 

{8E0D4DE5-3180-4024-A327-4DFAD1796A8D} [HKLM] -> http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab [MessengerStatsClient Class] -> 

{A90A5822-F108-45AD-8482-9BC8B12DD539} [HKLM] -> http://www.crucial.com/controls/cpcScanner.cab [Crucial cpcScan] -> 

{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab [Java Plug-in 1.5.0_08] -> 

{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab [Java Plug-in 1.5.0_09] -> 

{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab [Java Plug-in 1.5.0_10] -> 

{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab [Java Plug-in 1.6.0_01] -> 

{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab [Java Plug-in 1.6.0_03] -> 

{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab [Java Plug-in 1.6.0_05] -> 

{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab [Java Plug-in 1.6.0_07] -> 

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab [Java Plug-in 1.6.0_07] -> 

{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> 

DirectAnimation Java Classes [HKLM] -> file://C:\WINDOWS\Java\classes\dajava.cab [Reg Error: Key error.] -> 

Microsoft XML Parser for Java [HKLM] -> file://C:\WINDOWS\Java\classes\xmldso.cab [Reg Error: Key error.] -> 

< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 

DhcpNameServer -> [removed] [removed] -> 

< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 

{845944D2-9F76-450A-8A8C-A82A9C3EDE87}\\DhcpNameServer -> [removed] [removed]   (Realtek RTL8139/810X Family PCI Fast Ethernet NIC) -> 

< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 

*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 

Explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/14 01:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation)

*MultiFile Done* -> -> 

< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 

avgrsstarter -> C:\WINDOWS\System32\avgrsstx.dll -> [2009/06/08 21:13:48 | 00,011,952 | ---- | M] (AVG Technologies CZ, s.r.o.)

igfxcui -> C:\WINDOWS\System32\igfxsrvc.dll -> [2003/04/06 17:06:48 | 00,315,392 | ---- | M] (Intel Corporation)

< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> 

"%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> [2008/04/13 19:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)

"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\System32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2008/04/14 01:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation)

"C:\Program Files\MSN Messenger\livecall.exe" -> C:\Program Files\MSN Messenger\livecall.exe [C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)] -> [2007/01/04 16:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation)

"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1] -> [2007/01/19 12:54:56 | 05,674,352 | ---- | M] (Microsoft Corporation)

< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 

"%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> [2008/04/13 19:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)

"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\System32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2008/04/14 01:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation)

"C:\Program Files\AVG\AVG8\avgnsx.exe" -> C:\Program Files\AVG\AVG8\avgnsx.exe [C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe] -> [2009/06/08 21:13:25 | 00,594,712 | ---- | M] (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG8\avgupd.exe" -> C:\Program Files\AVG\AVG8\avgupd.exe [C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe] -> [2009/06/08 21:13:23 | 01,085,208 | ---- | M] (AVG Technologies CZ, s.r.o.)

"C:\Program Files\BitLord\BitLord.exe" -> C:\Program Files\BitLord\BitLord.exe [C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord] -> [2005/05/07 01:47:08 | 02,224,128 | ---- | M] (www.BitLord.com)

"C:\Program Files\Bonjour\mDNSResponder.exe" -> C:\Program Files\Bonjour\mDNSResponder.exe [C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour] -> [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.)

"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" -> C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe [C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe] -> [2007/11/02 11:58:46 | 01,421,312 | ---- | M] (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" -> C:\Program Files\HP\Digital Imaging\bin\hposid01.exe [C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe] -> [2007/11/30 02:24:18 | 00,107,864 | ---- | M] (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" -> C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe [C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe] -> [2007/10/31 16:45:22 | 00,147,456 | ---- | M] (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" -> C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe [C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe] -> [2007/10/19 21:46:08 | 00,184,320 | ---- | M] (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe] -> [2007/10/14 21:38:52 | 00,214,360 | ---- | M] (Hewlett-Packard Co.)

"C:\Program Files\iTunes\iTunes.exe" -> C:\Program Files\iTunes\iTunes.exe [C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes] -> [2009/04/02 16:10:58 | 13,646,632 | ---- | M] (Apple Inc.)

