MS Removal Tool changed proxy setting

2 posters

WiredWX Christian Hobby Weather Tools :: GeekPolice tech support archive :: Technical Support

Re: MS Removal Tool changed proxy setting17th April 2011, 12:38 pm

okay got that done

Spoiler :

btw am i supposed to have some thumbs.db file on my desktop?

Re: MS Removal Tool changed proxy setting18th April 2011, 2:50 am

It's a safe file.

Please download OTS by OldTimer and save it to your Desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

Close ALL OTHER PROGRAMS.
Double-click on OTS to start the program (if you are running on Vista then right-click the program and
choose Run as Administrator).
At the top, tick on Scan All Users section and Include MD5.
At File Age set it to 90 Days
In the Processes, Modules, Services, Drivers, and Registry
section, please set on Safe List.
In the Files Created Within and Files Modified Within section, set it to File Age
At the bottom, tick on all Safe List and Use Company Name WhiteList option
Under Additional Scans, tick on the "Extras" button and then click the checkboxes in front of the following items to select them:
Do NOT change any other settings.
Then, in the Custom Scans box, place this in:

%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\System32\*.sys
%systemroot%\System32\drivers\*.dll
%systemroot%\System32\drivers\*.ini
%systemroot%\System32\drivers\*.exe
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.
%appdata%\*.*
Now click the Run Scan button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Re: MS Removal Tool changed proxy setting18th April 2011, 6:23 am

ummm... breaking the notepad into 2 parts, doesn't fit into 1 post, goes over by 14500letters or so

Spoiler :

[code]
OTS logfile created on: 18/04/2011 3:57:13 PM - Run 1
OTS by OldTimer - Version 3.1.42.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 76.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 22.47 Gb Free Space | 60.32% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 186.30 Gb Total Space | 163.54 Gb Free Space | 87.78% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KON
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 90 Days

[Processes - Safe List]
ots.exe -> C:\Documents and Settings\Owner\Desktop\OTS.exe -> [2011/04/18 15:50:15 | 000,645,632 | ---- | M | MD5 = AF5A3E59558352FF5867CFA60A096A5E] (OldTimer Tools)
nokiamserver.exe -> C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe -> [2010/07/20 11:45:24 | 001,531,904 | ---- | M | MD5 = ACC5596B15EB0351261A483DA06F3EB3] (Nokia)
jucheck.exe -> C:\Program Files\Common Files\Java\Java Update\jucheck.exe -> [2010/05/14 11:44:46 | 000,501,480 | ---- | M | MD5 = DB1A23EE7DD2E5E04E7DE071A6BEF699] (Sun Microsystems, Inc.)
explorer.exe -> C:\WINDOWS\explorer.exe -> [2004/08/04 00:56:50 | 001,032,192 | ---- | M | MD5 = A0732187050030AE399B241436565E64] (Microsoft Corporation)

[Modules - Safe List]
ots.exe -> C:\Documents and Settings\Owner\Desktop\OTS.exe -> [2011/04/18 15:50:15 | 000,645,632 | ---- | M | MD5 = AF5A3E59558352FF5867CFA60A096A5E] (OldTimer Tools)
comctl32.dll -> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll -> [2004/08/04 00:57:02 | 001,050,624 | ---- | M | MD5 = 5AF68A5E44734A082442668E9C787743] (Microsoft Corporation)

[Win32 Services - Safe List]
(AppMgmt) Application Management [Disabled | Stopped] -> -> File not found
(Akamai) Akamai NetSession Interface [Auto | Running] -> c:\Program Files\Common Files\Akamai\netsession_win_a35e6b9.dll -> [2011/03/30 17:13:19 | 003,229,784 | ---- | M | MD5 = A35E6B91CA1FBA354B198969946DE07D] ()
(AVP) Kaspersky Anti-Virus Service [Auto | Stopped] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -> [2010/10/30 15:08:41 | 000,352,976 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
(ServiceLayer) ServiceLayer [On_Demand | Stopped] -> C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -> [2010/06/14 15:07:14 | 000,615,936 | ---- | M | MD5 = 2D841B7B7F6DEC32162EDFCC69D61F42] (Nokia)
(npggsvc) nProtect GameGuard Service [On_Demand | Stopped] -> C:\WINDOWS\System32\GameMon.des -> [2010/04/27 09:44:00 | 003,735,920 | ---- | M | MD5 = 529701597F19B8359606F28E43C121FA] (INCA Internet Co., Ltd.)

[Driver Services - Safe List]
(KLIF) Kaspersky Lab Driver [File_System | System | Running] -> C:\WINDOWS\system32\drivers\klif.sys -> [2010/10/30 15:08:41 | 000,475,736 | ---- | M | Unable to obtain MD5] (Kaspersky Lab)
(kl2) kl2 [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\kl2.sys -> [2010/06/09 17:43:52 | 000,011,352 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
(KL1) KL1 [Kernel | Boot | Running] -> C:\WINDOWS\system32\DRIVERS\kl1.sys -> [2010/06/09 17:43:50 | 000,132,184 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
(klim5) Kaspersky Anti-Virus NDIS Filter [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\klim5.sys -> [2010/05/07 12:06:26 | 000,032,856 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
(UsbserFilt) UsbserFilt [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -> [2010/02/26 14:32:58 | 000,008,192 | ---- | M | MD5 = 68B4F83CCCF70A2FF32EE142C234332A] (Nokia)
(upperdev) upperdev [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -> [2010/02/26 14:32:46 | 000,008,192 | ---- | M | MD5 = 0CCADC7391021376EDBB8AA649D04E68] (Nokia)
(nmwcdc) Nokia USB Generic [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\ccdcmbo.sys -> [2010/02/26 14:32:44 | 000,022,528 | ---- | M | MD5 = 3859C69A77793180548802DAC9F34A38] (Nokia)
(nmwcd) Nokia USB Phone Parent [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\ccdcmb.sys -> [2010/02/26 14:32:44 | 000,018,176 | ---- | M | MD5 = C3963D85B721A7F80D8A55F4E2867A3A] (Nokia)
(klmouflt) Kaspersky Lab KLMOUFLT [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\klmouflt.sys -> [2009/11/02 20:27:24 | 000,019,472 | ---- | M | Unable to obtain MD5] (Kaspersky Lab)
(pccsmcfd) PCCS Mode Change Filter Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\pccsmcfd.sys -> [2008/08/26 10:26:12 | 000,018,816 | ---- | M | MD5 = FD2041E9BA03DB7764B2248F02475079] (Nokia)
(WinDriver6) WinDriver6 [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\windrvr6.sys -> [2008/07/03 10:59:54 | 000,193,696 | ---- | M | MD5 = 451F905BC7BFF9E1CFF2E7AE76196B2C] (Jungo)
(bcm4sbxp) Broadcom 440x 10/100 Integrated Controller XP Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\bcm4sbxp.sys -> [2003/06/30 18:11:52 | 000,043,136 | R--- | M | MD5 = B60F57B4D9CDBC663CC03EB8AF7EC34E] (Broadcom Corporation)
(OMCI) OMCI [Kernel | System | Running] -> C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -> [2001/08/22 08:42:58 | 000,013,632 | ---- | M | MD5 = CEC7E2C6C1FA00C7AB2F5434F848AE51] (Dell Computer Corporation)

