GeekPolice
Would you like to react to this message? Create an account in a few clicks or log in to continue.

GeekPoliceLog in

 


:: Malwarebytes found Trojan.BHO ::

2 posters

description:: Malwarebytes found Trojan.BHO :: Empty:: Malwarebytes found Trojan.BHO ::3rd May 2011, 4:59 pm

more_horiz
Hello GeekPolice!

My computer has been slow and today started to randomly go to other web pages when doing a google search.
I ran Malwarebytes and the scan results said:
Vendor: Trojan.BHO
Category: Registry Key
Items: HKEY_CLASSES_ROOT\.fsharproj

Please advise. Thanks very much!

------------

OTL LOG

OTL logfile created on: 5/3/2011 9:29:26 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\FlavorInnovator\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 58.59 Gb Total Space | 21.76 Gb Free Space | 37.14% Space Free | Partition Type: NTFS
Drive D: | 59.51 Gb Total Space | 13.90 Gb Free Space | 23.35% Space Free | Partition Type: NTFS
Drive E: | 347.66 Gb Total Space | 129.96 Gb Free Space | 37.38% Space Free | Partition Type: NTFS

Computer Name: FLAVORIN-4BVAXJ | User Name: FlavorInnovator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/03 09:28:04 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\FlavorInnovator\My Documents\Downloads\OTL.com
PRC - [2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) -- C:\WINDOWS\system32\perfdisk32.exe
PRC - [2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) -- C:\WINDOWS\system32\icaapi32.exe
PRC - [2011/03/23 12:56:35 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/01/07 17:07:10 | 001,394,000 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2009/11/19 11:26:54 | 000,455,944 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
PRC - [2008/10/30 12:14:00 | 000,159,528 | ---- | M] (Wacom Technology, Corp.) -- C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
PRC - [2008/10/30 12:13:28 | 002,749,224 | ---- | M] (Wacom Technology, Corp.) -- C:\WINDOWS\system32\Wacom_Tablet.exe
PRC - [2007/01/04 14:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/04/07 11:37:14 | 000,135,168 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvraidservice.exe
PRC - [2004/12/16 10:26:58 | 000,462,848 | ---- | M] (Dell) -- C:\WINDOWS\system32\dlbxcoms.exe
PRC - [2004/09/22 02:50:28 | 003,145,728 | ---- | M] (Extensis Inc.) -- C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe
PRC - [2004/08/04 01:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/05/03 09:28:04 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\FlavorInnovator\My Documents\Downloads\OTL.com
MOD - [2004/08/04 01:57:02 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) [Auto | Running] -- C:\WINDOWS\system32\perfdisk32.exe -- (NVSvc32)
SRV - [2009/11/19 11:26:54 | 000,455,944 | ---- | M] () [Auto | Running] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2009/02/05 16:09:51 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/10/30 12:13:28 | 002,749,224 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\WINDOWS\system32\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV - [2007/01/04 14:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2004/12/16 10:26:58 | 000,462,848 | ---- | M] (Dell) [On_Demand | Running] -- C:\WINDOWS\System32\dlbxcoms.exe -- (dlbx_device)


========== Driver Services (SafeList) ==========

DRV - [2010/01/07 17:07:14 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2009/02/24 19:42:14 | 000,116,736 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mcdbus.sys -- (mcdbus)
DRV - [2008/12/09 02:06:00 | 000,296,448 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2008/10/06 12:53:24 | 000,015,656 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2008/07/11 12:16:50 | 000,013,352 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2007/04/09 09:56:22 | 000,021,248 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2007/04/09 09:55:08 | 000,022,912 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2007/04/09 09:53:24 | 000,012,672 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2007/02/16 12:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2007/02/15 17:11:28 | 000,011,440 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WacomVKHid.sys -- (WacomVKHid)
DRV - [2006/11/02 01:50:52 | 000,128,104 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WimFltr.sys -- (WimFltr)
DRV - [2006/04/24 02:52:28 | 000,100,736 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2004/10/27 16:21:30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/08/12 19:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2001/08/15 15:21:28 | 000,023,200 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\ppsio2.sys -- (ppsio2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 6E ED 5C 04 C4 0A 2F 4A 9E 1C 5C 9A 0B 05 FD F3 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.freelanceswitch.com"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {582195F5-92E7-40a0-A127-DB71295901D7}:0.6.4.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {7067cf8d-5880-46f7-8dec-c15bacac8b51}:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/06 22:41:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 12:56:37 | 000,000,000 | ---D | M]