"C:\Program Files\Messenger\msmsgs.exe" -> C:\Program Files\Messenger\msmsgs.exe [C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger] -> [2008/04/14 01:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)

"C:\Program Files\MSN Messenger\livecall.exe" -> C:\Program Files\MSN Messenger\livecall.exe [C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)] -> [2007/01/04 16:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation)

"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1] -> [2007/01/19 12:54:56 | 05,674,352 | ---- | M] (Microsoft Corporation)

"C:\Program Files\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe" -> C:\Program Files\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe [C:\Program Files\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe:*:Enabled:DarkCrusade] -> [2007/03/16 19:37:44 | 03,112,536 | ---- | M] (THQ Canada Inc.)

"C:\Program Files\THQ\Dawn of War - Dark Crusade\ttru_DarkCrusade.exe" -> C:\Program Files\THQ\Dawn of War - Dark Crusade\ttru_DarkCrusade.exe [C:\Program Files\THQ\Dawn of War - Dark Crusade\ttru_DarkCrusade.exe:*:Enabled:ttru_DarkCrusade] -> [2007/11/17 20:03:08 | 03,112,536 | ---- | M] (THQ Canada Inc.)

"C:\Program Files\WinMX\WinMX.exe" -> C:\Program Files\WinMX\WinMX.exe [C:\Program Files\WinMX\WinMX.exe:*:Enabled:WinMX Application] -> [2005/05/19 10:19:42 | 00,806,912 | ---- | M] (Frontcode Technologies)

"C:\WINDOWS\system32\rtcshare.exe" -> C:\WINDOWS\System32\rtcshare.exe [C:\WINDOWS\system32\rtcshare.exe:*:Disabled:RTC App Sharing] -> [2008/04/14 01:12:33 | 00,077,312 | ---- | M] (Microsoft Corporation)

< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 

"AlternateShell" -> cmd.exe -> 

< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->

"AutoRun" -> 1 -> 

"DisplayName" -> CD-ROM Driver -> 

"ImagePath" ->  [System32\DRIVERS\cdrom.sys] -> File not found

< Drives with AutoRun files > ->  -> 

C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2002/01/01 23:13:29 | 00,000,000 | ---- | M] ()

< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 

\{d0d3d86f-bef6-11dd-8cd3-00402b770968}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0d3d86f-bef6-11dd-8cd3-00402b770968}\Shell

\{d0d3d86f-bef6-11dd-8cd3-00402b770968}\Shell\\"" ->  [Autorun] -> File not found

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0d3d86f-bef6-11dd-8cd3-00402b770968}\Shell\AutoRun

\{d0d3d86f-bef6-11dd-8cd3-00402b770968}\Shell\AutoRun\\"" ->  [Auto&Play] -> File not found

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0d3d86f-bef6-11dd-8cd3-00402b770968}\Shell\Open\command

\{d0d3d86f-bef6-11dd-8cd3-00402b770968}\Shell\Open\command\\"" -> F:\RECYCLER\S-2-0-45-100023858-100000929-100005047-5541.com [F:\RECYCLER\S-2-0-45-100023858-100000929-100005047-5541.com f:\] -> File not found

 

 

[Files/Folders - Created Within 30 Days]

3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 

14 C:\Documents and Settings\MUM\Desktop\*.tmp files -> C:\Documents and Settings\MUM\Desktop\*.tmp -> 

OTS.exe -> C:\Documents and Settings\MUM\Desktop\OTS.exe -> [2009/06/16 22:06:25 | 00,507,392 | ---- | C] (OldTimer Tools)

02 Be The One.mp3 -> C:\Documents and Settings\MUM\Desktop\02 Be The One.mp3 -> [2009/06/16 13:57:00 | 06,060,102 | ---- | C] ()

SystemLook.exe -> C:\Documents and Settings\MUM\Desktop\SystemLook.exe -> [2009/06/16 12:28:26 | 00,101,636 | ---- | C] ()

RECYCLER -> C:\RECYCLER -> [2009/06/15 21:45:06 | 00,000,000 | -HSD | C]

gmer.exe -> C:\Documents and Settings\MUM\Desktop\gmer.exe -> [2009/06/15 21:44:26 | 00,286,208 | ---- | C] ()

gmer.zip -> C:\Documents and Settings\MUM\Desktop\gmer.zip -> [2009/06/15 21:43:35 | 00,278,221 | ---- | C] ()

temp -> C:\WINDOWS\temp -> [2009/06/14 21:57:57 | 00,000,000 | ---D | C]