[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> ->
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm ->
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> ->
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> ->
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> ->
HKEY_USERS\S-1-5-19\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> ->
HKEY_USERS\S-1-5-20\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\] > -> ->
HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\: Main\\"Start Page" -> http://search.babylon.com/?babsrc=HP_ss&mntrId=1cab1934000000000000000d565ba641&tlver=1.4.19.19&affID=17159 ->
HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\: SearchURL\\"provider" -> ->
HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\: URLSearchHooks\\"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}" [HKLM] -> C:\Program Files\uTorrentBar\tbuTor.dll [uTorrentBar Toolbar] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\: "ProxyEnable" -> 0 ->
< FireFox Settings [Prefs.js] > -> C:\Documents and Settings\Owner\Application Data\Mozilla\FireFox\Profiles\q9rv5dbh.default\prefs.js ->
network.proxy.http -> "127.0.0.1" ->
network.proxy.http_port -> 50808 ->
network.proxy.type -> 0 ->
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\extensions -> ->
HKLM\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} -> C:\PROGRAM FILES\NOKIA\NOKIA OVI SUITE\CONNECTORS\BOOKMARKS CONNECTOR\FIREFOXEXTENSION\ [C:\PROGRAM FILES\NOKIA\NOKIA OVI SUITE\CONNECTORS\BOOKMARKS CONNECTOR\FIREFOXEXTENSION\] -> [2010/10/26 20:25:50 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 4.0\extensions -> ->
HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components -> C:\Program Files\Mozilla Firefox\components [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2011/04/14 18:33:33 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins -> C:\Program Files\Mozilla Firefox\plugins [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2011/04/02 20:03:24 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Thunderbird\Extensions -> ->
HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74} -> C:\PROGRAM FILES\NOKIA\NOKIA OVI SUITE\CONNECTORS\THUNDERBIRD CONNECTOR\THUNDERBIRDEXTENSION\ [C:\PROGRAM FILES\NOKIA\NOKIA OVI SUITE\CONNECTORS\THUNDERBIRD CONNECTOR\THUNDERBIRDEXTENSION\] -> [2010/10/26 20:25:52 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\THBExt [C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2011\THBEXT] -> [2010/10/30 13:03:08 | 000,000,000 | ---D | M]
< FireFox Extensions [User Folders] > ->
-> C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions -> [2010/07/27 14:18:06 | 000,000,000 | ---D | M]
-> C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q9rv5dbh.default\extensions -> [2011/04/15 17:44:09 | 000,000,000 | ---D | M]
DownThemAll! -> C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q9rv5dbh.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} -> [2011/03/12 16:04:41 | 000,000,000 | ---D | M]
SearchPreview -> C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q9rv5dbh.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6} -> [2011/03/19 20:18:53 | 000,000,000 | ---D | M]
-> C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q9rv5dbh.default\extensions\ALone-live@ya.ru -> [2011/04/15 17:44:09 | 000,000,000 | ---D | M]
< FireFox SearchPlugins [User Folders] > ->
< FireFox Extensions [Program Folders] > ->
-> C:\Program Files\Mozilla Firefox\extensions -> [2011/04/14 18:41:27 | 000,000,000 | ---D | M]
-> C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru -> [2010/10/30 13:16:29 | 000,000,000 | ---D | M]
No name found -> -> File not found
No name found -> C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\Q9RV5DBH.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI -> ()
No name found -> C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\Q9RV5DBH.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI -> ()
Roomy Bookmarks Toolbar -> C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\Q9RV5DBH.DEFAULT\EXTENSIONS\ALONE-LIVE@YA.RU -> [2011/04/15 17:44:09 | 000,000,000 | ---D | M]
No name found -> C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\Q9RV5DBH.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI -> ()
Java Quick Starter -> C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF -> [2010/07/27 14:35:11 | 000,000,000 | ---D | M]
~[Filtered]~
Reset Hosts
127.0.0.1 localhost
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ->
{2EECD738-5844-4a99-B4B6-146BF802613B} [HKLM] -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll [CescrtHlpr Object] -> [2010/11/07 23:45:26 | 000,225,720 | ---- | M | MD5 = 91BCFFE9095DFE033125ADD31EE7FFC1] (Babylon BHO)
{30F9B915-B755-4826-820B-08FBA6BD249D} [HKLM] -> C:\Program Files\ConduitEngine\ConduitEngine.dll [Conduit Engine] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll [IEVkbdBHO Class] -> [2010/07/01 21:35:08 | 000,068,280 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
{5C255C8A-E604-49b4-9D64-90988571CECB} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Plug-In] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} [HKLM] -> C:\Program Files\uTorrentBar\tbuTor.dll [uTorrentBar Toolbar] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
{E33CF602-D945-461A-83F0-819F76A199F8} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [FilterBHO Class] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar ->
"{30F9B915-B755-4826-820B-08FBA6BD249D}" [HKLM] -> C:\Program Files\ConduitEngine\ConduitEngine.dll [Conduit Engine] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
"{98889811-442D-49dd-99D7-DC866BE87DBC}" [HKLM] -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll [Babylon Toolbar] -> [2010/11/07 23:45:28 | 000,184,760 | ---- | M | MD5 = CF158FAC1864EE97BFE3221285FEC23A] (Babylon Ltd.)
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}" [HKLM] -> C:\Program Files\uTorrentBar\tbuTor.dll [uTorrentBar Toolbar] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}" [HKLM] -> C:\Program Files\uTorrentBar\tbuTor.dll [uTorrentBar Toolbar] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"AVP" -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe ["C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"] -> [2010/10/30 15:08:41 | 000,352,976 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
"BabylonToolbar" -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe ["C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I] -> [2010/11/07 19:22:00 | 000,286,720 | ---- | M | MD5 = 000A83380536DF86EFE77D020D812F96] (Babylon Ltd.)
"IMJPMIG8.1" -> C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE ["C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32] -> [2004/08/03 22:32:00 | 000,208,952 | ---- | M | MD5 = 7BBE4CF421AECC7F0226EDD75F12079F] (Microsoft Corporation)
"NokiaMServer" -> C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe [C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup] -> [2010/07/20 11:45:24 | 001,531,904 | ---- | M | MD5 = ACC5596B15EB0351261A483DA06F3EB3] (Nokia)
"PHIME2002A" -> C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE [C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName] -> [2003/07/17 06:23:16 | 000,455,168 | ---- | M | MD5 = 024DC0F68DF5FD6AE9DD82DFBAF479D6] (Microsoft Corporation)
"PHIME2002ASync" -> C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE [C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC] -> [2003/07/17 06:23:16 | 000,455,168 | ---- | M | MD5 = 024DC0F68DF5FD6AE9DD82DFBAF479D6] (Microsoft Corporation)
< Administrator Startup Folder > -> C:\Documents and Settings\Administrator\Start Menu\Programs\Startup ->
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup ->
< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup ->
< Owner Startup Folder > -> C:\Documents and Settings\Owner\Start Menu\Programs\Startup ->
< Software Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer ->
< Software Policy Settings [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer ->
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"HonorAutoRunSetting" -> [1] -> File not found
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"AllowLegacyWebView" -> [1] -> File not found
\\"AllowUnhashedWebView" -> [1] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
\\"NoDrives" -> [0] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
\\"NoDrives" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ ->
{4248FE82-7FCB-46AC-B270-339F08212110}:{4248FE82-7FCB-46AC-B270-339F08212110} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [Button: &Virtual Keyboard] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
{898EA8C8-E7FF-479B-8935-AEC46303B9E5}:{898EA8C8-E7FF-479B-8935-AEC46303B9E5} [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Button: Skype Plug-In] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
{898EA8C8-E7FF-479B-8935-AEC46303B9E5}:{898EA8C8-E7FF-479B-8935-AEC46303B9E5} [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Menu: Skype Plug-In] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
{CCF151D8-D089-449F-A5A4-D9909053F20F}:{CCF151D8-D089-449F-A5A4-D9909053F20F} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [Button: URLs c&heck] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\"{4248FE82-7FCB-46AC-B270-339F08212110}" [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [VirtualKeyboardButtonHandler Class] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
CmdMapping\\"{898EA8C8-E7FF-479B-8935-AEC46303B9E5}" [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Browser Helper] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
CmdMapping\\"{CCF151D8-D089-449F-A5A4-D9909053F20F}" [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [FilterButtonHandler Class] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ ->
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. ->
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ ->
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22] ->
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} [HKLM] -> http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab [MessengerStatsClient Class] ->
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22] ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab [Java Plug-in 1.6.0_22] ->
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} [HKLM] -> http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab [Reg Error: Key error.] ->
{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} [HKLM] -> http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab [Minesweeper Flags Class] ->
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ ->
DhcpNameServer -> 192.168.0.1 ->
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ ->
{54948E67-3CD4-4064-870A-277FDA57788E}\\DhcpNameServer -> 192.168.0.1 (Broadcom 440x 10/100 Integrated Controller) ->
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell ->
Explorer.exe -> C:\WINDOWS\explorer.exe -> [2004/08/04 00:56:50 | 001,032,192 | ---- | M | MD5 = A0732187050030AE399B241436565E64] (Microsoft Corporation)
*MultiFile Done* -> ->
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->
igfxcui -> C:\WINDOWS\System32\igfxsrvc.dll -> [2003/04/07 00:06:48 | 000,315,392 | ---- | M | MD5 = 6474AF152CD6025F781D7A5F2B8B6084] (Intel Corporation)
klogon -> C:\WINDOWS\system32\klogon.dll -> [2010/07/01 21:35:12 | 000,228,024 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List ->
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ->
"E:\Warcraft III\war3.exe" -> [E:\Warcraft III\war3.exe:*:Enabled:Warcraft III] -> File not found
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot ->
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 ->
"DisplayName" -> CD-ROM Driver ->
"ImagePath" -> [System32\DRIVERS\cdrom.sys] -> File not found
< Drives with AutoRun files > -> ->
C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2010/07/27 08:22:15 | 000,000,000 | ---- | M | MD5 = D41D8CD98F00B204E9800998ECF8427E] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ->
< Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command ->
comfile [open] -> "%1" %* ->
exefile [open] -> "%1" %* ->
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\ ->
.com [@ = ComFile] -> "%1" %* ->
.exe [@ = exefile] -> "%1" %* ->