[2009/02/05 13:13:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Extensions
[2011/05/03 08:35:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions
[2011/03/25 08:54:27 | 000,000,000 | ---D | M] (Gmail Manager) -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{582195F5-92E7-40a0-A127-DB71295901D7}
[2011/05/03 08:58:22 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{7067cf8d-5880-46f7-8dec-c15bacac8b51}
[2011/01/31 15:54:02 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/01/28 11:32:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\notebook@google.com
[2009/02/05 15:25:09 | 000,000,000 | ---D | M] (Oberon Game Host) -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\OberonGameHost@OberonGames.com
[2011/04/30 16:24:13 | 000,001,894 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\searchplugins\isohunt---bittorrent.xml
[2008/04/17 10:33:56 | 000,001,387 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\searchplugins\torrentspy.xml
[2011/05/02 10:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/24 09:08:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/15 10:02:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/15 12:40:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/09 10:03:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/02/23 15:41:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2010/04/24 09:08:25 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2008/06/17 23:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2011/02/02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/04/16 10:07:12 | 000,180,293 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2010/01/26 01:00:41 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {045CED6E-0AC4-4A2F-9E1C-5C9A0B05FDF3} - C:\WINDOWS\system32\ati2dvaa32.dll (Dmitry Streblechenko)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DLBXCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBXtime.DLL ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe (NVIDIA Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Shortcut to Suitcase.exe.lnk = C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe (Extensis Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\FlavorInnovator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\FlavorInnovator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/05 12:30:38 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{d82e26fa-38ee-11de-b866-0018f36b64a8}\Shell - "" = AutoRun
O33 - MountPoints2\{d82e26fa-38ee-11de-b866-0018f36b64a8}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d82e26fa-38ee-11de-b866-0018f36b64a8}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{da9cb8cc-585c-11df-b9f8-0018f36b64a8}\Shell - "" = AutoRun
O33 - MountPoints2\{da9cb8cc-585c-11df-b9f8-0018f36b64a8}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{da9cb8cc-585c-11df-b9f8-0018f36b64a8}\Shell\AutoRun\command - "" = H:\Launcher.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Documents and Settings^FlavorInnovator^Start Menu^Programs^Startup^MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe - (MagicISO, Inc.)
MsConfig - StartUpReg: GBMPro8Agent - hkey= - key= - C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe (Genie-soft)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: OneTouch Monitor - hkey= - key= - C:\Program Files\Visioneer OneTouch\OneTouchMon.exe (Visioneer Inc)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3636B214-5242-9779-5EE8-571EA386560B} - Browser Customizations
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.3IV2 - C:\WINDOWS\System32\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/03 08:59:56 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\FlavorInnovator\Recent
[2011/05/02 19:16:54 | 000,692,736 | ---- | C] (wpcubed GmbH) -- C:\WINDOWS\System32\icaapi32.exe
[2011/05/02 19:16:53 | 000,155,648 | ---- | C] (AIDEX Team) -- C:\WINDOWS\System32\mfc4232.dll
[2011/05/02 19:16:47 | 000,692,736 | ---- | C] (wpcubed GmbH) -- C:\WINDOWS\System32\perfdisk32.exe
[2011/05/02 19:16:42 | 000,318,464 | ---- | C] (Dmitry Streblechenko) -- C:\WINDOWS\System32\ati2dvaa32.dll
[2011/04/16 22:04:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FlavorInnovator\Application Data\Nikon
[2011/04/16 22:03:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nikon
[2011/04/16 22:03:02 | 000,000,000 | ---D | C] -- C:\Program Files\Nikon
[2011/04/16 22:02:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2011/04/16 22:02:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2011/04/16 22:02:24 | 000,000,000 | ---D | C] -- C:\vc_temp
[2011/04/16 22:02:23 | 000,013,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2011/04/12 14:39:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CamStudio
[2011/04/12 14:39:29 | 000,000,000 | ---D | C] -- C:\Program Files\CamStudio
[1 C:\Documents and Settings\FlavorInnovator\*.tmp files -> C:\Documents and Settings\FlavorInnovator\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/03 08:32:29 | 000,050,257 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/05/03 08:32:24 | 001,600,720 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/05/03 08:32:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/02 20:04:20 | 000,036,979 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Desktop\eruope.gif
[2011/05/02 19:16:54 | 000,000,090 | ---- | M] () -- C:\WINDOWS\System32\640608007
[2011/05/02 19:16:53 | 000,155,648 | ---- | M] (AIDEX Team) -- C:\WINDOWS\System32\mfc4232.dll
[2011/05/02 19:16:42 | 000,318,464 | ---- | M] (Dmitry Streblechenko) -- C:\WINDOWS\System32\ati2dvaa32.dll
[2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) -- C:\WINDOWS\System32\perfdisk32.exe
[2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) -- C:\WINDOWS\System32\icaapi32.exe
[2011/05/02 14:04:18 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2011/05/02 09:54:53 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/29 12:15:45 | 000,138,891 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Desktop\print_honeydipped_04-copy.jpg
[2011/04/29 11:13:31 | 000,085,848 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Desktop\sd.gif
[2011/04/29 10:16:39 | 000,045,709 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Desktop\blog_japan_irc_02.gif
[2011/04/28 15:00:37 | 002,383,989 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Desktop\fame_misc.psd
[2011/04/22 13:36:35 | 000,000,906 | ---- | M] () -- C:\WINDOWS\dellstat.ini
[2011/04/17 14:56:31 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2011/04/17 14:56:31 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\PrintingModule
[2011/04/17 14:56:31 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Plugins
[2011/04/15 00:39:10 | 000,001,537 | ---- | M] () -- C:\WINDOWS\goldwave.ini
[2011/04/14 22:59:20 | 000,143,360 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/13 13:14:28 | 016,097,382 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Desktop\honeydipped_samples.psd
[1 C:\Documents and Settings\FlavorInnovator\*.tmp files -> C:\Documents and Settings\FlavorInnovator\*.tmp -> ]

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\WINDOWS\System32\melenemu
[2011/05/02 20:04:20 | 000,036,979 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Desktop\eruope.gif
[2011/05/02 19:16:47 | 000,000,090 | ---- | C] () -- C:\WINDOWS\System32\640608007
[2011/04/29 12:15:45 | 000,138,891 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Desktop\print_honeydipped_04-copy.jpg
[2011/04/29 11:13:31 | 000,085,848 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Desktop\sd.gif
[2011/04/29 10:16:39 | 000,045,709 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Desktop\blog_japan_irc_02.gif
[2011/04/28 15:00:33 | 002,383,989 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Desktop\fame_misc.psd
[2011/04/17 14:56:31 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Plugins
[2011/04/16 22:02:50 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2011/04/16 22:02:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Application Data\PrintingModule
[2010/10/28 11:55:03 | 000,056,884 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/08/14 10:32:44 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2010/01/05 10:43:53 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/01/05 10:43:53 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2009/11/10 11:17:21 | 000,000,516 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Application Data\Poladroid prefs.plist
[2009/07/25 13:55:57 | 000,000,004 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Application Data\EBA145
[2009/07/25 13:55:56 | 000,870,128 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Application Data\mcs.rma
[2009/04/24 18:31:41 | 000,000,906 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2009/04/24 18:30:43 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\dlbxins.dll
[2009/04/24 18:30:43 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\dlbxinsr.dll
[2009/04/24 18:30:43 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\dlbxcu.dll
[2009/04/24 18:30:43 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbxvs.dll
[2009/04/24 18:30:43 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\dlbxcur.dll
[2009/04/24 18:30:42 | 000,397,312 | ---- | C] () -- C:\WINDOWS\System32\dlbxutil.dll
[2009/04/24 18:30:42 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\dlbxinsb.dll
[2009/04/24 18:30:42 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\dlbxjswr.dll
[2009/04/24 18:30:42 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\dlbxcub.dll
[2009/03/26 00:32:38 | 000,006,312 | ---- | C] () -- C:\WINDOWS\gwpreset.ini
[2009/03/26 00:32:38 | 000,001,537 | ---- | C] () -- C:\WINDOWS\goldwave.ini
[2009/02/11 16:59:35 | 000,143,360 | ---- | C] () -- C:\Documents and Settings\FlavorInnovator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/07 14:02:56 | 000,023,200 | ---- | C] () -- C:\WINDOWS\System32\drivers\ppsio2.sys
[2009/02/07 14:01:30 | 000,000,376 | ---- | C] () -- C:\WINDOWS\mozregistry.dat
[2009/02/05 17:38:20 | 000,000,335 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2009/02/05 16:14:47 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
[2009/02/05 13:13:07 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/02/05 12:51:52 | 000,000,709 | R--- | C] () -- C:\WINDOWS\System32\AsusSetup.ini
[2009/02/05 12:51:52 | 000,000,263 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini
[2009/02/05 12:46:16 | 000,018,797 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009/02/05 12:46:12 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/02/05 12:46:06 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/02/05 12:32:08 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/02/05 12:28:30 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/02/05 04:24:06 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/02/05 04:23:15 | 001,600,720 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/02/18 23:33:34 | 000,446,352 | ---- | C] () -- C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2007/06/19 08:59:36 | 000,070,400 | ---- | C] () -- C:\WINDOWS\System32\PhysXLoader.dll
[2007/04/20 07:57:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2006/08/07 18:25:56 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/08/07 18:25:54 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/07 18:25:54 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/08/07 18:25:52 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/08/07 18:25:50 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/08/07 18:25:50 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/08/07 18:25:50 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/08/07 18:25:50 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/08/07 18:25:46 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/08/07 18:25:46 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/08/07 18:25:44 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2005/10/14 03:56:50 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/10/14 03:56:50 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2005/10/14 03:56:50 | 000,778,240 | ---- | C] () -- C:\WINDOWS\System32\DivXsm.exe
[2005/10/14 03:56:50 | 000,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005/10/14 03:56:50 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005/10/14 03:56:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2005/10/14 03:56:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2005/10/14 03:56:50 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2005/10/14 03:56:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2004/08/02 15:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2001/08/23 05:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 05:00:00 | 000,308,552 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 05:00:00 | 000,038,808 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 05:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2001/08/23 05:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 05:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2001/08/23 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== Custom Scans ==========


< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/02/05 12:30:27 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/12/16 10:15:10 | 000,073,728 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\dlbxPP5C.DLL
[2006/10/26 20:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/02/05 12:40:21 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/05 12:43:48 | 000,000,177 | -HS- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/02/05 12:34:25 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2008/10/13 12:22:42 | 000,069,607 | ---- | M] (Adobe Systems, Incorporated) -- C:\Documents and Settings\FlavorInnovator\Desktop\canon1200.exe
[2008/10/13 12:23:15 | 000,069,619 | ---- | M] (Adobe Systems, Incorporated) -- C:\Documents and Settings\FlavorInnovator\Desktop\canon1800.exe
[2009/06/02 09:42:33 | 000,340,122 | ---- | M] (Adobe Systems, Incorporated) -- C:\Documents and Settings\FlavorInnovator\Desktop\color.exe
[2009/06/22 11:12:49 | 000,340,128 | ---- | M] (Adobe Systems, Incorporated) -- C:\Documents and Settings\FlavorInnovator\Desktop\color2.exe
[2009/10/07 19:44:53 | 000,340,217 | ---- | M] (Adobe Systems, Incorporated) -- C:\Documents and Settings\FlavorInnovator\Desktop\color3.exe
[2010/09/07 17:18:51 | 000,339,959 | ---- | M] (Adobe Systems, Incorporated) -- C:\Documents and Settings\FlavorInnovator\Desktop\raw_to_jpg.exe
[2010/09/07 21:15:46 | 000,339,955 | ---- | M] (Adobe Systems, Incorporated) -- C:\Documents and Settings\FlavorInnovator\Desktop\small_blog.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2011/01/12 13:48:14 | 000,072,080 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\g2mdlhlpx.exe
[1 C:\Documents and Settings\FlavorInnovator\*.tmp files -> C:\Documents and Settings\FlavorInnovator\*.tmp -> ]

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\*.exe >
[2011/03/23 12:56:35 | 000,107,480 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\crashreporter.exe
[2011/03/23 12:56:35 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
[2011/03/23 12:56:36 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
[2011/03/23 12:56:36 | 000,245,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\updater.exe

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/02/05 12:43:48 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\FlavorInnovator\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/02/05 04:22:20 | 000,090,112 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/02/05 04:22:20 | 000,630,784 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/02/05 04:22:20 | 000,438,272 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2001/08/23 05:00:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2001/08/23 05:00:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2001/08/23 05:00:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2001/08/23 05:00:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2004/08/03 23:46:56 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2001/08/23 05:00:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2001/08/23 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2001/08/23 05:00:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2001/08/23 05:00:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2001/08/23 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/03 23:45:10 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2004/08/03 23:45:16 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2004/08/03 23:45:12 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2004/08/03 23:45:16 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2004/08/03 23:45:14 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2004/08/04 00:07:34 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2008/09/15 04:57:41 | 001,846,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys

< %systemroot%\system32\drivers\*.dll >
[2004/08/04 01:56:42 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv01nt5.dll
[2004/08/04 01:56:42 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv02nt5.dll
[2004/08/04 01:56:42 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv05nt5.dll
[2004/08/04 01:56:42 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv07nt5.dll
[2004/08/04 01:56:42 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv08nt5.dll
[2004/08/04 01:56:42 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv09nt5.dll
[2004/08/04 01:56:42 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv11nt5.dll
[2004/08/04 01:56:42 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv01nt5.dll
[2004/08/04 01:56:42 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv02nt5.dll
[2004/08/04 01:56:42 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv04nt5.dll
[2004/08/04 01:56:42 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv06nt5.dll
[2004/08/04 01:56:42 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv10nt5.dll
[2004/08/04 01:56:42 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
[2004/08/04 01:56:46 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\siint5.dll
[2004/08/04 01:56:48 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\vchnt5.dll