Boot.bak -> C:\Boot.bak -> [2009/06/14 18:47:44 | 00,000,210 | ---- | C] ()

cmldr -> C:\cmldr -> [2009/06/14 18:47:39 | 00,260,272 | ---- | C] ()

cmdcons -> C:\cmdcons -> [2009/06/14 18:47:35 | 00,000,000 | RHSD | C]

SWXCACLS.exe -> C:\WINDOWS\SWXCACLS.exe -> [2009/06/14 17:05:09 | 00,212,480 | ---- | C] (SteelWerX)

SWREG.exe -> C:\WINDOWS\SWREG.exe -> [2009/06/14 17:05:09 | 00,161,792 | ---- | C] (SteelWerX)

PEV.exe -> C:\WINDOWS\PEV.exe -> [2009/06/14 17:05:09 | 00,155,136 | ---- | C] ()

SWSC.exe -> C:\WINDOWS\SWSC.exe -> [2009/06/14 17:05:09 | 00,136,704 | ---- | C] (SteelWerX)

sed.exe -> C:\WINDOWS\sed.exe -> [2009/06/14 17:05:09 | 00,098,816 | ---- | C] ()

grep.exe -> C:\WINDOWS\grep.exe -> [2009/06/14 17:05:09 | 00,080,412 | ---- | C] ()

zip.exe -> C:\WINDOWS\zip.exe -> [2009/06/14 17:05:09 | 00,068,096 | ---- | C] ()

NIRCMD.exe -> C:\WINDOWS\NIRCMD.exe -> [2009/06/14 17:05:09 | 00,031,232 | ---- | C] (NirSoft)

ERDNT -> C:\WINDOWS\ERDNT -> [2009/06/14 17:04:59 | 00,000,000 | ---D | C]

Qoobox -> C:\Qoobox -> [2009/06/14 17:04:53 | 00,000,000 | ---D | C]

Combo-Fix.exe -> C:\Documents and Settings\MUM\Desktop\Combo-Fix.exe -> [2009/06/14 10:20:05 | 03,026,828 | R--- | C] ()

MUM.exe -> C:\Documents and Settings\MUM\Desktop\MUM.exe -> [2009/06/12 19:48:45 | 00,396,288 | ---- | C] (Trend Micro Inc.)

rsit -> C:\rsit -> [2009/06/12 19:48:44 | 00,000,000 | ---D | C]

RSIT.exe -> C:\Documents and Settings\MUM\Desktop\RSIT.exe -> [2009/06/12 19:48:20 | 00,781,909 | ---- | C] ()

DoctorWeb -> C:\Documents and Settings\MUM\DoctorWeb -> [2009/06/12 14:18:52 | 00,000,000 | ---D | C]

drweb-cureit.exe -> C:\Documents and Settings\MUM\Desktop\drweb-cureit.exe -> [2009/06/12 10:01:44 | 14,407,624 | ---- | C] (Doctor Web, Ltd.)

QuickTime -> C:\Program Files\QuickTime -> [2009/06/10 18:20:50 | 00,000,000 | ---D | C]

backups -> C:\Documents and Settings\MUM\Desktop\backups -> [2009/06/10 10:36:29 | 00,000,000 | ---D | C]

MalWare Removal • View topic - Trojan Horse virus help needed please.url -> C:\Documents and Settings\MUM\Desktop\MalWare Removal • View topic - Trojan Horse virus help needed please.url -> [2009/06/09 23:17:58 | 00,000,299 | ---- | C] ()

hiberfil.sys -> C:\hiberfil.sys -> [2009/06/09 18:41:32 | 10,716,97920 | -HS- | C] ()

Malwarebytes -> C:\Documents and Settings\MUM\Application Data\Malwarebytes -> [2009/06/09 09:54:45 | 00,000,000 | ---D | C]

Malwarebytes' Anti-Malware.lnk -> C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/06/09 07:16:47 | 00,000,720 | ---- | C] ()

mbamswissarmy.sys -> C:\WINDOWS\System32\drivers\mbamswissarmy.sys -> [2009/06/09 07:16:45 | 00,040,160 | ---- | C] (Malwarebytes Corporation)

mbam.sys -> C:\WINDOWS\System32\drivers\mbam.sys -> [2009/06/09 07:16:43 | 00,019,096 | ---- | C] (Malwarebytes Corporation)