[Registry - Additional Scans - Safe List]
< Drivers32 [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 ->
"msacm.iac2" -> C:\WINDOWS\System32\iac25_32.ax [iac25_32.ax] -> [2004/08/04 00:56:58 | 000,199,680 | ---- | M | MD5 = 6580E3EC7593C0621A91387AAB419524] (Intel Corporation)
"msacm.l3acm" -> C:\WINDOWS\system32\l3codeca.acm [C:\WINDOWS\System32\l3codeca.acm] -> [2010/01/30 00:43:39 | 000,307,260 | ---- | M | MD5 = F3946B534CC197CBFFD9A2ECFD1F556F] (Fraunhofer Institut Integrierte Schaltungen IIS)
"msacm.sl_anet" -> C:\WINDOWS\System32\sl_anet.acm [sl_anet.acm] -> [2004/08/04 00:56:30 | 000,086,016 | ---- | M | MD5 = 059FCD11A8F067650ABF6426E1CB43D3] (Sipro Lab Telecom Inc.)
"msacm.trspch" -> C:\WINDOWS\System32\tssoft32.acm [tssoft32.acm] -> [2003/07/17 06:48:37 | 000,008,192 | ---- | M | MD5 = E8CD0D7E169ECCE2D4FD829DAAB786ED] (DSP GROUP, INC.)
"vidc.cvid" -> C:\WINDOWS\System32\iccvid.dll [iccvid.dll] -> [2004/08/04 00:56:44 | 000,080,384 | ---- | M | MD5 = F263E68AF3B8ACE47DDB70F075B20782] (Radius Inc.)
"vidc.ffds" -> C:\Program Files\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll [C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll] -> [2009/08/30 22:13:30 | 000,085,504 | ---- | M | MD5 = 9DA0C6D1B8344F872108F621B56194FF] ()
"vidc.iv31" -> C:\WINDOWS\System32\ir32_32.dll [ir32_32.dll] -> [2003/07/17 06:30:49 | 000,199,168 | ---- | M | MD5 = 43ECA1576906BA76FB3E329A338A3CAE] ()
"vidc.iv32" -> C:\WINDOWS\System32\ir32_32.dll [ir32_32.dll] -> [2003/07/17 06:30:49 | 000,199,168 | ---- | M | MD5 = 43ECA1576906BA76FB3E329A338A3CAE] ()
"vidc.iv41" -> C:\WINDOWS\System32\ir41_32.ax [ir41_32.ax] -> [2004/08/04 00:56:58 | 000,848,384 | ---- | M | MD5 = B106530542C5920EDB040A288BD300AB] (Intel Corporation)
"vidc.iv50" -> C:\WINDOWS\System32\ir50_32.dll [ir50_32.dll] -> [2004/08/04 00:56:44 | 000,755,200 | ---- | M | MD5 = 603CC77B5E5F7977DE2ABFBA50CD6854] (Intel Corporation)
< Ext (PreApproved) - [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\ ->
{02BCC737-B171-4746-94C9-0D8A0B2C0089} [HKLM] -> C:\Program Files\Microsoft Office\Office12\IEAWSDC.DLL [Microsoft Office Template and Media Control] -> [2006/10/26 20:12:52 | 000,173,328 | ---- | M | MD5 = CC76C38D1995A716AC072D470D4A1345] ()
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [HKLM] -> C:\Program Files\QuickTime\QTPlugin.ocx [QuickTime Object] -> [2010/03/17 23:28:24 | 000,800,048 | ---- | M | MD5 = AD99EC8908185A02307CF071EF7BD9CF] (Apple Inc.)
{31261F21-2B16-45EE-BEAB-07C4CFA18B65} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{4063BE15-3B08-470D-A0D5-B37161CFFD69} [HKLM] -> C:\Program Files\QuickTime\QTPlugin.ocx [QuickTime Object] -> [2010/03/17 23:28:24 | 000,800,048 | ---- | M | MD5 = AD99EC8908185A02307CF071EF7BD9CF] (Apple Inc.)
{5852F5ED-8BF4-11D4-A245-0080C6F74284} [HKLM] -> C:\Program Files\Java\jre6\bin\wsdetect.dll [isInstalled Class] -> [2010/09/15 04:50:40 | 000,108,320 | ---- | M | MD5 = 54A3002507634139763983FBE4DBFE9A] (Sun Microsystems, Inc.)
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{7DDCF809-C211-4757-AB3E-6387D9DF530B} [HKLM] -> C:\Program Files\uTorrentBar\tbuTor.dll [uTorrentBar API Server] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
{812B35A9-45A7-4292-BF8C-94A156CE7085} [HKLM] -> C:\Program Files\ConduitEngine\ConduitEngine.dll [Conduit Engine API Server] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> C:\Program Files\Java\jre6\bin\npjpi160_22.dll [Java Plug-in 1.6.0_22] -> [2010/09/15 04:50:46 | 000,141,088 | ---- | M | MD5 = AFB7EFCDE5277F6514EF0E9FF8D8D862] (Sun Microsystems, Inc.)
{9F9C4924-C3F3-4459-A396-9E9E0D8B83D1} [HKLM] -> Reg Error: Key error. [SharePoint OpenDocuments Class] -> File not found
{BDEADEF2-C265-11D0-BCED-00A0C90AB50F} [HKLM] -> Reg Error: Key error. [SharePoint OpenDocuments Class] -> File not found
{BDEADEF4-C265-11D0-BCED-00A0C90AB50F} [HKLM] -> Reg Error: Key error. [SharePoint Stssync Handler] -> File not found
{C2828995-4A83-4100-A212-3024BA117356} [HKLM] -> C:\Program Files\Windows Live SkyDrive\Microsoft.Live.Folders.RichUpload.3.dll [Windows Live Upload Tool] -> [2008/10/29 11:46:56 | 000,245,112 | ---- | M | MD5 = DA204A2BAB5780A0DF37EB5BE58FCA57] (Microsoft Corporation)
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [HKLM] -> C:\Program Files\Java\jre6\bin\npjpi160_22.dll [Java Plug-in 1.6.0_22] -> [2010/09/15 04:50:46 | 000,141,088 | ---- | M | MD5 = AFB7EFCDE5277F6514EF0E9FF8D8D862] (Sun Microsystems, Inc.)
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBB} [HKLM] -> C:\Program Files\Java\jre6\bin\npjpi160_22.dll [Java Plug-in 1.6.0_22] -> [2010/09/15 04:50:46 | 000,141,088 | ---- | M | MD5 = AFB7EFCDE5277F6514EF0E9FF8D8D862] (Sun Microsystems, Inc.)
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC} [HKLM] -> C:\Program Files\Java\jre6\bin\npjpi160_22.dll [Java Plug-in 1.6.0_22] -> [2010/09/15 04:50:46 | 000,141,088 | ---- | M | MD5 = AFB7EFCDE5277F6514EF0E9FF8D8D862] (Sun Microsystems, Inc.)
{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} [HKLM] -> C:\WINDOWS\system32\deployJava1.dll [Deployment Toolkit] -> [2010/09/15 04:50:37 | 000,472,808 | ---- | M | MD5 = 27CADAE7E69FEEE773EA55108A8F9F47] (Sun Microsystems, Inc.)
{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA} [HKLM] -> C:\WINDOWS\system32\deployJava1.dll [Deployment Toolkit] -> [2010/09/15 04:50:37 | 000,472,808 | ---- | M | MD5 = 27CADAE7E69FEEE773EA55108A8F9F47] (Sun Microsystems, Inc.)
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBC} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{CB927D12-4FF7-4A9E-A169-56E4B8A75598} [HKLM] -> C:\Program Files\QuickTime\QTPlugin.ocx [Behavior Object] -> [2010/03/17 23:28:24 | 000,800,048 | ---- | M | MD5 = AD99EC8908185A02307CF071EF7BD9CF] (Apple Inc.)
{D719897A-B07A-4C0C-AEA9-9B663A28DFCB} [HKLM] -> C:\Program Files\iTunes\ITDetector.ocx [iTunesDetector Class] -> [2010/04/28 15:06:20 | 000,111,912 | ---- | M | MD5 = 13984DFEF5DE6E93B19B8BA31D6639C3] (Apple Inc.)
{E7339A62-0E31-4A5E-BA3D-F2FEDFBF8BE5} [HKLM] -> C:\Program Files\Common Files\Microsoft Shared\Portal\PortalConnectCore.dll [PersonalSite Class] -> [2006/10/26 21:30:44 | 000,482,088 | ---- | M | MD5 = 799A0E1244038B3FC2E1833D74FFA564] ()
< Ext (Settings) - [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\ ->
{2EECD738-5844-4A99-B4B6-146BF802613B} [HKLM] -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll [CescrtHlpr Object] -> [2010/11/07 23:45:26 | 000,225,720 | ---- | M | MD5 = 91BCFFE9095DFE033125ADD31EE7FFC1] (Babylon BHO)
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Browser Helper] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
{98889811-442D-49DD-99D7-DC866BE87DBC} [HKLM] -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll [Babylon Toolbar] -> [2010/11/07 23:45:28 | 000,184,760 | ---- | M | MD5 = CF158FAC1864EE97BFE3221285FEC23A] (Babylon Ltd.)
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Plug-In] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
{BDD307C3-7BC0-4542-9F8F-A9611FE6C1BF} [HKLM] -> C:\WINDOWS\system32\proctexe.ocx [Additive Surface] -> [2004/08/03 23:00:26 | 000,081,920 | ---- | M | MD5 = DAF4D5399F78812D3D79F0C9EAB1AC6B] (Intel Corporation)
{FB5F1910-F110-11D2-BB9E-00C04F795683} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Ext (Stats) - [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\ ->
{2670000A-7350-4F3C-8081-5663EE0C6C49} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{2EECD738-5844-4A99-B4B6-146BF802613B} [HKLM] -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll [CescrtHlpr Object] -> [2010/11/07 23:45:26 | 000,225,720 | ---- | M | MD5 = 91BCFFE9095DFE033125ADD31EE7FFC1] (Babylon BHO)
{30F9B915-B755-4826-820B-08FBA6BD249D} [HKLM] -> C:\Program Files\ConduitEngine\ConduitEngine.dll [Conduit Engine] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
{4248FE82-7FCB-46AC-B270-339F08212110} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [VirtualKeyboardButtonHandler Class] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll [IEVkbdBHO Class] -> [2010/07/01 21:35:08 | 000,068,280 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
{5C255C8A-E604-49B4-9D64-90988571CECB} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Browser Helper] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
{92780B25-18CC-41C8-B9BE-3C9C571A8263} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{98889811-442D-49DD-99D7-DC866BE87DBC} [HKLM] -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll [Babylon Toolbar] -> [2010/11/07 23:45:28 | 000,184,760 | ---- | M | MD5 = CF158FAC1864EE97BFE3221285FEC23A] (Babylon Ltd.)
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} [HKLM] -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Skype Plug-In] -> [2010/11/22 19:05:52 | 001,242,504 | ---- | M | MD5 = 590C4454A1D36F76DA1F636FAD139771] (Skype Technologies S.A.)
{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} [HKLM] -> C:\Program Files\uTorrentBar\tbuTor.dll [uTorrentBar Toolbar] -> [2010/12/09 12:51:30 | 003,911,776 | ---- | M | MD5 = D9A0CE26ADA5BD15B1B03A752DDF14A6] (Conduit Ltd.)
{CCF151D8-D089-449F-A5A4-D9909053F20F} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [FilterButtonHandler Class] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{E33CF602-D945-461A-83F0-819F76A199F8} [HKLM] -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [FilterBHO Class] -> [2010/07/01 21:35:14 | 000,191,160 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
{FB5F1910-F110-11D2-BB9E-00C04F795683} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Internet Explorer Bars [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ ->
{32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Internet Explorer Bars [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ ->
{32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Internet Explorer Bars [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ ->
{32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Internet Explorer Bars [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ ->
{32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Internet Explorer Bars [HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\] > -> HKEY_USERS\S-1-5-21-1801674531-682003330-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ ->
{32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost > -> ->
*netsvcs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs ->
6to4 -> -> File not found
AppMgmt -> -> File not found
Ias -> -> File not found
Iprip -> -> File not found
Irmon -> -> File not found
NWCWorkstation -> -> File not found
Nwsapagent -> -> File not found
WmdmPmSp -> -> File not found
*MultiFile Done* -> ->
< SafeBoot-Minimal Settings > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ ->
{36FC9E60-C465-11CF-8056-444553540000} -> Universal Serial Bus controllers
{4D36E965-E325-11CE-BFC1-08002BE10318} -> CD-ROM Drive
{4D36E967-E325-11CE-BFC1-08002BE10318} -> DiskDrive
{4D36E969-E325-11CE-BFC1-08002BE10318} -> Standard floppy disk controller
{4D36E96A-E325-11CE-BFC1-08002BE10318} -> Hdc
{4D36E96B-E325-11CE-BFC1-08002BE10318} -> Keyboard
{4D36E96F-E325-11CE-BFC1-08002BE10318} -> Mouse
{4D36E977-E325-11CE-BFC1-08002BE10318} -> PCMCIA Adapters
{4D36E97B-E325-11CE-BFC1-08002BE10318} -> SCSIAdapter
{4D36E97D-E325-11CE-BFC1-08002BE10318} -> System
{4D36E980-E325-11CE-BFC1-08002BE10318} -> Floppy disk drive
{533C5B84-EC70-11D2-9505-00C04F79DEAF} -> Volume shadow copy
{71A27CDD-812A-11D0-BEC7-08002BE2092F} -> Volume
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA} -> Human Interface Devices
AppMgmt -> -> File not found
Base -> Driver Group
Boot Bus Extender -> Driver Group
Boot file system -> Driver Group
File system -> Driver Group
Filter -> Driver Group
PCI Configuration -> Driver Group
PNP Filter -> Driver Group
Primary disk -> Driver Group
SCSI Class -> Driver Group
sermouse.sys -> Driver
System Bus Extender -> Driver Group
vds -> Service
vga.sys -> Driver
< SafeBoot-Network Settings > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ ->
{36FC9E60-C465-11CF-8056-444553540000} -> Universal Serial Bus controllers
{4D36E965-E325-11CE-BFC1-08002BE10318} -> CD-ROM Drive
{4D36E967-E325-11CE-BFC1-08002BE10318} -> DiskDrive
{4D36E969-E325-11CE-BFC1-08002BE10318} -> Standard floppy disk controller
{4D36E96A-E325-11CE-BFC1-08002BE10318} -> Hdc
{4D36E96B-E325-11CE-BFC1-08002BE10318} -> Keyboard
{4D36E96F-E325-11CE-BFC1-08002BE10318} -> Mouse
{4D36E972-E325-11CE-BFC1-08002BE10318} -> Net
{4D36E973-E325-11CE-BFC1-08002BE10318} -> NetClient
{4D36E974-E325-11CE-BFC1-08002BE10318} -> NetService
{4D36E975-E325-11CE-BFC1-08002BE10318} -> NetTrans
{4D36E977-E325-11CE-BFC1-08002BE10318} -> PCMCIA Adapters
{4D36E97B-E325-11CE-BFC1-08002BE10318} -> SCSIAdapter
{4D36E97D-E325-11CE-BFC1-08002BE10318} -> System
{4D36E980-E325-11CE-BFC1-08002BE10318} -> Floppy disk drive
{71A27CDD-812A-11D0-BEC7-08002BE2092F} -> Volume
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA} -> Human Interface Devices
AppMgmt -> -> File not found
Base -> Driver Group
Boot Bus Extender -> Driver Group
Boot file system -> Driver Group
File system -> Driver Group
Filter -> Driver Group
NDIS Wrapper -> Driver Group
NetBIOSGroup -> Driver Group
NetDDEGroup -> Driver Group
Network -> Driver Group
NetworkProvider -> Driver Group
PCI Configuration -> Driver Group
PNP Filter -> Driver Group
PNP_TDI -> Driver Group
Primary disk -> Driver Group
SCSI Class -> Driver Group
sermouse.sys -> Driver
Streams Drivers -> Driver Group
System Bus Extender -> Driver Group
TDI -> Driver Group
vga.sys -> Driver

Re: MS Removal Tool changed proxy setting18th April 2011, 6:23 am

second part

Spoiler :