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2004/12/16 10:15:10 | 000,073,728 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\dlbxPP5C.DLL
[2006/10/26 20:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %SYSTEMDRIVE%\*.* >
[2011/01/30 12:48:43 | 000,001,024 | ---- | M] () -- C:\.rnd
[2011/04/12 14:56:15 | 000,000,000 | ---- | M] () -- C:\asoutput.log
[2009/02/05 12:30:38 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/02/05 12:30:38 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/01/28 10:33:02 | 000,000,208 | ---- | M] () -- C:\dlbx.log
[2011/03/14 22:29:24 | 000,007,150 | ---- | M] () -- C:\dlbxscan.log
[2009/02/05 12:30:38 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/02/17 20:43:33 | 000,000,465 | -H-- | M] () -- C:\IPH.PH
[2010/09/08 16:57:14 | 000,001,015 | R--- | M] () -- C:\logFile.xsl
[2009/02/05 12:30:38 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/05/03 08:32:20 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2009/04/23 20:57:40 | 000,004,992 | ---- | M] () -- C:\wialog.txt

< %PROGRAMFILES%\*. >
[2010/09/08 16:56:53 | 000,000,000 | ---D | M] -- C:\Program Files\3ivx
[2009/02/05 18:11:43 | 000,000,000 | ---D | M] -- C:\Program Files\7-Zip
[2010/01/04 16:17:39 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2009/06/06 11:07:53 | 000,000,000 | ---D | M] -- C:\Program Files\AGEIA Technologies
[2009/02/17 20:43:33 | 000,000,000 | ---D | M] -- C:\Program Files\AIM6
[2010/01/27 12:39:07 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2009/02/05 16:54:17 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010/01/28 11:32:45 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2010/10/30 10:51:45 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2011/04/12 15:13:03 | 000,000,000 | ---D | M] -- C:\Program Files\CamStudio
[2011/05/03 09:00:40 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2011/01/12 13:48:25 | 000,000,000 | ---D | M] -- C:\Program Files\Citrix
[2009/02/05 13:14:58 | 000,000,000 | ---D | M] -- C:\Program Files\Codec Pack - All In 1
[2011/04/17 14:56:35 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2010/01/27 12:40:11 | 000,000,000 | ---D | M] -- C:\Program Files\COMODO
[2009/02/05 12:28:29 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/05/06 14:58:16 | 000,000,000 | ---D | M] -- C:\Program Files\Coupons
[2010/09/20 23:42:54 | 000,000,000 | ---D | M] -- C:\Program Files\Dell Photo AIO Printer 962
[2009/04/08 09:09:39 | 000,000,000 | ---D | M] -- C:\Program Files\directx
[2011/04/22 13:36:35 | 000,000,000 | ---D | M] -- C:\Program Files\DL_cats
[2009/02/05 16:44:51 | 000,000,000 | ---D | M] -- C:\Program Files\Extensis
[2010/09/08 16:56:46 | 000,000,000 | ---D | M] -- C:\Program Files\Flip Video
[2010/08/14 10:32:46 | 000,000,000 | ---D | M] -- C:\Program Files\Free Audio Pack
[2009/02/05 18:11:39 | 000,000,000 | ---D | M] -- C:\Program Files\Free Offers from Freeze.com
[2009/12/12 11:05:48 | 000,000,000 | ---D | M] -- C:\Program Files\Genie-Soft
[2009/03/09 15:58:56 | 000,000,000 | ---D | M] -- C:\Program Files\GlobalSCAPE
[2009/03/30 12:05:07 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2009/02/07 14:01:20 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2009/02/07 14:01:20 | 000,000,000 | ---D | M] -- C:\Program Files\hp deskjet 960c series
[2009/07/25 13:47:05 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2009/07/06 13:00:53 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/10/30 10:55:50 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2010/10/30 10:56:19 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2011/02/23 15:41:33 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2009/07/25 13:47:05 | 000,000,000 | ---D | M] -- C:\Program Files\LG Electronics
[2009/07/25 13:49:00 | 000,000,000 | ---D | M] -- C:\Program Files\LG Outlook Sync
[2011/03/16 10:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\LogMeIn
[2009/11/06 11:12:14 | 000,000,000 | ---D | M] -- C:\Program Files\MagicDisc
[2009/11/06 11:07:38 | 000,000,000 | ---D | M] -- C:\Program Files\MagicISO
[2010/01/28 12:26:44 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/03/17 14:43:06 | 000,000,000 | ---D | M] -- C:\Program Files\Marvell
[2009/02/05 16:57:13 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2009/02/05 12:30:46 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/02/05 22:03:39 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/02/05 22:03:36 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/02/05 22:03:45 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2009/02/05 12:40:09 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2011/05/02 10:12:07 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2009/02/05 22:03:42 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2009/02/05 12:28:27 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2009/02/05 12:28:15 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2009/02/05 12:39:33 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2011/04/17 14:56:32 | 000,000,000 | ---D | M] -- C:\Program Files\Nikon
[2009/02/05 12:28:27 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2009/02/05 12:39:33 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2009/11/11 15:54:55 | 000,000,000 | ---D | M] -- C:\Program Files\Poladroid
[2010/10/30 10:53:51 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2010/07/07 12:14:14 | 000,000,000 | ---D | M] -- C:\Program Files\SpywareBlaster
[2010/12/15 21:10:35 | 000,000,000 | ---D | M] -- C:\Program Files\Tablet
[2010/01/05 01:49:59 | 000,000,000 | ---D | M] -- C:\Program Files\TrendMicro
[2009/02/05 12:34:21 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/02/05 15:40:56 | 000,000,000 | ---D | M] -- C:\Program Files\uTorrent
[2009/09/30 11:32:56 | 000,000,000 | ---D | M] -- C:\Program Files\V CAST Music with Rhapsody
[2009/02/05 13:18:49 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2010/01/28 11:32:44 | 000,000,000 | ---D | M] -- C:\Program Files\Viewpoint
[2009/02/07 14:09:36 | 000,000,000 | ---D | M] -- C:\Program Files\Visioneer OneTouch
[2009/04/08 09:09:46 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Components
[2009/02/05 12:40:29 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2009/02/05 12:39:33 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009/02/05 15:29:57 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2009/02/05 12:30:46 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2010/08/03 14:37:40 | 000,000,000 | ---D | M] -- C:\Program Files\__ New Apps Install Files
[2010/12/20 11:32:46 | 000,000,000 | ---D | M] -- C:\Program Files\__Drivers