Malwarebytes' Anti-Malware -> C:\Program Files\Malwarebytes' Anti-Malware -> [2009/06/09 07:16:43 | 00,000,000 | ---D | C]

Malwarebytes -> C:\Documents and Settings\All Users\Application Data\Malwarebytes -> [2009/06/09 07:16:43 | 00,000,000 | ---D | C]

A stuff -> C:\Documents and Settings\MUM\My Documents\A stuff -> [2009/06/09 07:13:54 | 00,000,000 | ---D | C]

mbam-setup.exe -> C:\Documents and Settings\MUM\Desktop\mbam-setup.exe -> [2009/06/09 07:03:31 | 03,371,384 | ---- | C] (Malwarebytes Corporation                                    )

Bugs 06.09.csv -> C:\Documents and Settings\MUM\Desktop\Bugs 06.09.csv -> [2009/06/09 07:01:11 | 00,059,318 | ---- | C] ()

avgrsstx.dll -> C:\WINDOWS\System32\avgrsstx.dll -> [2009/06/08 21:13:48 | 00,011,952 | ---- | C] (AVG Technologies CZ, s.r.o.)

AVG Free 8.5.lnk -> C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk -> [2009/06/08 21:13:48 | 00,001,507 | ---- | C] ()

avgtdix.sys -> C:\WINDOWS\System32\drivers\avgtdix.sys -> [2009/06/08 21:13:47 | 00,108,552 | ---- | C] (AVG Technologies CZ, s.r.o.)

avgldx86.sys -> C:\WINDOWS\System32\drivers\avgldx86.sys -> [2009/06/08 21:13:45 | 00,325,896 | ---- | C] (AVG Technologies CZ, s.r.o.)

avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> [2009/06/08 21:13:43 | 00,027,784 | ---- | C] (AVG Technologies CZ, s.r.o.)

incavi.avm -> C:\WINDOWS\System32\drivers\Avg\incavi.avm -> [2009/06/08 21:13:37 | 37,139,497 | ---- | C] ()

avi7.avg -> C:\WINDOWS\System32\drivers\Avg\avi7.avg -> [2009/06/08 21:13:37 | 06,061,540 | ---- | C] ()

miniavi.avg -> C:\WINDOWS\System32\drivers\Avg\miniavi.avg -> [2009/06/08 21:13:37 | 00,434,673 | ---- | C] ()

microavi.avg -> C:\WINDOWS\System32\drivers\Avg\microavi.avg -> [2009/06/08 21:13:37 | 00,077,549 | ---- | C] ()

Avg -> C:\WINDOWS\System32\drivers\Avg -> [2009/06/08 21:13:37 | 00,000,000 | ---D | C]

avg8 -> C:\Documents and Settings\All Users\Application Data\avg8 -> [2009/06/08 21:13:22 | 00,000,000 | ---D | C]

AVG -> C:\Program Files\AVG -> [2009/06/08 21:13:22 | 00,000,000 | ---D | C]

Ÿ9Ÿ9 -> C:\Documents and Settings\MUM\Ÿ9Ÿ9 -> [2009/06/08 20:54:06 | 00,000,000 | ---- | C] ()

$AVG8.VAULT$ -> C:\$AVG8.VAULT$ -> [2009/06/08 20:45:39 | 00,000,000 | -H-D | C]

Windows Live Safety Center -> C:\Program Files\Windows Live Safety Center -> [2009/06/04 19:22:37 | 00,000,000 | ---D | C]

Shortcut to regedit.exe.lnk -> C:\Documents and Settings\MUM\Desktop\Shortcut to regedit.exe.lnk -> [2009/06/04 13:21:29 | 00,001,029 | ---- | C] ()

Shortcut to taskmgr.exe.lnk -> C:\Documents and Settings\MUM\Desktop\Shortcut to taskmgr.exe.lnk -> [2009/06/04 13:20:37 | 00,000,972 | ---- | C] ()

Application Data -> C:\WINDOWS\Application Data -> [2009/06/03 23:46:18 | 00,000,000 | ---D | C]

MalWare Removal.url -> C:\Documents and Settings\MUM\Desktop\MalWare Removal.url -> [2009/06/03 09:59:39 | 00,000,299 | ---- | C] ()

HighjackThis.exe -> C:\Documents and Settings\MUM\Desktop\HighjackThis.exe -> [2009/06/03 09:49:07 | 00,396,288 | ---- | C] (Trend Micro Inc.)