[Files/Folders - Created Within 90 Days]
OTS.exe -> C:\Documents and Settings\Owner\Desktop\OTS.exe -> [2011/04/18 15:50:14 | 000,645,632 | ---- | C | MD5 = AF5A3E59558352FF5867CFA60A096A5E] (OldTimer Tools)
_OTL -> C:\_OTL -> [2011/04/17 21:55:31 | 000,000,000 | ---D | C]
otl -> C:\Documents and Settings\Owner\Desktop\otl -> [2011/04/17 10:11:05 | 000,000,000 | ---D | C]
ESET -> C:\Program Files\ESET -> [2011/04/15 21:56:06 | 000,000,000 | ---D | C]
RECYCLER -> C:\RECYCLER -> [2011/04/15 18:21:05 | 000,000,000 | -HSD | C]
cmdcons -> C:\cmdcons -> [2011/04/15 14:59:07 | 000,000,000 | RHSD | C]
SWXCACLS.exe -> C:\WINDOWS\SWXCACLS.exe -> [2011/04/15 14:57:27 | 000,212,480 | ---- | C | MD5 = B1A9CF0B6F80611D31987C247EC630B4] (SteelWerX)
SWREG.exe -> C:\WINDOWS\SWREG.exe -> [2011/04/15 14:57:27 | 000,161,792 | ---- | C | MD5 = 01D95A1F8CF13D07CC564AABB36BCC0B] (SteelWerX)
SWSC.exe -> C:\WINDOWS\SWSC.exe -> [2011/04/15 14:57:27 | 000,136,704 | ---- | C | MD5 = B7517DB073B28F5696A1E5528ABEB5D0] (SteelWerX)
NIRCMD.exe -> C:\WINDOWS\NIRCMD.exe -> [2011/04/15 14:57:27 | 000,031,232 | ---- | C | MD5 = AE72E8619CB31D84DA25E2435E55003C] (NirSoft)
ERDNT -> C:\WINDOWS\ERDNT -> [2011/04/15 14:57:19 | 000,000,000 | ---D | C]
Qoobox -> C:\Qoobox -> [2011/04/15 14:57:12 | 000,000,000 | ---D | C]
PSX2PSPv1.4.2FULL -> C:\Documents and Settings\Owner\My Documents\PSX2PSPv1.4.2FULL -> [2011/04/14 16:39:10 | 000,000,000 | ---D | C]
ImpalerPSX -> C:\Documents and Settings\Owner\My Documents\ImpalerPSX -> [2011/04/14 16:38:30 | 000,000,000 | ---D | C]
Malwarebytes -> C:\Documents and Settings\Owner\Application Data\Malwarebytes -> [2011/04/13 16:45:27 | 000,000,000 | ---D | C]
Malwarebytes' Anti-Malware -> C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware -> [2011/04/13 16:45:20 | 000,000,000 | ---D | C]
mbamswissarmy.sys -> C:\WINDOWS\System32\drivers\mbamswissarmy.sys -> [2011/04/13 16:45:19 | 000,038,224 | ---- | C | MD5 = D68E165C3123ABA3B1282EDDB4213BD8] (Malwarebytes Corporation)
Malwarebytes -> C:\Documents and Settings\All Users\Application Data\Malwarebytes -> [2011/04/13 16:45:19 | 000,000,000 | ---D | C]
mbam.sys -> C:\WINDOWS\System32\drivers\mbam.sys -> [2011/04/13 16:45:16 | 000,020,952 | ---- | C | MD5 = 836E0E09CA9869BE7EB39EF2CF3602C7] (Malwarebytes Corporation)
Malwarebytes' Anti-Malware -> C:\Program Files\Malwarebytes' Anti-Malware -> [2011/04/13 16:45:16 | 000,000,000 | ---D | C]
Kaspersky Anti-Virus 2011 -> C:\Documents and Settings\All Users\Start Menu\Programs\Kaspersky Anti-Virus 2011 -> [2011/04/12 21:50:41 | 000,000,000 | ---D | C]
nJg28258bAfHl28258 -> C:\Documents and Settings\All Users\Application Data\nJg28258bAfHl28258 -> [2011/04/12 20:36:21 | 000,000,000 | ---D | C]
Axialis -> C:\Documents and Settings\Owner\Application Data\Axialis -> [2011/04/12 18:23:06 | 000,000,000 | ---D | C]
Axialis -> C:\Program Files\Axialis -> [2011/04/12 18:23:03 | 000,000,000 | ---D | C]
Axialis -> C:\Documents and Settings\Owner\Local Settings\Application Data\Axialis -> [2011/04/12 18:22:57 | 000,000,000 | ---D | C]
FileServe Manager -> C:\Documents and Settings\Owner\Local Settings\Application Data\FileServe Manager -> [2011/04/12 17:42:04 | 000,000,000 | ---D | C]
FileServe Limited -> C:\Documents and Settings\All Users\Application Data\FileServe Limited -> [2011/04/12 17:41:44 | 000,000,000 | ---D | C]
BabylonToolbar -> C:\Documents and Settings\Owner\Application Data\BabylonToolbar -> [2011/04/10 18:37:49 | 000,000,000 | ---D | C]
Messenger Plus! -> C:\Documents and Settings\All Users\Application Data\Messenger Plus! -> [2011/04/09 21:59:12 | 000,000,000 | ---D | C]
BabylonToolbar -> C:\Program Files\BabylonToolbar -> [2011/04/09 21:58:25 | 000,000,000 | ---D | C]
Yuna Software -> C:\Program Files\Yuna Software -> [2011/04/09 21:57:59 | 000,000,000 | ---D | C]
Microsoft -> C:\Program Files\Microsoft -> [2011/04/07 19:20:29 | 000,000,000 | ---D | C]
Windows Live -> C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live -> [2011/04/07 19:20:15 | 000,000,000 | ---D | C]
Windows Live -> C:\Program Files\Windows Live -> [2011/04/07 19:19:56 | 000,000,000 | ---D | C]
iTunes -> C:\Documents and Settings\All Users\Start Menu\Programs\iTunes -> [2011/04/02 20:04:55 | 000,000,000 | ---D | C]
iPod -> C:\Program Files\iPod -> [2011/04/02 20:03:58 | 000,000,000 | ---D | C]
iTunes -> C:\Program Files\iTunes -> [2011/04/02 20:03:51 | 000,000,000 | ---D | C]
QuickTime -> C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime -> [2011/04/02 20:03:14 | 000,000,000 | ---D | C]
QuickTime -> C:\Program Files\QuickTime -> [2011/04/02 20:02:49 | 000,000,000 | ---D | C]
Apple Software Update -> C:\Program Files\Apple Software Update -> [2011/04/02 20:02:29 | 000,000,000 | ---D | C]
SilvrLnk.sys -> C:\WINDOWS\System32\drivers\SilvrLnk.sys -> [2011/03/31 22:01:40 | 000,021,456 | ---- | C | MD5 = 392834ADB35DEB199B03AE6A6CAAB23A] (Texas Instruments Incorporated)
TI Tools -> C:\Documents and Settings\All Users\Start Menu\Programs\TI Tools -> [2011/03/31 22:01:21 | 000,000,000 | ---D | C]
TI Education -> C:\Program Files\TI Education -> [2011/03/31 22:01:16 | 000,000,000 | ---D | C]
Wise Installation Wizard -> C:\Program Files\Common Files\Wise Installation Wizard -> [2011/03/31 21:53:56 | 000,000,000 | ---D | C]
NJStar Chinese WP -> C:\Documents and Settings\Owner\Start Menu\Programs\NJStar Chinese WP -> [2011/03/25 20:56:59 | 000,000,000 | ---D | C]
NJStar Chinese WP -> C:\Documents and Settings\All Users\Start Menu\Programs\NJStar Chinese WP -> [2011/03/25 20:56:59 | 000,000,000 | ---D | C]
NJStar -> C:\Documents and Settings\Owner\Application Data\NJStar -> [2011/03/25 20:56:59 | 000,000,000 | ---D | C]
NJStar Chinese WP -> C:\Program Files\NJStar Chinese WP -> [2011/03/25 20:56:56 | 000,000,000 | ---D | C]
skypePM -> C:\Documents and Settings\Owner\Application Data\skypePM -> [2011/03/18 20:41:03 | 000,000,000 | ---D | C]
Skype -> C:\Documents and Settings\All Users\Start Menu\Programs\Skype -> [2011/03/18 20:40:09 | 000,000,000 | ---D | C]
Skype -> C:\Program Files\Common Files\Skype -> [2011/03/18 20:40:08 | 000,000,000 | ---D | C]
Skype -> C:\Program Files\Skype -> [2011/03/18 20:40:06 | 000,000,000 | R--D | C]
Skype -> C:\Documents and Settings\Owner\Application Data\Skype -> [2011/03/18 20:40:02 | 000,000,000 | ---D | C]
Skype -> C:\Documents and Settings\All Users\Application Data\Skype -> [2011/03/18 20:39:54 | 000,000,000 | ---D | C]
Recent -> C:\Documents and Settings\Owner\Recent -> [2011/02/14 13:04:29 | 000,000,000 | RH-D | C]
CCleaner -> C:\Program Files\CCleaner -> [2011/02/14 13:02:44 | 000,000,000 | ---D | C]
Conduit -> C:\Documents and Settings\Owner\Local Settings\Application Data\Conduit -> [2011/01/28 16:07:00 | 000,000,000 | ---D | C]
Conduit -> C:\Program Files\Conduit -> [2011/01/28 16:06:59 | 000,000,000 | ---D | C]
uTorrentBar -> C:\Documents and Settings\Owner\Local Settings\Application Data\uTorrentBar -> [2011/01/28 16:06:55 | 000,000,000 | ---D | C]
ConduitEngine -> C:\Documents and Settings\Owner\Local Settings\Application Data\ConduitEngine -> [2011/01/28 16:06:50 | 000,000,000 | ---D | C]
ConduitEngine -> C:\Program Files\ConduitEngine -> [2011/01/28 16:06:47 | 000,000,000 | ---D | C]
uTorrentBar -> C:\Program Files\uTorrentBar -> [2011/01/28 16:06:37 | 000,000,000 | ---D | C]
Apple Computer -> C:\Documents and Settings\LocalService\Application Data\Apple Computer -> [2011/01/25 23:00:07 | 000,000,000 | ---D | C]