< %appdata%\*.* >
[2009/02/05 04:23:44 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\desktop.ini
[2009/07/25 14:03:49 | 000,000,004 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\EBA145
[2009/07/25 14:03:49 | 000,870,128 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\mcs.rma
[2010/03/09 22:33:36 | 000,000,516 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\Poladroid prefs.plist
[2011/04/17 14:56:31 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\FlavorInnovator\Application Data\PrintingModule


< MD5 for: AGP440.SYS >
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\atapi.sys
[2001/08/23 05:00:00 | 000,086,656 | ---- | M] (Microsoft Corporation) MD5=A64013E98426E1877CB653685C5C0009 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::3rd May 2011, 4:59 pm

more_horiz
< MD5 for: DISK.SYS >
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:disk.sys
[2004/08/03 23:59:56 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2004/08/03 23:59:56 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\system32\dllcache\disk.sys
[2004/08/03 23:59:56 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\system32\drivers\disk.sys
[2008/04/13 11:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\disk.sys
[2001/08/23 05:00:00 | 000,033,664 | ---- | M] (Microsoft Corporation) MD5=43A10CD19D648E57ED039A6CAA667A56 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 17:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\eventlog.dll
[2004/08/04 01:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2004/08/04 01:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2004/08/04 01:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll
[2001/08/23 05:00:00 | 000,047,616 | ---- | M] (Microsoft Corporation) MD5=A510B91253544D56B5712D66BE8371E9 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\netlogon.dll
[2004/08/04 01:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2004/08/04 01:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2004/08/04 01:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll
[2001/08/23 05:00:00 | 000,397,824 | ---- | M] (Microsoft Corporation) MD5=F41C1602DC79AB72035F2388FCA0255F -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATABUS.SYS >
[2006/04/24 10:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS\OemDir\nvatabus.sys
[2006/04/24 02:52:28 | 000,100,736 | R--- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS\system32\drivers\nvatabus.sys
[2006/04/24 10:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\nvatabus.sys
[2006/04/24 02:52:28 | 000,100,736 | R--- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\nvatabus.sys

< MD5 for: SCECLI.DLL >
[2004/08/04 01:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2004/08/04 01:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2004/08/04 01:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll
[2001/08/23 05:00:00 | 000,174,080 | ---- | M] (Microsoft Corporation) MD5=73968C834C316ADC7A2F07DC4B5F3665 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\scecli.dll

< MD5 for: USBSTOR.SYS >
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:usbstor.sys
[2004/08/04 00:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\ServicePackFiles\i386\usbstor.sys
[2004/08/04 00:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\system32\dllcache\usbstor.sys
[2004/08/04 00:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\system32\drivers\USBSTOR.SYS
[2008/04/13 11:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\usbstor.sys

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2009-02-05 23:57:20

========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >


------------
EXTRAS LOG

OTL Extras logfile created on: 5/3/2011 9:29:26 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\FlavorInnovator\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 58.59 Gb Total Space | 21.76 Gb Free Space | 37.14% Space Free | Partition Type: NTFS
Drive D: | 59.51 Gb Total Space | 13.90 Gb Free Space | 23.35% Space Free | Partition Type: NTFS
Drive E: | 347.66 Gb Total Space | 129.96 Gb Free Space | 37.38% Space Free | Partition Type: NTFS

Computer Name: FLAVORIN-4BVAXJ | User Name: FlavorInnovator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\perfdisk32.exe" = C:\WINDOWS\system32\perfdisk32.exe:*:Enabled:Windows Update Service -- (wpcubed GmbH)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Documents and Settings\All Users\Start Menu\Programs\uTorrent.exe" = C:\Documents and Settings\All Users\Start Menu\Programs\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM -- (AOL LLC)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe" = C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe:*:Enabled:FTP Transfer Engine -- (GlobalSCAPE Texas, LP.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Documents and Settings\FlavorInnovator\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\FlavorInnovator\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- ()
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam
"C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe" = C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2
"E:\Steam\steamapps\common\left 4 dead 2\left4dead2.exe" = E:\Steam\steamapps\common\left 4 dead 2\left4dead2.exe:*:Enabled:left4dead2 -- ()
"C:\WINDOWS\system32\perfdisk32.exe" = C:\WINDOWS\system32\perfdisk32.exe:*:Enabled:Windows Update Service -- (wpcubed GmbH)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{09E2111C-16B1-4DDF-BF0D-F994C9A12350}" = Adobe Setup
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 24
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2C294A0B-DF22-4023-B168-8C7645B10019}" = Adobe Setup
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4915A273-16A5-42E7-B258-65BD92862D2E}_is1" = Genie Backup Manager Pro 8.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B215C29-1A3E-4736-92AA-10C83FA56EB9}" = Adobe After Effects CS3 Presets
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{5FE5135B-2B27-4E78-BA01-AEAC7826AD86}" = Extensis Suitcase 9.2.1
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{65F1CF63-31E0-450B-96F3-4A88BE7361A6}" = AGEIA PhysX v7.07.09
"{684B048F-DB5A-40C4-A374-E294BC179997}" = LG Outlook Sync
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}" = Adobe Dreamweaver CS3
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{8AF3FB06-BDA3-42A3-995C-308812D2F094}" = Adobe After Effects CS3
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91F34319-08DE-457a-99C0-0BCDFAC145B9}" = CuteFTP 8 Professional
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-0000-7760-000000000003}" = Adobe Acrobat 8 Professional
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B7F560B3-6EFF-4026-A982-843895A41149}" = Adobe BridgeTalk Plugin CS3
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{CB3F8375-B600-4B9F-83C9-238ED1E583FD}" = Adobe InDesign CS3
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1C18EDD-571A-4BDD-BE7B-1DD86027D7FF}" = Adobe Creative Suite 3 Design Premium
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E8FF78D0-4D1C-4B2D-AC80-670F135F5461}" = Poladroid
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{F08E8D2E-F132-4742-9C87-D5FF223A016A}" = Adobe Illustrator CS3
"{F7F23DFB-31E1-B7EC-7A6D-7668B595ADAE}" = FlipShare
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
"7-Zip" = 7-Zip 4.57
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Premiere 6.0" = Adobe Premiere 6.0
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Adobe_b7dd24a87e82dcf8af8876fd727b7cf" = Adobe After Effects CS3
"Adobe_c14ac4070fd9614ffe63f4bb533db2c" = Add or Remove Adobe Creative Suite 3 Design Premium
"AIM_6" = AIM 6
"CamStudio" = CamStudio
"CCleaner" = CCleaner
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.3.0
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"Dell Photo AIO Printer 962" = Dell Photo AIO Printer 962
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Eye Candy 4000" = Eye Candy 4000
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 1.91
"ie8" = Windows Internet Explorer 8
"KPT Vector Effects 1.5" = KPT Vector Effects 1.5
"Magic ISO Maker v5.5 (build 0276)" = Magic ISO Maker v5.5 (build 0276)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Marvell Miniport Driver" = Marvell Miniport Driver
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"SpywareBlaster_is1" = SpywareBlaster 4.3
"ViewpointMediaPlayer" = Viewpoint Media Player
"Visioneer 8100 Scanner" = Visioneer 8100 Scanner
"VLC media player" = VLC media player 0.9.8a
"Wacom Tablet Driver" = Wacom Tablet
"Windows XP Service Pack" = Windows XP Service Pack 2