Desktop Bits -> C:\Documents and Settings\MUM\My Documents\Desktop Bits -> [2009/06/03 07:05:24 | 00,000,000 | ---D | C]

Minidump -> C:\WINDOWS\Minidump -> [2009/05/28 22:48:39 | 00,000,000 | ---D | C]

NCH Software -> C:\Documents and Settings\All Users\Application Data\NCH Software -> [2009/05/18 21:28:51 | 00,000,000 | ---D | C]

NCH Software -> C:\Program Files\NCH Software -> [2009/05/18 20:45:17 | 00,000,000 | ---D | C]

ppadsetup.exe -> C:\Documents and Settings\MUM\My Documents\ppadsetup.exe -> [2009/05/18 20:39:08 | 00,242,352 | ---- | C] (NCH Software)

52289vzrus9.dll -> C:\WINDOWS\52289vzrus9.dll -> [2009/01/01 04:47:37 | 00,012,176 | ---- | C] ()

xlive.dll.cat -> C:\WINDOWS\System32\xlive.dll.cat -> [2008/10/28 18:40:48 | 00,173,552 | ---- | C] ()

55991spambotz.dll -> C:\WINDOWS\System32\55991spambotz.dll -> [2008/08/02 01:08:48 | 00,014,084 | ---- | C] ()

GTW32N50.dll -> C:\WINDOWS\System32\GTW32N50.dll -> [2008/06/25 17:12:09 | 00,094,208 | ---- | C] ()

libeay32.dll -> C:\WINDOWS\System32\libeay32.dll -> [2008/06/25 17:12:05 | 00,651,264 | ---- | C] ()

ssleay32.dll -> C:\WINDOWS\System32\ssleay32.dll -> [2008/06/25 17:12:05 | 00,147,456 | ---- | C] ()

WLAN.INI -> C:\WINDOWS\System32\WLAN.INI -> [2008/06/25 17:11:49 | 00,002,898 | ---- | C] ()

msoffice.ini -> C:\WINDOWS\msoffice.ini -> [2008/01/01 22:31:43 | 00,000,004 | ---- | C] ()

NeroDigital.ini -> C:\WINDOWS\NeroDigital.ini -> [2007/05/16 14:35:16 | 00,000,116 | ---- | C] ()

OGACheckControl.DLL -> C:\WINDOWS\System32\OGACheckControl.DLL -> [2007/03/05 13:34:28 | 00,676,224 | ---- | C] ()

gc.dll -> C:\WINDOWS\System32\gc.dll -> [2006/10/19 20:46:55 | 00,185,856 | ---- | C] ()

257DBC60.ini -> C:\WINDOWS\257DBC60.ini -> [2006/10/16 23:47:48 | 00,000,070 | ---- | C] ()

Brpfx04a.ini -> C:\WINDOWS\Brpfx04a.ini -> [2006/04/14 17:05:03 | 00,000,829 | ---- | C] ()

brpcfx.ini -> C:\WINDOWS\brpcfx.ini -> [2006/04/14 17:05:03 | 00,000,153 | ---- | C] ()

BrMuSNMP.dll -> C:\WINDOWS\System32\BrMuSNMP.dll -> [2006/04/14 17:04:00 | 00,106,496 | ---- | C] ()

maxlink.ini -> C:\WINDOWS\maxlink.ini -> [2006/04/14 17:00:36 | 00,027,015 | ---- | C] ()

brss01a.ini -> C:\WINDOWS\System32\brss01a.ini -> [2006/04/14 16:10:07 | 00,000,030 | ---- | C] ()

BRWMARK.INI -> C:\WINDOWS\BRWMARK.INI -> [2006/04/14 16:10:06 | 00,000,463 | ---- | C] ()

BRPP2KA.INI -> C:\WINDOWS\BRPP2KA.INI -> [2006/04/14 16:10:06 | 00,000,027 | ---- | C] ()

HEALTHCHECK 3.INI -> C:\WINDOWS\HEALTHCHECK 3.INI -> [2005/05/16 18:07:18 | 00,005,870 | ---- | C] ()