[Files/Folders - Modified Within 90 Days]
OTS.exe -> C:\Documents and Settings\Owner\Desktop\OTS.exe -> [2011/04/18 15:50:15 | 000,645,632 | ---- | M | MD5 = AF5A3E59558352FF5867CFA60A096A5E] (OldTimer Tools)
bootstat.dat -> C:\WINDOWS\bootstat.dat -> [2011/04/18 15:48:24 | 000,002,048 | --S- | M | MD5 = 6A2CB42966136854F4464516FBB4AE72] ()
Microsoft Office Word 2007.lnk -> C:\Documents and Settings\Owner\Desktop\Microsoft Office Word 2007.lnk -> [2011/04/18 11:05:44 | 000,002,515 | ---- | M | MD5 = 5835521B7442B2F98279A84BC8FEA985] ()
CKScanner.exe -> C:\Documents and Settings\Owner\Desktop\CKScanner.exe -> [2011/04/16 10:01:26 | 000,453,632 | ---- | M | MD5 = B3DFC8305C0C2AEE37B478D95DBC81FF] ()
hosts -> C:\WINDOWS\System32\drivers\etc\hosts -> [2011/04/15 15:07:42 | 000,000,027 | ---- | M | MD5 = 6A4029CFF35FD4BA34C001C1ED5D9945] ()
boot.ini -> C:\boot.ini -> [2011/04/15 14:59:12 | 000,000,327 | RHS- | M | MD5 = 012058B1753F8A6C221D1884098FBD82] ()
ComboFix.exe -> C:\Documents and Settings\Owner\Desktop\ComboFix.exe -> [2011/04/15 14:56:23 | 004,321,202 | R--- | M | MD5 = 5AE5F54F211EE7CB6AE604AF63D6E039] ()
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2011/04/15 12:19:54 | 000,039,424 | ---- | M | MD5 = 11452D05E3159BF3957B494FB45D86DB] ()
Malwarebytes' Anti-Malware.lnk -> C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk -> [2011/04/13 16:45:20 | 000,000,784 | ---- | M | MD5 = E6CAB5A056172204F4F2BEB220C88C1D] ()
klin.dat -> C:\WINDOWS\System32\drivers\klin.dat -> [2011/04/09 14:53:02 | 000,115,267 | ---- | M | Unable to obtain MD5] ()
klick.dat -> C:\WINDOWS\System32\drivers\klick.dat -> [2011/04/09 14:53:02 | 000,097,859 | ---- | M | Unable to obtain MD5] ()
FNTCACHE.DAT -> C:\WINDOWS\System32\FNTCACHE.DAT -> [2011/04/01 15:24:56 | 000,286,904 | ---- | M | MD5 = 27FABBD471C41E42F121644EBBB9D632] ()
TI Connect.lnk -> C:\Documents and Settings\All Users\Desktop\TI Connect.lnk -> [2011/03/31 22:01:22 | 000,001,102 | ---- | M | MD5 = 7BB9BE802EE12DE5799A0391018FB0BB] ()
NJStar Chinese WP.lnk -> C:\Documents and Settings\All Users\Desktop\NJStar Chinese WP.lnk -> [2011/03/25 20:56:59 | 000,000,733 | ---- | M | MD5 = 396F15FBF61009F00A53FC54BAD5AD68] ()
Mozilla Firefox.lnk -> C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk -> [2011/03/25 20:27:57 | 000,000,742 | ---- | M | MD5 = AECC81EEF44491A59D2032FF3555874E] ()
Skype.lnk -> C:\Documents and Settings\All Users\Desktop\Skype.lnk -> [2011/03/20 19:39:57 | 000,002,415 | ---- | M | MD5 = 0DE556D8013F8C612F72E47FEEB05675] ()
ezsidmv.dat -> C:\WINDOWS\System32\ezsidmv.dat -> [2011/03/18 20:41:06 | 000,000,056 | -H-- | M | MD5 = 29F8A8CBEC629393A068923EA41AB2B2] ()
perfh009.dat -> C:\WINDOWS\System32\perfh009.dat -> [2011/03/18 18:14:09 | 000,495,958 | ---- | M | MD5 = A70FADF2861D4B723DB2EDCF9752DE50] ()
perfc009.dat -> C:\WINDOWS\System32\perfc009.dat -> [2011/03/18 18:14:09 | 000,084,442 | ---- | M | MD5 = EDD5EBE35E0860727B3EA5AF3E8B9D02] ()
Microsoft Office Excel 2007.lnk -> C:\Documents and Settings\Owner\Desktop\Microsoft Office Excel 2007.lnk -> [2011/03/08 22:11:41 | 000,002,485 | ---- | M | MD5 = 9D2523EE9D4DC2746FBEFE0249E8A9C9] ()
wpa.dbl -> C:\WINDOWS\System32\wpa.dbl -> [2011/03/06 15:32:33 | 000,002,206 | ---- | M | MD5 = D1EEA952A2CCF71A779146BFD1086A83] ()

[Files - No Company Name]
CKScanner.exe -> C:\Documents and Settings\Owner\Desktop\CKScanner.exe -> [2011/04/16 10:01:25 | 000,453,632 | ---- | C | MD5 = B3DFC8305C0C2AEE37B478D95DBC81FF] ()
Boot.bak -> C:\Boot.bak -> [2011/04/15 14:59:12 | 000,000,211 | ---- | C | MD5 = F61DF22835F390A718706EFAF02C55F9] ()
cmldr -> C:\cmldr -> [2011/04/15 14:59:08 | 000,260,272 | RHS- | C | MD5 = 94E5450C43E4CF78E1D3AD4816966909] ()
PEV.exe -> C:\WINDOWS\PEV.exe -> [2011/04/15 14:57:27 | 000,256,512 | ---- | C | MD5 = F1FBA6185A6A2BC6456970914875078E] ()
sed.exe -> C:\WINDOWS\sed.exe -> [2011/04/15 14:57:27 | 000,098,816 | ---- | C | MD5 = 2B657A67AEBB84AEA5632C53E61E23BF] ()
MBR.exe -> C:\WINDOWS\MBR.exe -> [2011/04/15 14:57:27 | 000,089,088 | ---- | C | MD5 = 9DAA7218961710008D7385B01BD3F386] ()
grep.exe -> C:\WINDOWS\grep.exe -> [2011/04/15 14:57:27 | 000,080,412 | ---- | C | MD5 = 9E05A9C264C8A908A8E79450FCBFF047] ()
zip.exe -> C:\WINDOWS\zip.exe -> [2011/04/15 14:57:27 | 000,068,096 | ---- | C | MD5 = 5E832F4FAF5F481F2EAF3B3A48F603B8] ()
ComboFix.exe -> C:\Documents and Settings\Owner\Desktop\ComboFix.exe -> [2011/04/15 14:56:06 | 004,321,202 | R--- | C | MD5 = 5AE5F54F211EE7CB6AE604AF63D6E039] ()
Malwarebytes' Anti-Malware.lnk -> C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk -> [2011/04/13 16:45:20 | 000,000,784 | ---- | C | MD5 = E6CAB5A056172204F4F2BEB220C88C1D] ()
TI Connect.lnk -> C:\Documents and Settings\All Users\Desktop\TI Connect.lnk -> [2011/03/31 22:01:22 | 000,001,102 | ---- | C | MD5 = 7BB9BE802EE12DE5799A0391018FB0BB] ()
NJStar Chinese WP.lnk -> C:\Documents and Settings\All Users\Desktop\NJStar Chinese WP.lnk -> [2011/03/25 20:56:59 | 000,000,733 | ---- | C | MD5 = 396F15FBF61009F00A53FC54BAD5AD68] ()
Mozilla Firefox.lnk -> C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk -> [2011/03/25 20:27:57 | 000,000,730 | ---- | C | MD5 = F3B316BD7BE173DE7B9FDEF57BF3B400] ()
ezsidmv.dat -> C:\WINDOWS\System32\ezsidmv.dat -> [2011/03/18 20:41:06 | 000,000,056 | -H-- | C | MD5 = 29F8A8CBEC629393A068923EA41AB2B2] ()
Skype.lnk -> C:\Documents and Settings\All Users\Desktop\Skype.lnk -> [2011/03/18 20:40:09 | 000,002,415 | ---- | C | MD5 = 0DE556D8013F8C612F72E47FEEB05675] ()
Microsoft Office Excel 2007.lnk -> C:\Documents and Settings\Owner\Desktop\Microsoft Office Excel 2007.lnk -> [2011/03/09 21:08:34 | 000,002,485 | ---- | C | MD5 = 9D2523EE9D4DC2746FBEFE0249E8A9C9] ()
klin.dat -> C:\WINDOWS\System32\drivers\klin.dat -> [2010/10/30 13:04:35 | 000,115,267 | ---- | C | Unable to obtain MD5] ()
klick.dat -> C:\WINDOWS\System32\drivers\klick.dat -> [2010/10/30 13:04:35 | 000,097,859 | ---- | C | Unable to obtain MD5] ()
FontCache3.0.0.0.dat -> C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat -> [2010/08/07 22:18:48 | 000,168,400 | ---- | C | MD5 = 51A564B463E9C8C82A34625F28F575CF] ()
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2010/07/28 21:06:10 | 000,039,424 | ---- | C | MD5 = 11452D05E3159BF3957B494FB45D86DB] ()
ODBCINST.INI -> C:\WINDOWS\ODBCINST.INI -> [2010/07/27 18:11:36 | 000,004,161 | ---- | C | MD5 = CF20C26877B14BED0A9AA15A4800C3F8] ()
FNTCACHE.DAT -> C:\WINDOWS\System32\FNTCACHE.DAT -> [2010/07/27 18:10:40 | 000,286,904 | ---- | C | MD5 = 27FABBD471C41E42F121644EBBB9D632] ()
nsreg.dat -> C:\WINDOWS\nsreg.dat -> [2010/07/27 14:18:03 | 000,000,000 | ---- | C | MD5 = D41D8CD98F00B204E9800998ECF8427E] ()
bootstat.dat -> C:\WINDOWS\bootstat.dat -> [2010/07/27 08:32:45 | 000,002,048 | --S- | C | MD5 = 6A2CB42966136854F4464516FBB4AE72] ()
emptyregdb.dat -> C:\WINDOWS\System32\emptyregdb.dat -> [2010/07/27 08:19:59 | 000,021,640 | ---- | C | MD5 = 6F2F869DC147CA61D13C297CE827E9B1] ()
klopp.dat -> C:\WINDOWS\System32\drivers\klopp.dat -> [2009/09/09 19:01:40 | 000,027,675 | ---- | C | Unable to obtain MD5] ()
secupd.dat -> C:\WINDOWS\System32\secupd.dat -> [2004/08/02 14:20:40 | 000,004,569 | ---- | C | MD5 = 8588009E29654C772D891CD9CE983A1C] ()
oembios.dat -> C:\WINDOWS\System32\oembios.dat -> [2003/07/17 06:54:55 | 000,004,594 | ---- | C | MD5 = 17C9BFB1927530DB531AD11EB0AF4DF2] ()
oembios.bin -> C:\WINDOWS\System32\oembios.bin -> [2003/07/17 06:54:54 | 013,107,200 | ---- | C | MD5 = 5D99FEC4DC0AFA9EC9CA7E802A783DD3] ()
secdrv.sys -> C:\WINDOWS\System32\drivers\secdrv.sys -> [2003/07/17 06:44:08 | 000,027,440 | ---- | C | MD5 = D26E26EA516450AF9D072635C60387F4] ()
perfh009.dat -> C:\WINDOWS\System32\perfh009.dat -> [2003/07/17 06:41:25 | 000,495,958 | ---- | C | MD5 = A70FADF2861D4B723DB2EDCF9752DE50] ()
perfi009.dat -> C:\WINDOWS\System32\perfi009.dat -> [2003/07/17 06:41:25 | 000,272,128 | ---- | C | MD5 = 7796CCDEE5911408F15092CF3C3A563C] ()
perfd009.dat -> C:\WINDOWS\System32\perfd009.dat -> [2003/07/17 06:41:23 | 000,028,626 | ---- | C | MD5 = ECA2A3B283482FB78B446902F0BBA7DC] ()
perfc009.dat -> C:\WINDOWS\System32\perfc009.dat -> [2003/07/17 06:41:21 | 000,084,442 | ---- | C | MD5 = EDD5EBE35E0860727B3EA5AF3E8B9D02] ()
noise.dat -> C:\WINDOWS\System32\noise.dat -> [2003/07/17 06:39:07 | 000,000,741 | ---- | C | MD5 = DE78E0C57BC478D47CC2F470B68E1A45] ()
mlang.dat -> C:\WINDOWS\System32\mlang.dat -> [2003/07/17 06:33:50 | 000,673,088 | ---- | C | MD5 = ED434A3EBE29070A7E0138C42482EB93] ()
mib.bin -> C:\WINDOWS\System32\mib.bin -> [2003/07/17 06:33:39 | 000,046,258 | ---- | C | MD5 = 6FAFC044FAC0A871A0D9BE448FF83832] ()
dssec.dat -> C:\WINDOWS\System32\dssec.dat -> [2003/07/17 06:27:41 | 000,218,003 | ---- | C | MD5 = B26B88487BB3F49726DEB5E7D160DC38] ()
dcache.bin -> C:\WINDOWS\System32\dcache.bin -> [2003/07/17 06:26:37 | 000,001,788 | ---- | C | MD5 = 524C47310868F0D11A7CF21D3CEE0FD1] ()