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Facebook Plug-In" = Facebook Plug-In
"GoToMeeting" = GoToMeeting 4.5.0.457
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/4/2010 7:14:12 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrord32.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/4/2010 7:14:23 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrord32.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/4/2010 7:14:40 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/4/2010 7:21:29 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/4/2010 7:38:30 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/5/2010 3:25:01 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/5/2010 3:38:26 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/5/2010 3:59:22 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/5/2010 4:12:55 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 1/5/2010 4:32:20 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 8.0.0.456, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

[ OSession Events ]
Error - 4/18/2010 2:53:49 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.

Error - 4/18/2010 2:54:07 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 4/18/2010 2:59:17 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 5/17/2010 1:22:41 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2
seconds with 0 seconds of active time. This session ended with a crash.

Error - 5/17/2010 1:24:51 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.

Error - 5/17/2010 1:25:09 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 5/17/2010 1:25:23 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 5
seconds with 0 seconds of active time. This session ended with a crash.

Error - 5/17/2010 1:25:30 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 5/17/2010 1:25:44 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 7
seconds with 0 seconds of active time. This session ended with a crash.

Error - 6/17/2010 2:03:33 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 631
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 4/21/2011 12:14:47 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 4/22/2011 11:51:13 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 4/25/2011 12:39:34 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 4/26/2011 12:16:45 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 4/27/2011 2:06:39 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 4/28/2011 1:21:50 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 4/29/2011 12:38:06 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 4/30/2011 6:40:49 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 5/2/2011 12:55:05 PM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2

Error - 5/3/2011 11:32:36 AM | Computer Name = FLAVORIN-4BVAXJ | Source = Service Control Manager | ID = 7000
Description = The MCSTRM service failed to start due to the following error: %%2


< End of report >

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::3rd May 2011, 5:46 pm

more_horiz
Hello.

Please run OTL.exe.

  • Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):


    :OTL
    PRC - [2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) -- C:\WINDOWS\system32\perfdisk32.exe
    PRC - [2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) -- C:\WINDOWS\system32\icaapi32.exe
    SRV - [2011/05/02 19:16:39 | 000,692,736 | ---- | M] (wpcubed GmbH) [Auto | Running] -- C:\WINDOWS\system32\perfdisk32.exe -- (NVSvc32)
    O2 - BHO: (no name) - {045CED6E-0AC4-4A2F-9E1C-5C9A0B05FDF3} - C:\WINDOWS\system32\ati2dvaa32.dll (Dmitry Streblechenko)
    [2011/05/02 19:16:47 | 000,000,090 | ---- | C] () -- C:\WINDOWS\System32\640608007
    [2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\WINDOWS\System32\melenemu



  • Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.

  • Click the red Run Fix button.
  • A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTL.exe
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::3rd May 2011, 6:14 pm

more_horiz
========== OTL ==========
Process perfdisk32.exe killed successfully!
Process icaapi32.exe killed successfully!
Service NVSvc32 stopped successfully!
Service NVSvc32 deleted successfully!
C:\WINDOWS\system32\perfdisk32.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{045CED6E-0AC4-4A2F-9E1C-5C9A0B05FDF3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{045CED6E-0AC4-4A2F-9E1C-5C9A0B05FDF3}\ deleted successfully.
C:\WINDOWS\system32\ati2dvaa32.dll moved successfully.
C:\WINDOWS\system32\640608007 moved successfully.
C:\WINDOWS\system32\melenemu moved successfully.

OTL by OldTimer - Version 3.2.22.3 log created on 05032011_111412

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::4th May 2011, 2:18 pm

more_horiz
Hello.

  • Download combofix from here
    Link 1

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:

    :: Malwarebytes found Trojan.BHO :: CF_download_FF

    :: Malwarebytes found Trojan.BHO :: CF_download_rename

    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See HERE for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.