Disktool.INI -> C:\WINDOWS\Disktool.INI -> [2005/05/03 10:37:37 | 00,007,207 | R--- | C] ()

fwupgrade.ini -> C:\WINDOWS\fwupgrade.ini -> [2005/05/03 10:37:37 | 00,006,399 | R--- | C] ()

PlaySnd.INI -> C:\WINDOWS\PlaySnd.INI -> [2005/05/03 10:37:37 | 00,003,677 | R--- | C] ()

Tiny_Run.ini -> C:\WINDOWS\Tiny_Run.ini -> [2005/03/08 17:39:05 | 00,000,200 | ---- | C] ()

winamp.ini -> C:\WINDOWS\winamp.ini -> [2004/11/29 12:08:33 | 00,001,125 | ---- | C] ()

SETUP32.INI -> C:\WINDOWS\SETUP32.INI -> [2004/11/25 18:41:06 | 00,000,000 | ---- | C] ()

AlphaPlayer.INI -> C:\WINDOWS\AlphaPlayer.INI -> [2004/07/03 19:13:02 | 00,000,066 | ---- | C] ()

MSDraw.ini -> C:\WINDOWS\MSDraw.ini -> [2004/06/21 13:05:28 | 00,000,000 | ---- | C] ()

ULEAD32.INI -> C:\WINDOWS\ULEAD32.INI -> [2004/02/01 13:19:06 | 00,000,457 | ---- | C] ()

Fe.INI -> C:\WINDOWS\Fe.INI -> [2004/02/01 13:11:23 | 00,000,663 | ---- | C] ()

lexstat.ini -> C:\WINDOWS\lexstat.ini -> [2004/02/01 13:06:12 | 00,000,370 | ---- | C] ()

ODBC.INI -> C:\WINDOWS\ODBC.INI -> [2003/12/13 08:34:05 | 00,000,482 | ---- | C] ()

Welsof32.dll -> C:\WINDOWS\System32\Welsof32.dll -> [2002/08/09 14:15:16 | 00,101,376 | ---- | C] ()

Jpeg32.dll -> C:\WINDOWS\System32\Jpeg32.dll -> [2002/03/04 10:16:34 | 00,110,592 | R--- | C] ()

oeminfo.ini -> C:\WINDOWS\System32\oeminfo.ini -> [2002/01/02 05:54:16 | 00,001,492 | ---- | C] ()

emver.ini -> C:\WINDOWS\System32\emver.ini -> [2002/01/02 05:54:16 | 00,000,445 | ---- | C] ()

win.ini -> C:\WINDOWS\win.ini -> [2002/01/02 05:53:42 | 00,000,673 | ---- | C] ()

system.ini -> C:\WINDOWS\system.ini -> [2002/01/02 05:53:37 | 00,000,277 | ---- | C] ()

smscfg.ini -> C:\WINDOWS\smscfg.ini -> [2002/01/02 02:21:56 | 00,000,061 | ---- | C] ()

psisdecd.dll -> C:\WINDOWS\System32\psisdecd.dll -> [2002/01/01 23:53:07 | 00,363,520 | ---- | C] ()

HKNTDLL.dll -> C:\WINDOWS\HKNTDLL.dll -> [2002/01/01 23:52:30 | 00,024,576 | ---- | C] ()

 

[Files/Folders - Modified Within 30 Days]

1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 

OTS.exe -> C:\Documents and Settings\MUM\Desktop\OTS.exe -> [2009/06/16 22:06:31 | 00,507,392 | ---- | M] (OldTimer Tools)

02 Be The One.mp3 -> C:\Documents and Settings\MUM\Desktop\02 Be The One.mp3 -> [2009/06/16 13:57:00 | 06,060,102 | ---- | M] ()

PerfStringBackup.INI -> C:\WINDOWS\System32\PerfStringBackup.INI -> [2009/06/16 13:55:00 | 00,522,530 | ---- | M] ()

perfh009.dat -> C:\WINDOWS\System32\perfh009.dat -> [2009/06/16 13:55:00 | 00,442,398 | ---- | M] ()

perfc009.dat -> C:\WINDOWS\System32\perfc009.dat -> [2009/06/16 13:55:00 | 00,071,764 | ---- | M] ()

win.ini -> C:\WINDOWS\win.ini -> [2009/06/16 13:36:46 | 00,000,673 | ---- | M] ()

wpa.dbl -> C:\WINDOWS\System32\wpa.dbl -> [2009/06/16 13:36:14 | 00,001,158 | ---- | M] ()

SA.DAT -> C:\WINDOWS\tasks\SA.DAT -> [2009/06/16 13:15:11 | 00,000,006 | -H-- | M] ()

bootstat.dat -> C:\WINDOWS\bootstat.dat -> [2009/06/16 13:15:03 | 00,002,048 | --S- | M] ()

hiberfil.sys -> C:\hiberfil.sys -> [2009/06/16 13:15:01 | 10,716,97920 | -HS- | M] ()

NTUSER.DAT -> C:\Documents and Settings\MUM\NTUSER.DAT -> [2009/06/16 13:06:31 | 06,553,600 | ---- | M] ()

ntuser.ini -> C:\Documents and Settings\MUM\ntuser.ini -> [2009/06/16 13:06:31 | 00,000,278 | -HS- | M] ()

SystemLook.exe -> C:\Documents and Settings\MUM\Desktop\SystemLook.exe -> [2009/06/16 12:28:28 | 00,101,636 | ---- | M] ()

incavi.avm -> C:\WINDOWS\System32\drivers\Avg\incavi.avm -> [2009/06/16 04:09:46 | 37,139,497 | ---- | M] ()

microavi.avg -> C:\WINDOWS\System32\drivers\Avg\microavi.avg -> [2009/06/16 04:09:04 | 00,077,549 | ---- | M] ()

qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2009/06/16 03:46:33 | 00,005,513 | ---- | M] ()

qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2009/06/16 03:46:33 | 00,004,232 | ---- | M] ()

gmer.zip -> C:\Documents and Settings\MUM\Desktop\gmer.zip -> [2009/06/15 21:43:36 | 00,278,221 | ---- | M] ()

MalWare Removal • View topic - Trojan Horse virus help needed please.url -> C:\Documents and Settings\MUM\Desktop\MalWare Removal • View topic - Trojan Horse virus help needed please.url -> [2009/06/15 17:03:28 | 00,000,299 | ---- | M] ()

system.ini -> C:\WINDOWS\system.ini -> [2009/06/14 21:52:36 | 00,000,277 | ---- | M] ()

hosts -> C:\WINDOWS\System32\drivers\etc\hosts -> [2009/06/14 21:51:10 | 00,000,027 | ---- | M] ()

boot.ini -> C:\boot.ini -> [2009/06/14 18:47:44 | 00,000,281 | RHS- | M] ()

Combo-Fix.exe -> C:\Documents and Settings\MUM\Desktop\Combo-Fix.exe -> [2009/06/14 10:20:11 | 03,026,828 | R--- | M] ()

RSIT.exe -> C:\Documents and Settings\MUM\Desktop\RSIT.exe -> [2009/06/12 19:48:28 | 00,781,909 | ---- | M] ()

drweb-cureit.exe -> C:\Documents and Settings\MUM\Desktop\drweb-cureit.exe -> [2009/06/12 10:01:44 | 14,407,624 | ---- | M] (Doctor Web, Ltd.)

FNTCACHE.DAT -> C:\WINDOWS\System32\FNTCACHE.DAT -> [2009/06/12 03:08:19 | 00,215,264 | ---- | M] ()

imsins.BAK -> C:\WINDOWS\imsins.BAK -> [2009/06/12 03:01:44 | 00,001,374 | ---- | M] ()

DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> C:\Documents and Settings\MUM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/06/11 17:48:46 | 00,067,584 | ---- | M] ()

NeroDigital.ini -> C:\WINDOWS\NeroDigital.ini -> [2009/06/11 17:44:22 | 00,000,116 | ---- | M] ()

Malwarebytes' Anti-Malware.lnk -> C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/06/11 07:01:47 | 00,000,720 | ---- | M] ()

IconCache.db -> C:\Documents and Settings\MUM\Local Settings\Application Data\IconCache.db -> [2009/06/10 10:38:11 | 04,319,120 | -H-- | M] ()

MalWare Removal.url -> C:\Documents and Settings\MUM\Desktop\MalWare Removal.url -> [2009/06/09 18:44:16 | 00,000,299 | ---- | M] ()

mbam-setup.exe -> C:\Documents and Settings\MUM\Desktop\mbam-setup.exe -> [2009/06/09 07:03:41 | 03,371,384 | ---- | M] (Malwarebytes Corporation                                    )

Bugs 06.09.csv -> C:\Documents and Settings\MUM\Desktop\Bugs 06.09.csv -> [2009/06/09 07:01:12 | 00,059,318 | ---- | M] ()

avi7.avg -> C:\WINDOWS\System32\drivers\Avg\avi7.avg -> [2009/06/08 21:18:26 | 06,061,540 | ---- | M] ()

miniavi.avg -> C:\WINDOWS\System32\drivers\Avg\miniavi.avg -> [2009/06/08 21:18:26 | 00,434,673 | ---- | M] ()

avgrsstx.dll -> C:\WINDOWS\System32\avgrsstx.dll -> [2009/06/08 21:13:48 | 00,011,952 | ---- | M] (AVG Technologies CZ, s.r.o.)

AVG Free 8.5.lnk -> C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk -> [2009/06/08 21:13:48 | 00,001,507 | ---- | M] ()

avgtdix.sys -> C:\WINDOWS\System32\drivers\avgtdix.sys -> [2009/06/08 21:13:47 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.)

avgldx86.sys -> C:\WINDOWS\System32\drivers\avgldx86.sys -> [2009/06/08 21:13:45 | 00,325,896 | ---- | M] (AVG Technologies CZ, s.r.o.)

avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> [2009/06/08 21:13:43 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.)

Ÿ9Ÿ9 -> C:\Documents and Settings\MUM\Ÿ9Ÿ9 -> [2009/06/08 20:54:06 | 00,000,000 | ---- | M] ()

PEV.exe -> C:\WINDOWS\PEV.exe -> [2009/06/08 08:10:10 | 00,155,136 | ---- | M] ()

Shortcut to regedit.exe.lnk -> C:\Documents and Settings\MUM\Desktop\Shortcut to regedit.exe.lnk -> [2009/06/04 13:21:29 | 00,001,029 | ---- | M] ()

Shortcut to taskmgr.exe.lnk -> C:\Documents and Settings\MUM\Desktop\Shortcut to taskmgr.exe.lnk -> [2009/06/04 13:20:37 | 00,000,972 | ---- | M] ()

MUM.exe -> C:\Documents and Settings\MUM\Desktop\MUM.exe -> [2009/06/03 09:49:12 | 00,396,288 | ---- | M] (Trend Micro Inc.)

HighjackThis.exe -> C:\Documents and Settings\MUM\Desktop\HighjackThis.exe -> [2009/06/03 09:49:12 | 00,396,288 | ---- | M] (Trend Micro Inc.)

MRT.exe -> C:\WINDOWS\System32\MRT.exe -> [2009/06/01 17:51:12 | 23,635,392 | ---- | M] (Microsoft Corporation)

AppleSoftwareUpdate.job -> C:\WINDOWS\tasks\AppleSoftwareUpdate.job -> [2009/05/30 13:11:04 | 00,000,284 | ---- | M] ()

msoffice.ini -> C:\WINDOWS\msoffice.ini -> [2009/05/27 09:59:49 | 00,000,004 | ---- | M] ()

mbamswissarmy.sys -> C:\WINDOWS\System32\drivers\mbamswissarmy.sys -> [2009/05/26 13:20:08 | 00,040,160 | ---- | M] (Malwarebytes Corporation)

mbam.sys -> C:\WINDOWS\System32\drivers\mbam.sys -> [2009/05/26 13:19:56 | 00,019,096 | ---- | M] (Malwarebytes Corporation)

ppadsetup.exe -> C:\Documents and Settings\MUM\My Documents\ppadsetup.exe -> [2009/05/18 20:45:09 | 00,242,352 | ---- | M] (NCH Software)

wklntsk.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wklntsk.dat -> [2009/04/15 22:10:57 | 00,495,748 | ---- | M] ()

wklntnts.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wklntnts.dat -> [2009/04/15 22:10:57 | 00,495,748 | ---- | M] ()

college.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Money\11.0\Webcache\college.dat -> [2002/07/17 12:00:00 | 00,314,360 | ---- | M] ()

about.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Money\11.0\Webcache\about.dat -> [2002/07/17 12:00:00 | 00,002,302 | ---- | M] ()

 

[Alternate Data Streams]

@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7E95B6FD

@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D10517E

< End of report >

File::

C:\WINDOWS\System32\55991spambotz.dll

C:\WINDOWS\52289vzrus9.dll