[File - Lop Check]
FileServe Limited -> C:\Documents and Settings\All Users\Application Data\FileServe Limited -> [2011/04/12 17:41:44 | 000,000,000 | ---D | M]
Messenger Plus! -> C:\Documents and Settings\All Users\Application Data\Messenger Plus! -> [2011/04/09 21:59:12 | 000,000,000 | ---D | M]
NexonUS -> C:\Documents and Settings\All Users\Application Data\NexonUS -> [2011/04/02 19:54:50 | 000,000,000 | ---D | M]
nJg28258bAfHl28258 -> C:\Documents and Settings\All Users\Application Data\nJg28258bAfHl28258 -> [2011/04/13 17:08:32 | 000,000,000 | ---D | M]
Nokia -> C:\Documents and Settings\All Users\Application Data\Nokia -> [2010/10/26 21:09:44 | 000,000,000 | ---D | M]
NokiaInstallerCache -> C:\Documents and Settings\All Users\Application Data\NokiaInstallerCache -> [2010/10/26 20:23:51 | 000,000,000 | ---D | M]
PC Suite -> C:\Documents and Settings\All Users\Application Data\PC Suite -> [2010/10/26 20:34:01 | 000,000,000 | ---D | M]
PMB Files -> C:\Documents and Settings\All Users\Application Data\PMB Files -> [2011/01/10 19:39:58 | 000,000,000 | ---D | M]
{429CAD59-35B1-4DBC-BB6D-1DB246563521} -> C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} -> [2010/08/08 20:28:09 | 000,000,000 | ---D | M]
{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} -> C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} -> [2010/07/27 21:06:07 | 000,000,000 | ---D | M]
Axialis -> C:\Documents and Settings\Owner\Application Data\Axialis -> [2011/04/12 18:23:06 | 000,000,000 | ---D | M]
BabylonToolbar -> C:\Documents and Settings\Owner\Application Data\BabylonToolbar -> [2011/04/10 18:37:49 | 000,000,000 | ---D | M]
Foxit Software -> C:\Documents and Settings\Owner\Application Data\Foxit Software -> [2010/08/02 20:09:49 | 000,000,000 | ---D | M]
GetRightToGo -> C:\Documents and Settings\Owner\Application Data\GetRightToGo -> [2010/07/29 19:19:47 | 000,000,000 | ---D | M]
NJStar -> C:\Documents and Settings\Owner\Application Data\NJStar -> [2011/03/25 20:56:59 | 000,000,000 | ---D | M]
Nokia -> C:\Documents and Settings\Owner\Application Data\Nokia -> [2010/10/26 20:38:51 | 000,000,000 | ---D | M]
PC Suite -> C:\Documents and Settings\Owner\Application Data\PC Suite -> [2010/10/26 20:40:24 | 000,000,000 | ---D | M]
uTorrent -> C:\Documents and Settings\Owner\Application Data\uTorrent -> [2011/04/12 22:48:16 | 000,000,000 | ---D | M]

[File - Purity Scan]

[Custom Scans]
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
klogon.dll : Unable to obtain MD5 -> C:\WINDOWS\system32\klogon.dll -> [2010/07/01 21:35:12 | 000,228,024 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
< %systemroot%\system32\*.exe /lockedfiles >
< %systemroot%\Tasks\*.job /lockedfiles >
< %systemroot%\system32\drivers\*.sys /lockedfiles >
kl1.sys : Unable to obtain MD5 -> C:\WINDOWS\system32\drivers\kl1.sys -> [2010/06/09 17:43:50 | 000,132,184 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
kl2.sys : Unable to obtain MD5 -> C:\WINDOWS\system32\drivers\kl2.sys -> [2010/06/09 17:43:52 | 000,011,352 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
klif.sys : Unable to obtain MD5 -> C:\WINDOWS\system32\drivers\klif.sys -> [2010/10/30 15:08:41 | 000,475,736 | ---- | M | Unable to obtain MD5] (Kaspersky Lab)
klim5.sys : Unable to obtain MD5 -> C:\WINDOWS\system32\drivers\klim5.sys -> [2010/05/07 12:06:26 | 000,032,856 | ---- | M | Unable to obtain MD5] (Kaspersky Lab ZAO)
klmouflt.sys : Unable to obtain MD5 -> C:\WINDOWS\system32\drivers\klmouflt.sys -> [2009/11/02 20:27:24 | 000,019,472 | ---- | M | Unable to obtain MD5] (Kaspersky Lab)
< %systemroot%\System32\config\*.sav >
default.sav -> C:\WINDOWS\system32\config\default.sav -> [2010/07/27 18:10:04 | 000,094,208 | ---- | M | MD5 = 017F508F3D6B922E77D9230AE05AD7D5] ()
software.sav -> C:\WINDOWS\system32\config\software.sav -> [2010/07/27 18:10:04 | 000,602,112 | ---- | M | MD5 = 8F10884415F428920631AE450A8F5884] ()
system.sav -> C:\WINDOWS\system32\config\system.sav -> [2010/07/27 18:10:04 | 000,393,216 | ---- | M | MD5 = C1F66650239AB49BB39F5641CDF66BF3] ()
< %systemroot%\System32\*.sys >
ansi.sys -> C:\WINDOWS\system32\ansi.sys -> [2003/07/17 06:24:13 | 000,009,029 | ---- | M | MD5 = 8AAD333C876590293F72B315E162BCC7] ()
country.sys -> C:\WINDOWS\system32\country.sys -> [2003/07/17 06:25:52 | 000,027,097 | ---- | M | MD5 = 0FE9F16075C9ACB941C957B7C649176E] ()
himem.sys -> C:\WINDOWS\system32\himem.sys -> [2003/07/17 06:29:25 | 000,004,768 | ---- | M | MD5 = E6BC0F98FECEF245A0010D350C1A0B9B] ()
key01.sys -> C:\WINDOWS\system32\key01.sys -> [2003/07/17 06:31:42 | 000,042,809 | ---- | M | MD5 = 582BCDD47CF4B68B5CB528F18E3CB808] ()
keyboard.sys -> C:\WINDOWS\system32\keyboard.sys -> [2003/07/17 06:31:44 | 000,042,537 | ---- | M | MD5 = FBBCFEC1379C5C02D88A361993EDF1B8] ()
npptNT2.sys -> C:\WINDOWS\system32\npptNT2.sys -> [2005/01/04 10:43:08 | 000,004,682 | ---- | M | MD5 = 9131FE60ADFAB595C8DA53AD6A06AA31] (INCA Internet Co., Ltd.)
ntdos.sys -> C:\WINDOWS\system32\ntdos.sys -> [2003/07/17 06:39:32 | 000,027,866 | ---- | M | MD5 = FFFF296A08DBF2AC0126C62E3778AC0D] ()
ntdos404.sys -> C:\WINDOWS\system32\ntdos404.sys -> [2003/07/17 06:39:33 | 000,029,146 | ---- | M | MD5 = CF9ED169FF86D935E47999E82359E898] ()
ntdos411.sys -> C:\WINDOWS\system32\ntdos411.sys -> [2003/07/17 06:39:33 | 000,029,370 | ---- | M | MD5 = 03B945AC0481CD8BB161C3569D8ED1C3] ()
ntdos412.sys -> C:\WINDOWS\system32\ntdos412.sys -> [2003/07/17 06:39:37 | 000,029,274 | ---- | M | MD5 = BBC957DC18C17CC027EB80B7C77F2AEA] ()
ntdos804.sys -> C:\WINDOWS\system32\ntdos804.sys -> [2003/07/17 06:39:38 | 000,029,146 | ---- | M | MD5 = 3CFFAEFFF23B0D208214A6D3061A5B1B] ()
ntio.sys -> C:\WINDOWS\system32\ntio.sys -> [2004/08/03 22:45:10 | 000,033,840 | ---- | M | MD5 = 4FE09F868CE65B334B42862C372C69CC] ()
ntio404.sys -> C:\WINDOWS\system32\ntio404.sys -> [2004/08/03 22:45:16 | 000,034,560 | ---- | M | MD5 = 6F73F50162DEF60C84B725C18CD9140F] ()
ntio411.sys -> C:\WINDOWS\system32\ntio411.sys -> [2004/08/03 22:45:12 | 000,035,648 | ---- | M | MD5 = 0FDD5E69C1FF3B58043D44F2CC743D45] ()
ntio412.sys -> C:\WINDOWS\system32\ntio412.sys -> [2004/08/03 22:45:16 | 000,035,424 | ---- | M | MD5 = 8842837C4D8311BF8E72BEE8CCC42217] ()
ntio804.sys -> C:\WINDOWS\system32\ntio804.sys -> [2004/08/03 22:45:14 | 000,034,560 | ---- | M | MD5 = 6B56CEB3C6F9D5CD7293DBD9FE23B311] ()
watchdog.sys -> C:\WINDOWS\system32\watchdog.sys -> [2004/08/03 23:07:34 | 000,017,664 | ---- | M | MD5 = C9BF2F12C4E6C12F8A85FBA4B6BC6208] (Microsoft Corporation)
win32k.sys -> C:\WINDOWS\system32\win32k.sys -> [2010/05/02 15:56:34 | 001,850,880 | ---- | M | MD5 = 7190A8EBD16D56C78864E49C9BB5FE7D] (Microsoft Corporation)
< %systemroot%\System32\drivers\*.dll >
adv01nt5.dll -> C:\WINDOWS\system32\drivers\adv01nt5.dll -> [2004/08/04 00:56:42 | 000,004,255 | ---- | M | MD5 = E843F15273FD0BB4D8D82D02786E0501] (Intel(R) Corporation)
adv02nt5.dll -> C:\WINDOWS\system32\drivers\adv02nt5.dll -> [2004/08/04 00:56:42 | 000,003,967 | ---- | M | MD5 = 8EBACA0542B6BA1F9E44D51571782743] (Intel(R) Corporation)
adv05nt5.dll -> C:\WINDOWS\system32\drivers\adv05nt5.dll -> [2004/08/04 00:56:42 | 000,003,615 | ---- | M | MD5 = ABD110E5843DBC92DB3AF6BD22D87B00] (Intel(R) Corporation)
adv07nt5.dll -> C:\WINDOWS\system32\drivers\adv07nt5.dll -> [2004/08/04 00:56:42 | 000,003,647 | ---- | M | MD5 = 0CB199356BC00F25C68C6A6FC195B5B7] (Intel(R) Corporation)
adv08nt5.dll -> C:\WINDOWS\system32\drivers\adv08nt5.dll -> [2004/08/04 00:56:42 | 000,003,135 | ---- | M | MD5 = 71248001E6C8100274569219F14CFAA1] (Intel(R) Corporation)
adv09nt5.dll -> C:\WINDOWS\system32\drivers\adv09nt5.dll -> [2004/08/04 00:56:42 | 000,003,711 | ---- | M | MD5 = 68B89CCB062E18A201DA0D7A719EA3E8] (Intel(R) Corporation)
adv11nt5.dll -> C:\WINDOWS\system32\drivers\adv11nt5.dll -> [2004/08/04 00:56:42 | 000,003,775 | ---- | M | MD5 = 5E6161F389B252450AD23D3CCEA10508] (Intel(R) Corporation)
atv01nt5.dll -> C:\WINDOWS\system32\drivers\atv01nt5.dll -> [2004/08/04 00:56:42 | 000,021,183 | ---- | M | MD5 = A7B5356B55E1322EE534DCA5BBD07D53] (Intel(R) Corporation)
atv02nt5.dll -> C:\WINDOWS\system32\drivers\atv02nt5.dll -> [2004/08/04 00:56:42 | 000,011,359 | ---- | M | MD5 = 26A953C339990BA628B5E798A58DE05C] (Intel(R) Corporation)
atv04nt5.dll -> C:\WINDOWS\system32\drivers\atv04nt5.dll -> [2004/08/04 00:56:42 | 000,025,471 | ---- | M | MD5 = 510DA475CA621CEFF2B956DAFF39FAED] (Intel(R) Corporation)
atv06nt5.dll -> C:\WINDOWS\system32\drivers\atv06nt5.dll -> [2004/08/04 00:56:42 | 000,014,143 | ---- | M | MD5 = 93AC52C2513A788B4723965DF73A788C] (Intel(R) Corporation)
atv10nt5.dll -> C:\WINDOWS\system32\drivers\atv10nt5.dll -> [2004/08/04 00:56:42 | 000,017,279 | ---- | M | MD5 = E0DA7019226AE1DA265BDD2B9162B9B1] (Intel(R) Corporation)
ch7xxnt5.dll -> C:\WINDOWS\system32\drivers\ch7xxnt5.dll -> [2004/08/04 00:56:42 | 000,015,423 | ---- | M | MD5 = 5043B1E84F0E5E0B5D4173AF56E18544] (Intel(R) Corporation)
siint5.dll -> C:\WINDOWS\system32\drivers\siint5.dll -> [2004/08/04 00:56:46 | 000,003,901 | ---- | M | MD5 = 91401E49115D8A09F4DDF8CE78D31298] (Intel(R) Corporation)
vchnt5.dll -> C:\WINDOWS\system32\drivers\vchnt5.dll -> [2004/08/04 00:56:48 | 000,011,325 | ---- | M | MD5 = 64CA66A32509379BF7932A084A7972AC] (Intel(R) Corporation)
< %systemroot%\System32\drivers\*.ini >
< %systemroot%\System32\drivers\*.exe >
< %SYSTEMDRIVE%\*.* >
AUTOEXEC.BAT -> C:\AUTOEXEC.BAT -> [2010/07/27 08:22:15 | 000,000,000 | ---- | M | MD5 = D41D8CD98F00B204E9800998ECF8427E] ()
Boot.bak -> C:\Boot.bak -> [2010/07/27 12:45:03 | 000,000,211 | ---- | M | MD5 = F61DF22835F390A718706EFAF02C55F9] ()
boot.ini -> C:\boot.ini -> [2011/04/15 14:59:12 | 000,000,327 | RHS- | M | MD5 = 012058B1753F8A6C221D1884098FBD82] ()
cmldr -> C:\cmldr -> [2004/08/03 23:00:00 | 000,260,272 | RHS- | M | MD5 = 94E5450C43E4CF78E1D3AD4816966909] ()
ComboFix.txt -> C:\ComboFix.txt -> [2011/04/15 15:14:56 | 000,014,701 | ---- | M | MD5 = 171EAC771B533D04B14BBB66A116B484] ()
CONFIG.SYS -> C:\CONFIG.SYS -> [2010/07/27 08:22:15 | 000,000,000 | ---- | M | MD5 = D41D8CD98F00B204E9800998ECF8427E] ()
IO.SYS -> C:\IO.SYS -> [2010/07/27 08:22:15 | 000,000,000 | RHS- | M | MD5 = D41D8CD98F00B204E9800998ECF8427E] ()
MSDOS.SYS -> C:\MSDOS.SYS -> [2010/07/27 08:22:15 | 000,000,000 | RHS- | M | MD5 = D41D8CD98F00B204E9800998ECF8427E] ()
NTDETECT.COM -> C:\NTDETECT.COM -> [2010/07/27 12:41:17 | 000,047,564 | RHS- | M | MD5 = B2DE3452DE03674C6CEC68B8C8CE7C78] ()
ntldr -> C:\ntldr -> [2010/07/27 12:41:17 | 000,250,032 | RHS- | M | MD5 = 9EC920F4179D45AF3A6638A083D39C85] ()
pagefile.sys -> C:\pagefile.sys -> [2011/04/18 15:48:21 | 2145,386,496 | -HS- | M | Unable to obtain MD5] ()
rkill.log -> C:\rkill.log -> [2011/04/13 16:44:19 | 000,000,785 | ---- | M | MD5 = 224ED4A689ED9B5D5B6E3974D644CABE] ()
< %PROGRAMFILES%\*. >
Analog Devices -> C:\Program Files\Analog Devices -> [2010/07/27 13:35:12 | 000,000,000 | ---D | M]
Apple Software Update -> C:\Program Files\Apple Software Update -> [2011/04/02 20:02:30 | 000,000,000 | ---D | M]
AutoHotkey -> C:\Program Files\AutoHotkey -> [2010/10/31 12:13:39 | 000,000,000 | ---D | M]
Axialis -> C:\Program Files\Axialis -> [2011/04/13 18:42:58 | 000,000,000 | ---D | M]
BabylonToolbar -> C:\Program Files\BabylonToolbar -> [2011/04/09 21:58:25 | 000,000,000 | ---D | M]
Bonjour -> C:\Program Files\Bonjour -> [2010/10/07 20:52:09 | 000,000,000 | ---D | M]
Broadcom -> C:\Program Files\Broadcom -> [2010/07/27 13:38:46 | 000,000,000 | ---D | M]
CCleaner -> C:\Program Files\CCleaner -> [2011/02/14 13:02:54 | 000,000,000 | ---D | M]
Combined Community Codec Pack -> C:\Program Files\Combined Community Codec Pack -> [2010/07/27 20:52:08 | 000,000,000 | ---D | M]
Common Files -> C:\Program Files\Common Files -> [2011/04/15 15:02:56 | 000,000,000 | ---D | M]
ComPlus Applications -> C:\Program Files\ComPlus Applications -> [2010/07/27 08:19:50 | 000,000,000 | ---D | M]
Conduit -> C:\Program Files\Conduit -> [2011/01/28 16:06:59 | 000,000,000 | ---D | M]
ConduitEngine -> C:\Program Files\ConduitEngine -> [2011/01/28 16:06:53 | 000,000,000 | ---D | M]
DIFX -> C:\Program Files\DIFX -> [2010/10/26 20:25:43 | 000,000,000 | ---D | M]
ESET -> C:\Program Files\ESET -> [2011/04/15 21:56:06 | 000,000,000 | ---D | M]
Foxit Software -> C:\Program Files\Foxit Software -> [2010/07/27 14:24:08 | 000,000,000 | ---D | M]
InstallShield Installation Information -> C:\Program Files\InstallShield Installation Information -> [2010/07/27 13:39:20 | 000,000,000 | -H-D | M]
Intel -> C:\Program Files\Intel -> [2010/07/27 13:36:44 | 000,000,000 | ---D | M]
Internet Explorer -> C:\Program Files\Internet Explorer -> [2010/07/27 18:12:57 | 000,000,000 | ---D | M]
iPod -> C:\Program Files\iPod -> [2011/04/02 20:03:58 | 000,000,000 | ---D | M]
iTunes -> C:\Program Files\iTunes -> [2011/04/02 20:04:53 | 000,000,000 | ---D | M]
Jasc Software Inc -> C:\Program Files\Jasc Software Inc -> [2010/08/19 20:57:59 | 000,000,000 | ---D | M]
Java -> C:\Program Files\Java -> [2010/11/07 13:09:47 | 000,000,000 | ---D | M]
Kaspersky Lab -> C:\Program Files\Kaspersky Lab -> [2010/10/30 13:02:00 | 000,000,000 | ---D | M]
kis2011_au -> C:\Program Files\kis2011_au -> [2010/10/30 13:00:06 | 000,000,000 | ---D | M]
Malwarebytes' Anti-Malware -> C:\Program Files\Malwarebytes' Anti-Malware -> [2011/04/13 16:45:20 | 000,000,000 | ---D | M]
Messenger -> C:\Program Files\Messenger -> [2010/07/27 18:18:49 | 000,000,000 | ---D | M]
Microsoft -> C:\Program Files\Microsoft -> [2011/04/07 19:20:29 | 000,000,000 | ---D | M]
microsoft frontpage -> C:\Program Files\microsoft frontpage -> [2010/07/27 08:31:38 | 000,000,000 | ---D | M]
Microsoft Office -> C:\Program Files\Microsoft Office -> [2010/07/27 13:53:12 | 000,000,000 | ---D | M]
Microsoft Visual Studio -> C:\Program Files\Microsoft Visual Studio -> [2010/07/27 13:53:01 | 000,000,000 | ---D | M]
Microsoft Works -> C:\Program Files\Microsoft Works -> [2010/07/27 13:53:26 | 000,000,000 | ---D | M]
Microsoft.NET -> C:\Program Files\Microsoft.NET -> [2011/01/11 15:31:12 | 000,000,000 | ---D | M]
Movie Maker -> C:\Program Files\Movie Maker -> [2010/07/27 18:16:28 | 000,000,000 | ---D | M]
Mozilla Firefox -> C:\Program Files\Mozilla Firefox -> [2011/04/14 18:33:30 | 000,000,000 | ---D | M]
MSBuild -> C:\Program Files\MSBuild -> [2010/07/27 13:53:19 | 000,000,000 | ---D | M]
MSN -> C:\Program Files\MSN -> [2010/07/27 08:19:21 | 000,000,000 | ---D | M]
MSN Gaming Zone -> C:\Program Files\MSN Gaming Zone -> [2010/07/27 08:19:11 | 000,000,000 | ---D | M]
MSXML 6.0 -> C:\Program Files\MSXML 6.0 -> [2010/08/07 22:15:15 | 000,000,000 | ---D | M]
NetMeeting -> C:\Program Files\NetMeeting -> [2010/07/27 12:42:43 | 000,000,000 | ---D | M]
NJStar Chinese WP -> C:\Program Files\NJStar Chinese WP -> [2011/03/25 20:57:02 | 000,000,000 | ---D | M]
Nokia -> C:\Program Files\Nokia -> [2010/10/26 20:25:49 | 000,000,000 | ---D | M]
Online Services -> C:\Program Files\Online Services -> [2010/07/27 08:19:22 | 000,000,000 | ---D | M]
Outlook Express -> C:\Program Files\Outlook Express -> [2010/07/27 18:14:22 | 000,000,000 | ---D | M]
Pando Networks -> C:\Program Files\Pando Networks -> [2010/09/20 20:53:46 | 000,000,000 | ---D | M]
PC Connectivity Solution -> C:\Program Files\PC Connectivity Solution -> [2010/10/26 20:25:38 | 000,000,000 | ---D | M]
QuickTime -> C:\Program Files\QuickTime -> [2011/04/02 20:03:23 | 000,000,000 | ---D | M]
Real Alternative -> C:\Program Files\Real Alternative -> [2010/09/25 22:10:39 | 000,000,000 | ---D | M]
Reference Assemblies -> C:\Program Files\Reference Assemblies -> [2010/08/07 22:18:10 | 000,000,000 | ---D | M]
Skype -> C:\Program Files\Skype -> [2011/03/18 20:40:27 | 000,000,000 | R--D | M]
TI Education -> C:\Program Files\TI Education -> [2011/03/31 22:01:40 | 000,000,000 | ---D | M]
Uninstall Information -> C:\Program Files\Uninstall Information -> [2010/07/27 08:36:56 | 000,000,000 | -H-D | M]
uTorrent -> C:\Program Files\uTorrent -> [2011/01/29 10:04:54 | 000,000,000 | ---D | M]
uTorrentBar -> C:\Program Files\uTorrentBar -> [2011/01/28 16:07:00 | 000,000,000 | ---D | M]
Windows Live -> C:\Program Files\Windows Live -> [2011/04/07 19:20:22 | 000,000,000 | ---D | M]
Windows Live SkyDrive -> C:\Program Files\Windows Live SkyDrive -> [2010/07/27 20:55:37 | 000,000,000 | ---D | M]
Windows Media Connect 2 -> C:\Program Files\Windows Media Connect 2 -> [2010/07/27 20:50:30 | 000,000,000 | ---D | M]
Windows Media Player -> C:\Program Files\Windows Media Player -> [2010/07/27 20:50:29 | 000,000,000 | ---D | M]
Windows NT -> C:\Program Files\Windows NT -> [2010/07/27 12:42:40 | 000,000,000 | ---D | M]
WindowsUpdate -> C:\Program Files\WindowsUpdate -> [2010/07/27 08:19:22 | 000,000,000 | -H-D | M]
WinRAR -> C:\Program Files\WinRAR -> [2010/07/27 21:46:27 | 000,000,000 | ---D | M]
xerox -> C:\Program Files\xerox -> [2010/07/27 08:31:38 | 000,000,000 | ---D | M]
Yuna Software -> C:\Program Files\Yuna Software -> [2011/04/09 21:57:59 | 000,000,000 | ---D | M]
< %appdata%\*.* >
desktop.ini -> C:\Documents and Settings\Owner\Application Data\desktop.ini -> [2010/07/27 18:11:13 | 000,000,062 | -HS- | M | MD5 = 88CF0FF92A4A9FA7BD9B7513B2E9E22B] ()
< End of report >
[/code]

Re: MS Removal Tool changed proxy setting20th April 2011, 4:57 am

Any more issues?

We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

Many of the things to note for us would be:

Slow computer
Error messages
Fake antivirus alerts or the icon in the system tray
svchost.exe running at 100%
System crashes or blue screen of death

Re: MS Removal Tool changed proxy setting20th April 2011, 7:09 am

ummm...
this is probably the main issue with the internet
but, my windows messenger isn't working fully, like i sign in and appear online to people but they still see me offline, this doesn't happen when i use messenger on ipod though.
I don't have any fake anti virus alerts but my processes seem to use up a lot of mem usage.
the wuauclt.exe uses roughly 46,700K and this seems to be quite a bit compared to when i first used this computer after a reformat.
no error messages nor blur screen
ummm... how do i know if my svchost.exe is running at 100%?

but that should be about all my problems that i actually notice

edit: just noticed this but when i turn on my computer, i get this how to load windows screen for a second or 2
couldn't read it but i saw like 3 options, something about safe boot, windows xp and not sure about the other one

Re: MS Removal Tool changed proxy setting21st April 2011, 2:36 am

Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
Click on View > Select Colunms.
In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
Go File>Save As, and save the report as Procexp.txt.
Attach the file to your next reply.

Re: MS Removal Tool changed proxy setting21st April 2011, 8:03 am

okay that screen when I first turn on my computer says some stuff about windows recovery, doesn't seem too important

Procexp.txt

Spoiler :

Process PID CPU Private Bytes Working Set Description Company Name Command Line
System Idle Process 0 0 K 16 K
System 4 1.52 0 K 240 K
Interrupts n/a < 0.01 0 K 0 K Hardware Interrupts and DPCs
smss.exe 872 168 K 400 K Windows NT Session Manager Microsoft Corporation \SystemRoot\System32\smss.exe
csrss.exe 920 1,864 K 4,136 K Client Server Runtime Process Microsoft Corporation C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe 944 6,648 K 4,120 K Windows NT Logon Application Microsoft Corporation winlogon.exe
services.exe 992 2,156 K 4,336 K Services and Controller app Microsoft Corporation C:\WINDOWS\system32\services.exe
svchost.exe 1168 3,300 K 5,160 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k DcomLaunch
wmiprvse.exe 3880 3,764 K 7,064 K WMI Microsoft Corporation C:\WINDOWS\system32\wbem\wmiprvse.exe
wmiprvse.exe 3284 2,944 K 4,840 K WMI Microsoft Corporation C:\WINDOWS\system32\wbem\wmiprvse.exe
svchost.exe 1272 1,868 K 4,356 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k rpcss
svchost.exe 1400 93.94 63,700 K 77,616 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k netsvcs
wuauclt.exe 2208 10,160 K 41,620 K Windows Update Microsoft Corporation "C:\WINDOWS\system32\wuauclt.exe" /RunStoreAsComServer Local\[578]SUSDS95c27eade3c6e340b5780379f61d7339
wscntfy.exe 4064 1,048 K 3,008 K Windows Security Center Notification App Microsoft Corporation C:\WINDOWS\system32\wscntfy.exe
wuauclt.exe 4036 2,344 K 4,224 K Windows Update Microsoft Corporation "C:\WINDOWS\system32\wuauclt.exe"
svchost.exe 1444 2,456 K 3,464 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe 1624 1,484 K 3,644 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k NetworkService
svchost.exe 1764 1,564 K 3,904 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k LocalService
spoolsv.exe 1916 3,636 K 5,364 K Spooler SubSystem App Microsoft Corporation C:\WINDOWS\system32\spoolsv.exe
svchost.exe 788 1,344 K 3,460 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k LocalService
svchost.exe 1344 5,660 K 9,620 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k Akamai
AppleMobileDeviceService.exe 1424 4,776 K 7,136 K MobileDeviceService Apple Inc. "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
mDNSResponder.exe 1720 1,276 K 3,744 K Bonjour Service Apple Inc. "C:\Program Files\Bonjour\mDNSResponder.exe"
jqs.exe 124 2,084 K 1,724 K Java(TM) Quick Starter Service Sun Microsystems, Inc. "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"
svchost.exe 456 2,568 K 4,196 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k imgsvc
iPodService.exe 3168 2,560 K 4,120 K iPodService Module (32-bit) Apple Inc. "C:\Program Files\iPod\bin\iPodService.exe"
alg.exe 3560 1,232 K 3,564 K Application Layer Gateway Service Microsoft Corporation C:\WINDOWS\System32\alg.exe
lsass.exe 1004 3,960 K 6,252 K LSA Shell (Export Version) Microsoft Corporation C:\WINDOWS\system32\lsass.exe
explorer.exe 280 17,808 K 27,216 K Windows Explorer Microsoft Corporation C:\WINDOWS\Explorer.EXE
hkcmd.exe 664 1,980 K 4,436 K hkcmd Module Intel Corporation "C:\WINDOWS\system32\hkcmd.exe"
GrooveMonitor.exe 676 2,072 K 6,428 K GrooveMonitor Utility Microsoft Corporation "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
jusched.exe 688 848 K 2,564 K Java(TM) Update Scheduler Sun Microsystems, Inc. "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
iTunesHelper.exe 760 10,636 K 15,392 K iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
NokiaMServer.exe 824 9,144 K 16,676 K Nokia M Platform Nokia "C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe" /watchfiles startup
ctfmon.exe 864 1,472 K 4,448 K CTF Loader Microsoft Corporation "C:\WINDOWS\system32\ctfmon.exe"
rundll32.exe 888 2,768 K 4,012 K Run a DLL as an App Microsoft Corporation "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\witc10.dll",Startup
firefox.exe 2840 4.55 136,104 K 150,800 K Firefox Mozilla Corporation "C:\Program Files\Mozilla Firefox\firefox.exe"
procexp.exe 600 12,452 K 17,780 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com "C:\Documents and Settings\Owner\My Documents\Downloads\procexp.exe"
dwm.exe 288 3,800 K 6,464 K "C:\Documents and Settings\Owner\Application Data\dwm.exe"
conhost.exe 392 2,624 K 4,440 K "C:\Documents and Settings\Owner\Application Data\Microsoft\conhost.exe"

Re: MS Removal Tool changed proxy setting22nd April 2011, 4:03 am

Please download SpiderKill by DragonMaster Jay and save it to your Desktop.

Right-click on SpiderKill.zip and click Extract All. Follow the prompts and read carefully, to save it to your Desktop.
Double-click on the SpiderKill folder, and then double-click on SpiderKill.bat and follow all the prompts in the program.
Within a minute, it will save its log titled SpiderKill.txt. Please post that in your next reply. You may have to use two or three posts to be able to fit the information in.

Re: MS Removal Tool changed proxy setting23rd April 2011, 6:01 am

oh umm... actually...
my brother came back from Sydney earlier than i thought and hes helping me with reformatting the computer

sorry for the trouble i caused you and thanks

MS Removal Tool changed proxy setting

descriptionRe: MS Removal Tool changed proxy setting17th April 2011, 12:38 pm

descriptionRe: MS Removal Tool changed proxy setting18th April 2011, 2:50 am

descriptionRe: MS Removal Tool changed proxy setting18th April 2011, 6:23 am

descriptionRe: MS Removal Tool changed proxy setting18th April 2011, 6:23 am

descriptionRe: MS Removal Tool changed proxy setting20th April 2011, 4:57 am

descriptionRe: MS Removal Tool changed proxy setting20th April 2011, 7:09 am

descriptionRe: MS Removal Tool changed proxy setting21st April 2011, 2:36 am

descriptionRe: MS Removal Tool changed proxy setting21st April 2011, 8:03 am

descriptionRe: MS Removal Tool changed proxy setting22nd April 2011, 4:03 am

descriptionRe: MS Removal Tool changed proxy setting23rd April 2011, 6:01 am

descriptionRe: MS Removal Tool changed proxy setting23rd April 2011, 9:00 am

descriptionRe: MS Removal Tool changed proxy setting

Re: MS Removal Tool changed proxy setting17th April 2011, 12:38 pm

Re: MS Removal Tool changed proxy setting18th April 2011, 2:50 am

Re: MS Removal Tool changed proxy setting18th April 2011, 6:23 am

Re: MS Removal Tool changed proxy setting18th April 2011, 6:23 am

Re: MS Removal Tool changed proxy setting20th April 2011, 4:57 am

Re: MS Removal Tool changed proxy setting20th April 2011, 7:09 am

Re: MS Removal Tool changed proxy setting21st April 2011, 2:36 am

Re: MS Removal Tool changed proxy setting21st April 2011, 8:03 am

Re: MS Removal Tool changed proxy setting22nd April 2011, 4:03 am

Re: MS Removal Tool changed proxy setting23rd April 2011, 6:01 am

Re: MS Removal Tool changed proxy setting23rd April 2011, 9:00 am

Re: MS Removal Tool changed proxy setting