    :: Malwarebytes found Trojan.BHO :: Cf410

  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes

    :: Malwarebytes found Trojan.BHO :: Cf510

  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::4th May 2011, 5:56 pm

more_horiz
ComboFix 11-05-03.08 - FlavorInnovator 05/04/2011 10:42:26.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1630 [GMT -7:00]
Running from: c:\documents and settings\FlavorInnovator\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{7067cf8d-5880-46f7-8dec-c15bacac8b51}
c:\documents and settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{7067cf8d-5880-46f7-8dec-c15bacac8b51}\chrome.manifest
c:\documents and settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{7067cf8d-5880-46f7-8dec-c15bacac8b51}\chrome\xulcache.jar
c:\documents and settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{7067cf8d-5880-46f7-8dec-c15bacac8b51}\defaults\preferences\xulcache.js
c:\documents and settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{7067cf8d-5880-46f7-8dec-c15bacac8b51}\install.rdf
c:\documents and settings\FlavorInnovator\g2mdlhlpx.exe
c:\documents and settings\FlavorInnovator\WINDOWS
C:\RECYCLER(2)
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc10.psd
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc11.psd
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc13.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc14.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc15.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc16.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc17.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc18.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc19.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc20.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc21.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._admin.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._evt_manage.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._growth_prod.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._managed_serv.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._new_comm.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._start_happ.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._stud_parent.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._whats_happ.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc22\._why_happ.png
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc23.zip
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc7.log
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\Dc9.psd
c:\recycler(2)\S-1-5-21-1417001333-1897051121-725345543-1003(2)\INFO2
.
.
((((((((((((((((((((((((( Files Created from 2011-04-04 to 2011-05-04 )))))))))))))))))))))))))))))))
.
.
2011-05-03 18:14 . 2011-05-03 18:14 -------- d-----w- C:\_OTL
2011-05-03 15:57 . 2011-05-03 15:57 0 ---ha-w- c:\documents and settings\FlavorInnovator\hdjahfnlrn.tmp
2011-05-03 02:16 . 2011-05-03 02:16 692736 ----a-w- c:\windows\system32\icaapi32.exe
2011-05-03 02:16 . 2011-05-03 02:16 155648 ----a-w- c:\windows\system32\mfc4232.dll
2011-04-17 05:04 . 2011-04-17 05:04 -------- d-----w- c:\documents and settings\FlavorInnovator\Application Data\Nikon
2011-04-17 05:03 . 2011-04-17 05:03 335872 ----a-r- c:\documents and settings\FlavorInnovator\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2011-04-17 05:03 . 2011-04-17 21:56 -------- d-----w- c:\program files\Common Files\Nikon
2011-04-17 05:03 . 2011-04-17 21:56 -------- d-----w- c:\program files\Nikon
2011-04-17 05:02 . 2011-04-17 05:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Ultima_T15
2011-04-17 05:02 . 2011-04-17 05:02 -------- d-----w- c:\documents and settings\All Users\Application Data\EnterNHelp
2011-04-17 05:02 . 2011-04-17 05:02 -------- d-----w- C:\vc_temp
2011-04-12 21:39 . 2011-04-12 22:13 -------- d-----w- c:\program files\CamStudio
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\FlavorInnovator\Application Data\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\FlavorInnovator\Application Data\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\FlavorInnovator\Application Data\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2006-04-07 135168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-08 7561216]
"DLBXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBXtime.dll" [2004-12-07 69632]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Shortcut to Suitcase.exe.lnk - c:\program files\Extensis\Suitcase 9.2\Suitcase.exe [2009-2-5 3145728]
.
[HKLM\~\startupfolder\C:^Documents and Settings^FlavorInnovator^Start Menu^Programs^Startup^MagicDisc.lnk]
path=c:\documents and settings\FlavorInnovator\Start Menu\Programs\Startup\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBMPro8Agent]
2008-07-28 18:05 189056 ----a-w- c:\program files\Genie-Soft\GBMPro8\GBMAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 09:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneTouch Monitor]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 18:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\All Users\\Start Menu\\Programs\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\GlobalSCAPE\\CuteFTP 8 Professional\\ftpte.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\FlavorInnovator\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
.
R2 ppsio2;PPDevice;c:\windows\system32\drivers\ppsio2.sys [2/7/2009 2:02 PM 23200]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [12/15/2010 9:10 PM 2749224]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/17/2009 8:43 PM 24652]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [12/15/2010 9:10 PM 15656]
S3 PciCon;PciCon;\??\f:\pcicon.sys --> f:\PciCon.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2010-12-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.freelanceswitch.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Gmail Manager: {582195F5-92E7-40a0-A127-DB71295901D7} - %profile%\extensions\{582195F5-92E7-40a0-A127-DB71295901D7}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{045CED6E-0AC4-4A2F-9E1C-5C9A0B05FDF3} - c:\windows\system32\ati2dvaa32.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-04 10:44
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBXCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files ...
.
.
c:\docume~1\FLAVOR~1\LOCALS~1\Temp\RGI5.tmp 7075 bytes
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1417001333-1897051121-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5430F50B-4474-E38A-D416-8D6C7FA1F4A1}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oacppijaglbjcegeompgbohhgmdpne"=hex:69,61,62,69,6c,6a,65,61,6c,6b,68,63,6a,69,
67,6f,65,62,00,00
"naipefeiifkagfjndaeffipmaffh"=hex:69,61,66,62,68,69,6b,6e,6a,6e,63,70,6a,65,
70,67,61,6f,00,00
"gbknpkamogefohbhneahiihicimjephjhemkflmmppfkpe"=hex:61,61,00,00
"bbandoopcgiimgomfnknfcofmpffldajjkan"=hex:61,61,00,00
.
Completion time: 2011-05-04 10:45:42
ComboFix-quarantined-files.txt 2011-05-04 17:45
.
Pre-Run: 23,299,182,592 bytes free
Post-Run: 23,276,728,320 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 8FCFC9424A19D009BCD0862BA56E5282

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::4th May 2011, 10:11 pm

more_horiz
Hello.

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    Code:


    File::
    c:\documents and settings\FlavorInnovator\hdjahfnlrn.tmp
    c:\windows\system32\icaapi32.exe
    c:\windows\system32\mfc4232.dll

    RegNull::
    [HKEY_USERS\S-1-5-21-1417001333-1897051121-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5430F50B-4474-E38A-D416-8D6C7FA1F4A1}*]


  4. Save this as CFScript.txt, in the same location as ComboFix.exe

    :: Malwarebytes found Trojan.BHO :: Cfscriptb4i

  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::4th May 2011, 10:26 pm

more_horiz
ComboFix 11-05-04.02 - FlavorInnovator 05/04/2011 15:22:13.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1614 [GMT -7:00]
Running from: c:\documents and settings\FlavorInnovator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\FlavorInnovator\Desktop\CFScript.txt.txt
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\documents and settings\FlavorInnovator\hdjahfnlrn.tmp"
"c:\windows\system32\icaapi32.exe"
"c:\windows\system32\mfc4232.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\FlavorInnovator\hdjahfnlrn.tmp
c:\windows\system32\icaapi32.exe
c:\windows\system32\mfc4232.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-04-04 to 2011-05-04 )))))))))))))))))))))))))))))))
.
.
2011-05-03 18:14 . 2011-05-03 18:14 -------- d-----w- C:\_OTL
2011-04-17 05:04 . 2011-04-17 05:04 -------- d-----w- c:\documents and settings\FlavorInnovator\Application Data\Nikon
2011-04-17 05:03 . 2011-04-17 05:03 335872 ----a-r- c:\documents and settings\FlavorInnovator\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2011-04-17 05:03 . 2011-04-17 21:56 -------- d-----w- c:\program files\Common Files\Nikon
2011-04-17 05:03 . 2011-04-17 21:56 -------- d-----w- c:\program files\Nikon
2011-04-17 05:02 . 2011-04-17 05:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Ultima_T15
2011-04-17 05:02 . 2011-04-17 05:02 -------- d-----w- c:\documents and settings\All Users\Application Data\EnterNHelp
2011-04-17 05:02 . 2011-04-17 05:02 -------- d-----w- C:\vc_temp
2011-04-12 21:39 . 2011-04-12 22:13 -------- d-----w- c:\program files\CamStudio
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-04_17.44.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-05-04 19:27 . 2011-05-04 19:27 16384 c:\windows\Temp\Perflib_Perfdata_270.dat
+ 2009-02-05 11:23 . 2011-05-04 19:27 1600608 c:\windows\system32\FNTCACHE.DAT
- 2009-02-05 11:23 . 2011-05-04 17:15 1600608 c:\windows\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\FlavorInnovator\Application Data\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\FlavorInnovator\Application Data\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\documents and settings\FlavorInnovator\Application Data\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2006-04-07 135168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-08 7561216]
"DLBXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBXtime.dll" [2004-12-07 69632]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Shortcut to Suitcase.exe.lnk - c:\program files\Extensis\Suitcase 9.2\Suitcase.exe [2009-2-5 3145728]
.
[HKLM\~\startupfolder\C:^Documents and Settings^FlavorInnovator^Start Menu^Programs^Startup^MagicDisc.lnk]
path=c:\documents and settings\FlavorInnovator\Start Menu\Programs\Startup\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBMPro8Agent]
2008-07-28 18:05 189056 ----a-w- c:\program files\Genie-Soft\GBMPro8\GBMAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 09:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneTouch Monitor]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 18:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\All Users\\Start Menu\\Programs\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\GlobalSCAPE\\CuteFTP 8 Professional\\ftpte.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\FlavorInnovator\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
.
R2 ppsio2;PPDevice;c:\windows\system32\drivers\ppsio2.sys [2/7/2009 2:02 PM 23200]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [12/15/2010 9:10 PM 2749224]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/17/2009 8:43 PM 24652]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [12/15/2010 9:10 PM 15656]
S3 PciCon;PciCon;\??\f:\pcicon.sys --> f:\PciCon.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2010-12-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.freelanceswitch.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Gmail Manager: {582195F5-92E7-40a0-A127-DB71295901D7} - %profile%\extensions\{582195F5-92E7-40a0-A127-DB71295901D7}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-04 15:24
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBXCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\cscui.dll
.
Completion time: 2011-05-04 15:25:39
ComboFix-quarantined-files.txt 2011-05-04 22:25
ComboFix2.txt 2011-05-04 17:45
.
Pre-Run: 23,289,479,168 bytes free
Post-Run: 23,269,404,672 bytes free
.
- - End Of File - - E0C77817D0F34EFD0C295A5196FEB210

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::4th May 2011, 11:06 pm

more_horiz
Hello.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

  • Check (tick) this box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • When prompted to run ActiveX. click Yes.
  • You will be asked to install an ActiveX. Click Install.
  • Once installed, the scanner will be initialized.
  • After the scanner is initialized, click Start.
  • Check (tick) Remove found threats box.
  • Check (tick) Scan unwanted applications.
  • Click on Scan.
  • It will start scanning. Please be patient.
  • Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::5th May 2011, 4:25 am

more_horiz
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=f25bf80a484c43419423da11b46d5dda
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-05-05 01:25:29
# local_time=2011-05-04 06:25:29 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=768 16777215 100 0 39851535 39851535 0 0
# compatibility_mode=3073 16777214 0 35 39769206 39851471 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=261982
# found=10
# cleaned=10
# scan_time=3247
C:\Qoobox\Quarantine\C\Documents and Settings\FlavorInnovator\Application Data\Mozilla\Firefox\Profiles\x1x4x21c.default\extensions\{7067cf8d-5880-46f7-8dec-c15bacac8b51}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\icaapi32.exe.vir a variant of Win32/Kryptik.NHY trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\mfc4232.dll.vir a variant of Win32/Kryptik.NHY trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{1AB224AD-A145-476E-96D8-E40D0C5E0F1D}\RP427\A0054869.manifest Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{1AB224AD-A145-476E-96D8-E40D0C5E0F1D}\RP428\A0055114.exe a variant of Win32/Kryptik.NHY trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{1AB224AD-A145-476E-96D8-E40D0C5E0F1D}\RP428\A0055115.dll a variant of Win32/Kryptik.NHY trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\05032011_111412\C_WINDOWS\system32\ati2dvaa32.dll a variant of Win32/Kryptik.NHY trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\05032011_111412\C_WINDOWS\system32\perfdisk32.exe a variant of Win32/Kryptik.NHY trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\C backup 2009\__ New Apps Install Files\3DS_Max_8\Keygen\Keygen part 1.exe a variant of Win32/Keygen.AQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\Data\Documents\gfx\tutorials and plugins\After Effects Plugins\Trapcode Particular v1.50\trapcode.multikeygen.v1.2.exe probably a variant of Win32/Agent.CWNTZGW trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::5th May 2011, 6:31 pm

more_horiz
Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Viewpoint Media Player

Your Java needs updating!

  • Please go to Start > Control Panel, click on Java.
  • When the Java control panel opens, go into the Update tab.
  • At the bottom of that window, press the "Update Now" button and it will attempt to download the latest Java update.
  • Next, the Updater window opens, hit the Install button. It will now attempt to download the update.
  • Untick the box for installing the Yahoo Toolbar when asked.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::5th May 2011, 6:41 pm

more_horiz
although i deleted my AVG antivirus my computer still says that the AVG real time shield is still running. How can i completely uninstall/delete AVG?

Other than that I think my computer is fixed.
Thank you very much!!!

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::5th May 2011, 6:57 pm

more_horiz
Hello.
What antivirus are you using now then?

To remove AVG, please re-download Combofix and run this script.

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    Code:


    SecCenter::
    {17DDD097-36FF-435F-9E1B-52D74245D6BF}

  4. Save this as CFScript.txt, in the same location as ComboFix.exe

    :: Malwarebytes found Trojan.BHO :: Cfscriptb4i

  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.

description:: Malwarebytes found Trojan.BHO :: EmptyRe: :: Malwarebytes found Trojan.BHO ::

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum