Author Topic: Google Redirect (Read 48635 times)

Dr Jay · « **Reply #45 on:** March 09, 2010, 11:21:08 AM »

Open OTLPE

In the Custom Scans box, place in the following then press Quick Scan:

/md5start
atapi.sys
iastor.sys
explorer.exe
lsass.exe
/md5stop

Post the log in your next reply.

Kerjifire · « **Reply #46 on:** March 10, 2010, 02:27:45 AM »

OTL logfile created on: 3/10/2010 6:12:51 PM - Run
OTLPE by OldTimer - Version 3.1.35.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 64.74 Gb Total Space | 15.67 Gb Free Space | 24.21% Space Free | Partition Type: NTFS
Drive D: | 39.06 Gb Total Space | 20.66 Gb Free Space | 52.89% Space Free | Partition Type: NTFS
Drive E: | 45.25 Gb Total Space | 11.29 Gb Free Space | 24.94% Space Free | Partition Type: NTFS
Drive F: | 39.06 Gb Total Space | 4.55 Gb Free Space | 11.65% Space Free | Partition Type: NTFS
Drive G: | 199.73 Gb Total Space | 135.39 Gb Free Space | 67.79% Space Free | Partition Type: NTFS
Drive H: | 296.53 Gb Total Space | 13.07 Gb Free Space | 4.41% Space Free | Partition Type: NTFS
Drive I: | 329.06 Gb Total Space | 214.31 Gb Free Space | 65.13% Space Free | Partition Type: NTFS
Drive J: | 3.75 Gb Total Space | 1.64 Gb Free Space | 43.63% Space Free | Partition Type: FAT32
Drive X: | 276.79 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (ssrcc)
SRV - File not found [Auto] -- -- (msrvc)
SRV - File not found [Auto] -- -- (DNTVSchedulerPro)
SRV - [2010/02/19 03:31:44 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [Auto] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/07 00:07:10 | 000,236,368 | ---- | M] (Malwarebytes Corporation) [Auto] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2009/11/09 18:28:08 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009/11/05 22:29:22 | 001,141,712 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009/10/29 19:18:16 | 000,359,624 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2009/07/19 20:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/05/18 20:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009/02/15 09:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2001/04/05 22:57:46 | 000,238,080 | ---- | M] (O&O Software GmbH) [Auto] -- C:\WINDOWS\System32\OOD2000.exe -- (OOD2000)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Search,Local Page = http://www.Google.com/
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Local Page Restore =

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\CS_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\Guest_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\M_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
IE - HKU\M_Chung_ON_C\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - Reg Error: Key error. File not found
IE - HKU\M_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ninemsn.com.au/?ocid=iehp
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP =
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8080

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/10/14 06:33:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/21 02:47:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/21 02:47:09 | 000,000,000 | ---D | M]

[2010/03/06 06:04:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/06/08 06:29:36 | 000,239,432 | ---- | M] (Pando Networks) -- C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2010/02/04 03:21:29 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\CS_Chung_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\CS_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\Guest_ON_C\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKU\M_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\M_Chung_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\S_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S_Chung_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [DNTVSchedulerProTray Icon] C:\Program Files\DNTV Scheduler Pro\DNTVSchedulerProTray.exe (Renura Enterprises Pty Ltd)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [OpwareSE2] C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S_Chung_ON_C..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O4 - HKU\S_Chung_ON_C..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\CS_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Guest_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\M_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1256421470390 (WUWebControl Class)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab (CBreakshotControl Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/06 08:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005/04/06 08:15:00 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/03/09 22:27:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\My Documents\8R
[2010/03/07 05:14:08 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/07 05:14:08 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/07 05:14:08 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/07 05:14:08 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/07 05:13:55 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010/03/07 04:39:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/03/06 23:37:55 | 000,155,648 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Oemdspif.dll
[2010/03/06 23:37:54 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ati2edxx.dll
[2010/03/06 23:37:53 | 000,208,896 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atipdlxx.dll
[2010/03/06 23:37:53 | 000,026,112 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Ati2mdxx.exe
[2010/03/06 23:37:53 | 000,024,064 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ativcoxx.dll
[2010/03/06 23:37:16 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2010/03/06 23:37:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2010/03/06 23:36:29 | 000,000,000 | ---D | C] -- C:\ATI
[2010/03/06 23:17:13 | 000,000,000 | ---D | C] -- C:\Program Files\Phyxion.net
[2010/03/05 23:41:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\maxdriver
[2010/03/05 18:03:07 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Cookies
[2010/03/04 02:39:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\Application Data\mIRC
[2010/03/03 05:04:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\My Documents\8R Buttons
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NSS
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Scan
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NSS\0207000.034
[2010/03/02 04:08:51 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/03/02 03:08:38 | 000,000,000 | ---D | C] -- C:\_OTS
[2010/03/02 02:57:18 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/02/28 03:43:11 | 000,632,832 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\S Chung\Desktop\OTS.exe
[2010/02/26 23:40:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\CS Chung\Application Data\Logitech
[2010/02/26 18:36:01 | 000,000,000 | ---D | C] -- C:\Program Files\WhoCrashed
[2010/02/25 03:24:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\Desktop\Ratings
[2010/02/25 03:15:25 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/02/25 02:28:05 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/02/25 01:13:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\Desktop\avenger
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\Documents and Settings\M Chung\My Documents\*.tmp files -> C:\Documents and Settings\M Chung\My Documents\*.tmp -> ]
[32 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\Documents and Settings\S Chung\My Documents\*.tmp files -> C:\Documents and Settings\S Chung\My Documents\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/03/09 20:21:14 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/03/07 05:43:08 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
[2010/03/07 05:43:08 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT
[2010/03/07 05:43:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/07 05:43:00 | 009,437,184 | ---- | M] () -- C:\Documents and Settings\S Chung\NTUSER.DAT
[2010/03/07 05:42:58 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\S Chung\ntuser.ini
[2010/03/07 05:31:10 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/07 05:30:24 | 000,350,192 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010/03/07 05:30:13 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/07 05:29:55 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/07 05:29:26 | 2147,012,608 | -HS- | M] () -- C:\hiberfil.sys
[2010/03/07 05:29:25 | 2145,386,496 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2010/03/07 05:00:18 | 004,121,899 | R--- | M] () -- C:\Documents and Settings\S Chung\Desktop\ComboFix.exe
[2010/03/07 04:14:37 | 000,051,200 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\maths PROBLEMS Part 4.doc
[2010/03/06 23:13:09 | 000,000,051 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/03/06 22:21:40 | 000,000,508 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\Combat Arms.lnk
[2010/03/06 00:52:28 | 003,932,160 | ---- | M] () -- C:\Documents and Settings\CS Chung\ntuser.dat.rmbak
[2010/03/06 00:52:28 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.rmbak
[2010/03/06 00:51:45 | 009,699,328 | ---- | M] () -- C:\Documents and Settings\S Chung\ntuser.dat.rmbak
[2010/03/06 00:51:17 | 003,731,456 | ---- | M] () -- C:\Documents and Settings\M Chung\NTUSER.DAT
[2010/03/06 00:51:17 | 000,774,144 | ---- | M] () -- C:\Documents and Settings\Guest\NTUSER.DAT
[2010/03/06 00:51:17 | 000,462,848 | ---- | M] () -- C:\Documents and Settings\Administrator\s-1-5-21-1935655697-688789844-1801674531-500.rrr
[2010/03/06 00:51:15 | 003,702,784 | ---- | M] () -- C:\Documents and Settings\CS Chung\NTUSER.DAT
[2010/03/06 00:50:53 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\s-1-5-19.rrr
[2010/03/05 20:13:49 | 000,007,410 | ---- | M] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100306_121346.reg
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 18:00:06 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\CS Chung\ntuser.ini
[2010/03/05 17:59:52 | 000,000,082 | ---- | M] () -- C:\WINDOWS\SuperUtil.ini
[2010/03/05 17:59:22 | 000,443,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/05 17:59:22 | 000,071,846 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/05 05:40:27 | 000,164,864 | ---- | M] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/04 05:33:46 | 000,038,197 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex1.swf
[2010/03/04 05:11:47 | 000,086,038 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex.swf
[2010/03/04 03:08:51 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/03/04 03:05:24 | 000,060,056 | ---- | M] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100304_190440.reg
[2010/03/04 00:40:52 | 001,138,992 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\maxlook.exe
[2010/03/03 03:56:21 | 000,172,335 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\avatar_1218.gif
[2010/03/03 00:41:40 | 000,047,616 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\Win32kDiag.exe
[2010/03/02 07:24:28 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\China Essay.doc
[2010/03/02 05:45:59 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/03/02 05:45:28 | 007,520,288 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\SUPERAntiSpyware.exe
[2010/03/02 05:41:16 | 000,000,476 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for S Chung.job
[2010/03/02 04:08:56 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\NSS\0207000.034\isolate.ini
[2010/03/02 03:16:23 | 000,100,908 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\SystemLook.exe
[2010/03/01 06:21:08 | 000,000,490 | ---- | M] () -- C:\WINDOWS\tasks\Install_NSS.job
[2010/02/28 03:43:15 | 000,632,832 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\S Chung\Desktop\OTS.exe
[2010/02/27 01:53:10 | 000,028,160 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\test.doc
[2010/02/26 23:40:38 | 000,149,440 | ---- | M] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/26 20:01:07 | 000,638,548 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\GetSystemInfo_CSC2_S Chung_2010_02_27_11_54_57.zip
[2010/02/26 18:36:01 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\WhoCrashed.lnk
[2010/02/26 06:32:31 | 003,729,202 | -H-- | M] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\IconCache.db
[2010/02/26 06:13:46 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cab6d4c3b7d16a.job
[2010/02/26 01:07:29 | 000,000,162 | -H-- | M] () -- C:\Documents and Settings\S Chung\My Documents\~$THS PROBLEMS Part 4.doc
[2010/02/25 05:23:35 | 001,190,400 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\Should Australia Have An R Rating For Games.ppt
[2010/02/25 02:59:28 | 000,009,654 | ---- | M] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100225_185909.reg
[2010/02/25 02:45:12 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/02/25 02:28:12 | 000,000,330 | RHS- | M] () -- C:\boot.ini
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\Documents and Settings\M Chung\My Documents\*.tmp files -> C:\Documents and Settings\M Chung\My Documents\*.tmp -> ]
[32 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\Documents and Settings\S Chung\My Documents\*.tmp files -> C:\Documents and Settings\S Chung\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/07 05:14:08 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/07 05:14:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/07 05:14:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/07 05:14:08 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/07 05:14:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/06 23:44:18 | 2147,012,608 | -HS- | C] () -- C:\hiberfil.sys
[2010/03/06 23:37:55 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/03/06 23:37:54 | 000,455,520 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/03/06 23:37:53 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2010/03/06 23:37:53 | 000,198,341 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/03/06 23:37:53 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2010/03/06 23:37:53 | 000,031,240 | ---- | C] () -- C:\WINDOWS\System32\atiapfxx.blb
[2010/03/06 23:37:53 | 000,020,274 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2010/03/06 23:37:53 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/03/06 06:43:07 | 000,000,508 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Combat Arms.lnk
[2010/03/05 20:13:47 | 000,007,410 | ---- | C] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100306_121346.reg
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 06:47:19 | 000,000,082 | ---- | C] () -- C:\WINDOWS\SuperUtil.ini
[2010/03/04 05:33:46 | 000,038,197 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex1.swf
[2010/03/04 05:11:47 | 000,086,038 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex.swf
[2010/03/04 03:04:41 | 000,060,056 | ---- | C] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100304_190440.reg
[2010/03/04 00:40:51 | 001,138,992 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\maxlook.exe
[2010/03/03 03:56:20 | 000,172,335 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\avatar_1218.gif
[2010/03/03 00:41:39 | 000,047,616 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Win32kDiag.exe
[2010/03/02 05:45:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/03/02 05:45:24 | 007,520,288 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\SUPERAntiSpyware.exe
[2010/03/02 05:41:16 | 000,000,476 | ---- | C] () -- C:\WINDOWS\tasks\Norton Security Scan for S Chung.job
[2010/03/02 04:08:56 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\NSS\0207000.034\isolate.ini
[2010/03/02 03:16:23 | 000,100,908 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\SystemLook.exe
[2010/03/02 02:52:56 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\China Essay.doc
[2010/03/01 06:21:08 | 000,000,490 | ---- | C] () -- C:\WINDOWS\tasks\Install_NSS.job
[2010/02/27 01:52:58 | 000,028,160 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\test.doc
[2010/02/26 23:06:08 | 004,121,899 | R--- | C] () -- C:\Documents and Settings\S Chung\Desktop\ComboFix.exe
[2010/02/26 19:55:08 | 000,638,548 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\GetSystemInfo_CSC2_S Chung_2010_02_27_11_54_57.zip
[2010/02/26 18:36:01 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\WhoCrashed.lnk
[2010/02/26 06:13:46 | 000,000,882 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cab6d4c3b7d16a.job
[2010/02/26 01:07:29 | 000,000,162 | -H-- | C] () -- C:\Documents and Settings\S Chung\My Documents\~$THS PROBLEMS Part 4.doc
[2010/02/26 00:47:19 | 000,085,797 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Cheetah-Anti-Rogue.cmd
[2010/02/25 04:05:09 | 001,190,400 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\Should Australia Have An R Rating For Games.ppt
[2010/02/25 02:59:11 | 000,009,654 | ---- | C] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100225_185909.reg
[2010/02/25 02:28:11 | 000,000,260 | ---- | C] () -- C:\Boot.bak
[2010/02/25 02:28:08 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/02/23 06:16:57 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/02/23 06:16:57 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/02/16 04:48:20 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\WinVd32.sys
[2010/02/16 04:48:18 | 000,017,984 | ---- | C] () -- C:\WINDOWS\System32\WinFLdrv.sys
[2010/02/16 04:48:17 | 000,000,990 | -HS- | C] () -- C:\Documents and Settings\S Chung\Application Data\systemfl.$dk
[2010/02/16 01:37:31 | 000,000,067 | ---- | C] () -- C:\WINDOWS\AudioMidRecorder.INI
[2010/01/25 22:08:06 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010/01/25 00:03:25 | 000,000,532 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/12/14 23:08:59 | 000,000,355 | ---- | C] () -- C:\WINDOWS\Sonic3K.INI
[2009/12/14 03:02:54 | 000,075,600 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\ReplayMusicLog.log
[2009/11/24 05:45:51 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\rmc_rtspdl.dll
[2009/11/23 06:02:51 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009/11/09 14:17:25 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\housecall.guid.cache
[2009/10/26 06:13:43 | 000,000,068 | ---- | C] () -- C:\WINDOWS\MyProg.ini
[2009/10/24 04:07:25 | 000,298,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\yk51x86.sys
[2009/09/10 19:00:34 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2009/08/03 00:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/28 06:28:32 | 000,305,408 | ---- | C] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/07/25 05:36:54 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\fusioncache.dat
[2009/07/24 04:00:27 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/04 00:06:18 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\fusioncache.dat
[2009/05/27 05:40:54 | 000,001,814 | ---- | C] () -- C:\WINDOWS\HprSnap.INI
[2009/05/26 04:19:33 | 000,000,051 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009/05/22 08:10:40 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\ood2kmsg.dll
[2009/05/22 08:10:39 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\OODCSPRO.dll
[2008/11/11 15:59:33 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/11/05 06:58:55 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2008/10/11 17:36:19 | 000,000,022 | ---- | C] () -- C:\WINDOWS\REGPSD20.INI
[2008/10/11 17:36:11 | 000,000,037 | ---- | C] () -- C:\WINDOWS\Viewer.ini
[2008/10/11 17:36:06 | 000,000,778 | ---- | C] () -- C:\WINDOWS\PSDEWIN.INI
[2008/10/11 17:36:06 | 000,000,080 | ---- | C] () -- C:\WINDOWS\psdxport.ini
[2008/08/18 16:07:05 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/03 02:38:01 | 000,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/07/03 02:38:01 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\PnkBstrK.sys
[2008/01/28 06:05:33 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL
[2007/12/06 00:59:26 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\M Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/22 04:47:36 | 000,000,059 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\AVSDVDPlayer.m3u
[2007/09/08 02:06:57 | 000,000,745 | ---- | C] () -- C:\WINDOWS\CoD.INI
[2007/08/25 00:38:36 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\CS Chung\Application Data\AVSDVDPlayer.m3u
[2007/08/04 06:51:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2007/07/04 06:26:05 | 000,164,864 | ---- | C] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/30 00:02:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2007/06/27 02:11:04 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/06/18 05:09:05 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/06/15 05:12:31 | 000,087,808 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2007/06/15 04:01:19 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS7M.DLL
[2007/06/14 06:28:12 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004/11/28 17:09:03 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT4.dll
[2004/11/28 17:05:56 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT3.dll
[2004/11/27 23:28:03 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT2.dll
[2004/11/27 23:11:01 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT1.dll
[2004/08/03 19:56:46 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/07/08 07:04:46 | 000,000,015 | ---- | C] () -- C:\WINDOWS\System32\caacedfedaadeca.dll

========== LOP Check ==========

[2009/05/30 20:05:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Canon
[2008/06/29 01:45:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\CD-LabelPrint
[2009/07/25 05:54:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Cuttermaran
[2009/01/28 02:33:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\HiYo
[2009/07/28 06:19:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Pegasys Inc
[2009/11/09 14:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\QuickScan
[2009/08/09 08:10:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\VideoReDo-TVSuite
[2009/08/05 07:04:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\VideoReDoPlus
[2009/02/28 18:28:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\HiYo
[2009/07/24 18:49:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\My Battle for Middle-earth Files
[2007/07/01 21:16:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\Sierra
[2007/11/24 06:25:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\Thunderbird
[2009/11/25 06:26:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Any Video Converter
[2010/01/29 02:54:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Auslogics
[2010/01/25 01:03:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Error Fix
[2010/01/22 19:38:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Leadertech
[2009/11/26 03:29:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Mp3tag
[2009/12/13 22:06:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\My Battle for Middle-earth(tm) II Files
[2009/11/19 05:14:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Registry Mechanic
[2010/01/25 00:03:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\ScanSoft
[2010/01/25 23:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Simply Super Software
[2009/11/19 18:15:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Ubisoft
[2010/03/05 07:42:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\uTorrent
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2010/03/01 06:21:08 | 000,000,490 | ---- | M] () -- C:\WINDOWS\Tasks\Install_NSS.job

========== Purity Check ==========

========== Custom Scans ==========

< MD5 for: ATAPI.SYS >
[2004/08/04 07:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/10/24 17:20:50 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009/10/24 17:20:50 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] () MD5=2A7506584BB54EB87CA6F1BCF1DBBE15 -- C:\WINDOWS\maxdriver\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] () MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\ComboFix\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2004/08/04 07:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 07:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: LSASS.EXE >
[2004/08/04 07:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=84885F9B82F4D55C6146EBF6065D75D2 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008/04/13 19:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\ERDNT\cache\lsass.exe
[2008/04/13 19:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008/04/13 19:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\lsass.exe
[2008/04/13 19:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\system32\lsass.exe
< End of report >

Kerjifire · « **Reply #47 on:** March 10, 2010, 02:28:54 AM »

Can u get my XP working soon, i sorta needa do my skool work

Dr Jay · « **Reply #48 on:** March 10, 2010, 08:06:19 AM »

Open OTLPE

In the Custom Scans box, place in the following then press Quick Scan:

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
c:\$recycle.bin\*.* /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
nvstor32.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
explorer.exe
svchost.exe
userinit.exe
qmgr.dll
ws2_32.dll
proquota.exe
imm32.dll
kernel32.dll
ndis.sys
autochk.exe
spoolsv.exe
xmlprov.dll
ntmssvc.dll
mswsock.dll
Beep.SYS
ntfs.sys
termsrv.dll
sfcfiles.dll
st3shark.sys
ahcix86.sys
srsvc.dll
nvrd32.sys
/md5stop
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

Post the log in your next reply.

Kerjifire · « **Reply #49 on:** March 10, 2010, 11:30:42 PM »

OTL logfile created on: 3/11/2010 5:03:03 PM - Run
OTLPE by OldTimer - Version 3.1.35.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 64.74 Gb Total Space | 15.67 Gb Free Space | 24.21% Space Free | Partition Type: NTFS
Drive D: | 39.06 Gb Total Space | 20.66 Gb Free Space | 52.89% Space Free | Partition Type: NTFS
Drive E: | 45.25 Gb Total Space | 11.29 Gb Free Space | 24.94% Space Free | Partition Type: NTFS
Drive F: | 39.06 Gb Total Space | 4.55 Gb Free Space | 11.65% Space Free | Partition Type: NTFS
Drive G: | 199.73 Gb Total Space | 135.39 Gb Free Space | 67.79% Space Free | Partition Type: NTFS
Drive H: | 296.53 Gb Total Space | 13.07 Gb Free Space | 4.41% Space Free | Partition Type: NTFS
Drive I: | 329.06 Gb Total Space | 214.31 Gb Free Space | 65.13% Space Free | Partition Type: NTFS
Drive J: | 3.75 Gb Total Space | 1.63 Gb Free Space | 43.45% Space Free | Partition Type: FAT32
Drive X: | 276.79 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (ssrcc)
SRV - File not found [Auto] -- -- (msrvc)
SRV - File not found [Auto] -- -- (DNTVSchedulerPro)
SRV - [2010/02/19 03:31:44 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [Auto] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/07 00:07:10 | 000,236,368 | ---- | M] (Malwarebytes Corporation) [Auto] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2009/11/09 18:28:08 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009/11/05 22:29:22 | 001,141,712 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009/10/29 19:18:16 | 000,359,624 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2009/07/19 20:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/05/18 20:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009/02/15 09:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2001/04/05 22:57:46 | 000,238,080 | ---- | M] (O&O Software GmbH) [Auto] -- C:\WINDOWS\System32\OOD2000.exe -- (OOD2000)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Search,Local Page = http://www.Google.com/
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Local Page Restore =

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\CS_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\Guest_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\M_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
IE - HKU\M_Chung_ON_C\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - Reg Error: Key error. File not found
IE - HKU\M_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ninemsn.com.au/?ocid=iehp
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP =
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8080

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/10/14 06:33:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/21 02:47:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/21 02:47:09 | 000,000,000 | ---D | M]

[2010/03/06 06:04:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/06/08 06:29:36 | 000,239,432 | ---- | M] (Pando Networks) -- C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2010/02/04 03:21:29 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\CS_Chung_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\CS_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\Guest_ON_C\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKU\M_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\M_Chung_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\S_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S_Chung_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [DNTVSchedulerProTray Icon] C:\Program Files\DNTV Scheduler Pro\DNTVSchedulerProTray.exe (Renura Enterprises Pty Ltd)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [OpwareSE2] C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S_Chung_ON_C..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O4 - HKU\S_Chung_ON_C..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\CS_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Guest_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\M_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1256421470390 (WUWebControl Class)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab (CBreakshotControl Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/06 08:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005/04/06 08:15:00 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/10/24 14:13:42 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 2
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sdauxservice - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SafeBootMin: sdcoreservice - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: WdfLoadGroup -
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sdauxservice - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SafeBootNet: sdcoreservice - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: vsmon - C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SafeBootNet: WdfLoadGroup -
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646d-cd3c-40f4-97b9-cd9e4e6262ef} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89b4c1cd-b018-4511-b0a1-5476dbf70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.alf2cd - C:\WINDOWS\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.scg726 - C:\WINDOWS\System32\Scg726.acm (SHARP Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept)
Drivers32: vidc.ffds - C:\Program Files\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MKVC - C:\WINDOWS\System32\KMVIDC32.DLL ()
Drivers32: vidc.mp42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mp43 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.XFR1 - C:\WINDOWS\System32\xfcodec.dll ()
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

========== Files/Folders - Created Within 14 Days ==========

[2010/03/09 22:27:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\My Documents\8R
[2010/03/07 05:14:08 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/07 05:14:08 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/07 05:14:08 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/07 05:14:08 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/07 05:13:55 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010/03/07 04:39:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/03/06 23:37:55 | 000,155,648 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Oemdspif.dll
[2010/03/06 23:37:54 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ati2edxx.dll
[2010/03/06 23:37:53 | 000,208,896 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atipdlxx.dll
[2010/03/06 23:37:53 | 000,026,112 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Ati2mdxx.exe
[2010/03/06 23:37:53 | 000,024,064 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ativcoxx.dll
[2010/03/06 23:37:16 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2010/03/06 23:37:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2010/03/06 23:36:29 | 000,000,000 | ---D | C] -- C:\ATI
[2010/03/06 23:17:13 | 000,000,000 | ---D | C] -- C:\Program Files\Phyxion.net
[2010/03/05 23:41:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\maxdriver
[2010/03/05 18:03:07 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Cookies
[2010/03/04 02:39:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\Application Data\mIRC
[2010/03/03 05:04:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\My Documents\8R Buttons
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NSS
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Scan
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NSS\0207000.034
[2010/03/02 04:08:51 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/03/02 03:08:38 | 000,000,000 | ---D | C] -- C:\_OTS
[2010/03/02 02:57:18 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/02/28 03:43:11 | 000,632,832 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\S Chung\Desktop\OTS.exe
[2010/02/26 23:40:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\CS Chung\Application Data\Logitech
[2010/02/26 18:36:01 | 000,000,000 | ---D | C] -- C:\Program Files\WhoCrashed
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\Documents and Settings\M Chung\My Documents\*.tmp files -> C:\Documents and Settings\M Chung\My Documents\*.tmp -> ]
[32 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\Documents and Settings\S Chung\My Documents\*.tmp files -> C:\Documents and Settings\S Chung\My Documents\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/03/10 20:21:20 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/03/07 05:43:08 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
[2010/03/07 05:43:08 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT
[2010/03/07 05:43:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/07 05:43:00 | 009,437,184 | ---- | M] () -- C:\Documents and Settings\S Chung\NTUSER.DAT
[2010/03/07 05:42:58 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\S Chung\ntuser.ini
[2010/03/07 05:31:10 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/07 05:30:24 | 000,350,192 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010/03/07 05:30:13 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/07 05:29:55 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/07 05:29:26 | 2147,012,608 | -HS- | M] () -- C:\hiberfil.sys
[2010/03/07 05:29:25 | 2145,386,496 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2010/03/07 05:00:18 | 004,121,899 | R--- | M] () -- C:\Documents and Settings\S Chung\Desktop\ComboFix.exe
[2010/03/07 04:14:37 | 000,051,200 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\maths PROBLEMS Part 4.doc
[2010/03/06 23:13:09 | 000,000,051 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/03/06 22:21:40 | 000,000,508 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\Combat Arms.lnk
[2010/03/06 00:52:28 | 003,932,160 | ---- | M] () -- C:\Documents and Settings\CS Chung\ntuser.dat.rmbak
[2010/03/06 00:52:28 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.rmbak
[2010/03/06 00:51:45 | 009,699,328 | ---- | M] () -- C:\Documents and Settings\S Chung\ntuser.dat.rmbak
[2010/03/06 00:51:17 | 003,731,456 | ---- | M] () -- C:\Documents and Settings\M Chung\NTUSER.DAT
[2010/03/06 00:51:17 | 000,774,144 | ---- | M] () -- C:\Documents and Settings\Guest\NTUSER.DAT
[2010/03/06 00:51:17 | 000,462,848 | ---- | M] () -- C:\Documents and Settings\Administrator\s-1-5-21-1935655697-688789844-1801674531-500.rrr
[2010/03/06 00:51:15 | 003,702,784 | ---- | M] () -- C:\Documents and Settings\CS Chung\NTUSER.DAT
[2010/03/06 00:50:53 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\s-1-5-19.rrr
[2010/03/05 20:13:49 | 000,007,410 | ---- | M] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100306_121346.reg
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 18:00:06 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\CS Chung\ntuser.ini
[2010/03/05 17:59:52 | 000,000,082 | ---- | M] () -- C:\WINDOWS\SuperUtil.ini
[2010/03/05 17:59:22 | 000,443,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/05 17:59:22 | 000,071,846 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/05 05:40:27 | 000,164,864 | ---- | M] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/04 05:33:46 | 000,038,197 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex1.swf
[2010/03/04 05:11:47 | 000,086,038 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex.swf
[2010/03/04 03:08:51 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/03/04 03:05:24 | 000,060,056 | ---- | M] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100304_190440.reg
[2010/03/04 00:40:52 | 001,138,992 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\maxlook.exe
[2010/03/03 03:56:21 | 000,172,335 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\avatar_1218.gif
[2010/03/03 00:41:40 | 000,047,616 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\Win32kDiag.exe
[2010/03/02 07:24:28 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\China Essay.doc
[2010/03/02 05:45:59 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/03/02 05:45:28 | 007,520,288 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\SUPERAntiSpyware.exe
[2010/03/02 05:41:16 | 000,000,476 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for S Chung.job
[2010/03/02 04:08:56 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\NSS\0207000.034\isolate.ini
[2010/03/02 03:16:23 | 000,100,908 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\SystemLook.exe
[2010/03/01 06:21:08 | 000,000,490 | ---- | M] () -- C:\WINDOWS\tasks\Install_NSS.job
[2010/02/28 03:43:15 | 000,632,832 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\S Chung\Desktop\OTS.exe
[2010/02/27 01:53:10 | 000,028,160 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\test.doc
[2010/02/26 23:40:38 | 000,149,440 | ---- | M] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/26 20:01:07 | 000,638,548 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\GetSystemInfo_CSC2_S Chung_2010_02_27_11_54_57.zip
[2010/02/26 18:36:01 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\WhoCrashed.lnk
[2010/02/26 06:32:31 | 003,729,202 | -H-- | M] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\IconCache.db
[2010/02/26 06:13:46 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cab6d4c3b7d16a.job
[2010/02/26 01:07:29 | 000,000,162 | -H-- | M] () -- C:\Documents and Settings\S Chung\My Documents\~$THS PROBLEMS Part 4.doc
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\Documents and Settings\M Chung\My Documents\*.tmp files -> C:\Documents and Settings\M Chung\My Documents\*.tmp -> ]
[32 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\Documents and Settings\S Chung\My Documents\*.tmp files -> C:\Documents and Settings\S Chung\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

Kerjifire · « **Reply #50 on:** March 10, 2010, 11:31:15 PM »

[2010/03/07 05:14:08 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/07 05:14:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/07 05:14:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/07 05:14:08 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/07 05:14:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/06 23:44:18 | 2147,012,608 | -HS- | C] () -- C:\hiberfil.sys
[2010/03/06 23:37:55 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/03/06 23:37:54 | 000,455,520 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/03/06 23:37:53 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2010/03/06 23:37:53 | 000,198,341 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/03/06 23:37:53 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2010/03/06 23:37:53 | 000,031,240 | ---- | C] () -- C:\WINDOWS\System32\atiapfxx.blb
[2010/03/06 23:37:53 | 000,020,274 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2010/03/06 23:37:53 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/03/06 06:43:07 | 000,000,508 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Combat Arms.lnk
[2010/03/05 20:13:47 | 000,007,410 | ---- | C] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100306_121346.reg
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 06:47:19 | 000,000,082 | ---- | C] () -- C:\WINDOWS\SuperUtil.ini
[2010/03/04 05:33:46 | 000,038,197 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex1.swf
[2010/03/04 05:11:47 | 000,086,038 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex.swf
[2010/03/04 03:04:41 | 000,060,056 | ---- | C] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100304_190440.reg
[2010/03/04 00:40:51 | 001,138,992 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\maxlook.exe
[2010/03/03 03:56:20 | 000,172,335 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\avatar_1218.gif
[2010/03/03 00:41:39 | 000,047,616 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Win32kDiag.exe
[2010/03/02 05:45:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/03/02 05:45:24 | 007,520,288 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\SUPERAntiSpyware.exe
[2010/03/02 05:41:16 | 000,000,476 | ---- | C] () -- C:\WINDOWS\tasks\Norton Security Scan for S Chung.job
[2010/03/02 04:08:56 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\NSS\0207000.034\isolate.ini
[2010/03/02 03:16:23 | 000,100,908 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\SystemLook.exe
[2010/03/02 02:52:56 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\China Essay.doc
[2010/03/01 06:21:08 | 000,000,490 | ---- | C] () -- C:\WINDOWS\tasks\Install_NSS.job
[2010/02/27 01:52:58 | 000,028,160 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\test.doc
[2010/02/26 23:06:08 | 004,121,899 | R--- | C] () -- C:\Documents and Settings\S Chung\Desktop\ComboFix.exe
[2010/02/26 19:55:08 | 000,638,548 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\GetSystemInfo_CSC2_S Chung_2010_02_27_11_54_57.zip
[2010/02/26 18:36:01 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\WhoCrashed.lnk
[2010/02/26 06:13:46 | 000,000,882 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cab6d4c3b7d16a.job
[2010/02/26 01:07:29 | 000,000,162 | -H-- | C] () -- C:\Documents and Settings\S Chung\My Documents\~$THS PROBLEMS Part 4.doc
[2010/02/26 00:47:19 | 000,085,797 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Cheetah-Anti-Rogue.cmd
[2010/02/23 06:16:57 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/02/23 06:16:57 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/02/16 04:48:20 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\WinVd32.sys
[2010/02/16 04:48:18 | 000,017,984 | ---- | C] () -- C:\WINDOWS\System32\WinFLdrv.sys
[2010/02/16 04:48:17 | 000,000,990 | -HS- | C] () -- C:\Documents and Settings\S Chung\Application Data\systemfl.$dk
[2010/02/16 01:37:31 | 000,000,067 | ---- | C] () -- C:\WINDOWS\AudioMidRecorder.INI
[2010/01/25 22:08:06 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010/01/25 00:03:25 | 000,000,532 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/12/14 23:08:59 | 000,000,355 | ---- | C] () -- C:\WINDOWS\Sonic3K.INI
[2009/12/14 03:02:54 | 000,075,600 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\ReplayMusicLog.log
[2009/11/24 05:45:51 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\rmc_rtspdl.dll
[2009/11/23 06:02:51 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009/11/09 14:17:25 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\housecall.guid.cache
[2009/10/26 06:13:43 | 000,000,068 | ---- | C] () -- C:\WINDOWS\MyProg.ini
[2009/10/24 04:07:25 | 000,298,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\yk51x86.sys
[2009/09/10 19:00:34 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2009/08/03 00:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/28 06:28:32 | 000,305,408 | ---- | C] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/07/25 05:36:54 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\fusioncache.dat
[2009/07/24 04:00:27 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/04 00:06:18 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\fusioncache.dat
[2009/05/27 05:40:54 | 000,001,814 | ---- | C] () -- C:\WINDOWS\HprSnap.INI
[2009/05/26 04:19:33 | 000,000,051 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009/05/22 08:10:40 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\ood2kmsg.dll
[2009/05/22 08:10:39 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\OODCSPRO.dll
[2008/11/11 15:59:33 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/11/05 06:58:55 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2008/10/11 17:36:19 | 000,000,022 | ---- | C] () -- C:\WINDOWS\REGPSD20.INI
[2008/10/11 17:36:11 | 000,000,037 | ---- | C] () -- C:\WINDOWS\Viewer.ini
[2008/10/11 17:36:06 | 000,000,778 | ---- | C] () -- C:\WINDOWS\PSDEWIN.INI
[2008/10/11 17:36:06 | 000,000,080 | ---- | C] () -- C:\WINDOWS\psdxport.ini
[2008/08/18 16:07:05 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/03 02:38:01 | 000,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/07/03 02:38:01 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\PnkBstrK.sys
[2008/01/28 06:05:33 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL
[2007/12/06 00:59:26 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\M Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/22 04:47:36 | 000,000,059 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\AVSDVDPlayer.m3u
[2007/09/08 02:06:57 | 000,000,745 | ---- | C] () -- C:\WINDOWS\CoD.INI
[2007/08/25 00:38:36 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\CS Chung\Application Data\AVSDVDPlayer.m3u
[2007/08/04 06:51:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2007/07/04 06:26:05 | 000,164,864 | ---- | C] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/30 00:02:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2007/06/27 02:11:04 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/06/18 05:09:05 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/06/15 05:12:31 | 000,087,808 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2007/06/15 04:01:19 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS7M.DLL
[2007/06/14 06:28:12 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004/11/28 17:09:03 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT4.dll
[2004/11/28 17:05:56 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT3.dll
[2004/11/27 23:28:03 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT2.dll
[2004/11/27 23:11:01 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT1.dll
[2004/08/03 19:56:46 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/07/08 07:04:46 | 000,000,015 | ---- | C] () -- C:\WINDOWS\System32\caacedfedaadeca.dll

========== LOP Check ==========

[2009/05/30 20:05:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Canon
[2008/06/29 01:45:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\CD-LabelPrint
[2009/07/25 05:54:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Cuttermaran
[2009/01/28 02:33:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\HiYo
[2009/07/28 06:19:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Pegasys Inc
[2009/11/09 14:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\QuickScan
[2009/08/09 08:10:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\VideoReDo-TVSuite
[2009/08/05 07:04:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\VideoReDoPlus
[2009/02/28 18:28:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\HiYo
[2009/07/24 18:49:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\My Battle for Middle-earth Files
[2007/07/01 21:16:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\Sierra
[2007/11/24 06:25:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\Thunderbird
[2009/11/25 06:26:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Any Video Converter
[2010/01/29 02:54:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Auslogics
[2010/01/25 01:03:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Error Fix
[2010/01/22 19:38:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Leadertech
[2009/11/26 03:29:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Mp3tag
[2009/12/13 22:06:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\My Battle for Middle-earth(tm) II Files
[2009/11/19 05:14:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Registry Mechanic
[2010/01/25 00:03:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\ScanSoft
[2010/01/25 23:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Simply Super Software
[2009/11/19 18:15:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Ubisoft
[2010/03/05 07:42:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\uTorrent
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2010/03/01 06:21:08 | 000,000,490 | ---- | M] () -- C:\WINDOWS\Tasks\Install_NSS.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< %systemroot%\*. /mp /s >

< c:\$recycle.bin\*.* /s >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-03-07 06:57:23

< MD5 for: AGP440.SYS >
[2004/08/04 07:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/10/24 17:20:50 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009/10/24 17:20:50 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\maxdriver\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 07:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 07:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/10/24 17:20:50 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009/10/24 17:20:50 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] () MD5=2A7506584BB54EB87CA6F1BCF1DBBE15 -- C:\WINDOWS\maxdriver\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] () MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\ComboFix\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2008/04/13 19:12:12 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\cmdcons\autochk.exe
[2008/04/13 19:12:12 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\ServicePackFiles\i386\autochk.exe
[2008/04/13 19:12:12 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\autochk.exe
[2008/04/13 19:12:12 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\system32\autochk.exe
[2004/08/04 07:00:00 | 000,588,800 | ---- | M] (Microsoft Corporation) MD5=B3415B9D6026F65E43089ABED096C38C -- C:\WINDOWS\$NtServicePackUninstall$\autochk.exe

< MD5 for: BEEP.SYS >
[2004/08/04 07:00:00 | 000,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\ERDNT\cache\beep.sys
[2004/08/04 07:00:00 | 000,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\maxdriver\beep.sys
[2004/08/04 07:00:00 | 000,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\system32\dllcache\beep.sys
[2004/08/04 07:00:00 | 000,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\system32\drivers\beep.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2004/08/04 07:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 07:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: IMM32.DLL >
[2008/04/13 19:11:54 | 000,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\ERDNT\cache\imm32.dll
[2008/04/13 19:11:54 | 000,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\ServicePackFiles\i386\imm32.dll
[2008/04/13 19:11:54 | 000,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\imm32.dll
[2008/04/13 19:11:54 | 000,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\system32\imm32.dll
[2004/08/04 07:00:00 | 000,110,080 | ---- | M] (Microsoft Corporation) MD5=87CA7CE6469577F059297B9D6556D66D -- C:\WINDOWS\$NtServicePackUninstall$\imm32.dll

< MD5 for: KERNEL32.DLL >
[2007/04/16 11:07:27 | 000,986,112 | ---- | M] (Microsoft Corporation) MD5=09F7CB3687F86EDAA4CA081F7AB66C03 -- C:\WINDOWS\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[2004/08/04 07:00:00 | 000,983,552 | ---- | M] (Microsoft Corporation) MD5=888190E31455FAD793312F8D087146EB -- C:\WINDOWS\$NtServicePackUninstall$\kernel32.dll
[2004/08/04 07:00:00 | 000,983,552 | ---- | M] (Microsoft Corporation) MD5=888190E31455FAD793312F8D087146EB -- C:\WINDOWS\$NtUninstallKB935839$\kernel32.dll
[2009/03/21 09:06:58 | 000,989,696 | ---- | M] (Microsoft Corporation) MD5=B921FB870C9AC0D509B2CCABBBBE95F3 -- C:\WINDOWS\ERDNT\cache\kernel32.dll
[2009/03/21 09:06:58 | 000,989,696 | ---- | M] (Microsoft Corporation) MD5=B921FB870C9AC0D509B2CCABBBBE95F3 -- C:\WINDOWS\system32\dllcache\kernel32.dll
[2009/03/21 09:06:58 | 000,989,696 | ---- | M] (Microsoft Corporation) MD5=B921FB870C9AC0D509B2CCABBBBE95F3 -- C:\WINDOWS\system32\kernel32.dll
[2008/04/13 19:11:56 | 000,989,696 | ---- | M] (Microsoft Corporation) MD5=C24B983D211C34DA8FCC1AC38477971D -- C:\WINDOWS\$NtUninstallKB959426$\kernel32.dll
[2008/04/13 19:11:56 | 000,989,696 | ---- | M] (Microsoft Corporation) MD5=C24B983D211C34DA8FCC1AC38477971D -- C:\WINDOWS\ServicePackFiles\i386\kernel32.dll
[2008/04/13 19:11:56 | 000,989,696 | ---- | M] (Microsoft Corporation) MD5=C24B983D211C34DA8FCC1AC38477971D -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\kernel32.dll
[2009/03/21 08:59:23 | 000,991,744 | ---- | M] (Microsoft Corporation) MD5=DA11D9D6ECBDF0F93436A4B7C13F7BEC -- C:\WINDOWS\$hf_mig$\KB959426\SP3QFE\kernel32.dll

< MD5 for: LOGEVENT.DLL >
[2008/04/13 19:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\logevent.dll

< MD5 for: MSWSOCK.DLL >
[2008/06/20 12:36:11 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=1DFCA7713EA5A70D5D93B436AEA0317A -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
[2004/08/04 07:00:00 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=4E74AF063C3271FBEA20DD940CFD1184 -- C:\WINDOWS\$NtServicePackUninstall$\mswsock.dll
[2004/08/04 07:00:00 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=4E74AF063C3271FBEA20DD940CFD1184 -- C:\WINDOWS\$NtUninstallKB951748_0$\mswsock.dll
[2008/06/20 12:46:57 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
[2008/06/20 12:46:57 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\ERDNT\cache\mswsock.dll
[2008/06/20 12:46:57 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\system32\dllcache\mswsock.dll
[2008/06/20 12:46:57 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\system32\mswsock.dll
[2008/04/13 19:12:01 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
[2008/04/13 19:12:01 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\ServicePackFiles\i386\mswsock.dll
[2008/04/13 19:12:01 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\mswsock.dll
[2008/06/20 12:43:05 | 000,245,248 | ---- | M] (Microsoft Corporation) MD5=FCEE5FCB99F7C724593365C706D28388 -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll

< MD5 for: NDIS.SYS >
[2008/04/13 14:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ERDNT\cache\ndis.sys
[2008/04/13 14:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\maxdriver\ndis.sys
[2008/04/13 14:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008/04/13 14:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\ndis.sys
[2008/04/13 14:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2004/08/04 07:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NTFS.SYS >
[2007/02/09 06:23:36 | 000,574,976 | ---- | M] (Microsoft Corporation) MD5=05AB81909514BFD69CBB1F2C147CF6B9 -- C:\WINDOWS\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[2008/04/13 14:15:53 | 000,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\ERDNT\cache\ntfs.sys
[2008/04/13 14:15:53 | 000,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\maxdriver\ntfs.sys
[2008/04/13 14:15:53 | 000,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\ServicePackFiles\i386\ntfs.sys
[2008/04/13 14:15:53 | 000,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\ntfs.sys
[2008/04/13 14:15:53 | 000,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\system32\drivers\ntfs.sys
[2004/08/03 07:15:10 | 000,574,592 | ---- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD -- C:\cmdcons\NTFS.SYS
[2004/08/04 07:00:00 | 000,574,592 | ---- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD -- C:\WINDOWS\$NtServicePackUninstall$\ntfs.sys
[2004/08/04 07:00:00 | 000,574,592 | ---- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD -- C:\WINDOWS\$NtUninstallKB930916$\ntfs.sys

< MD5 for: NTMSSVC.DLL >
[2008/04/13 19:12:02 | 000,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\ERDNT\cache\ntmssvc.dll
[2008/04/13 19:12:02 | 000,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\ServicePackFiles\i386\ntmssvc.dll
[2008/04/13 19:12:02 | 000,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\ntmssvc.dll
[2008/04/13 19:12:02 | 000,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\system32\ntmssvc.dll
[2004/08/04 07:00:00 | 000,435,200 | ---- | M] (Microsoft Corporation) MD5=B62F29C00AC55A761B2E45877D85EA0F -- C:\WINDOWS\$NtServicePackUninstall$\ntmssvc.dll

< MD5 for: PROQUOTA.EXE >
[2004/08/04 07:00:00 | 000,050,176 | ---- | M] (Microsoft Corporation) MD5=4D9D45A4370E0C2AD00C362B7118E2A4 -- C:\WINDOWS\$NtServicePackUninstall$\proquota.exe
[2008/04/13 19:12:32 | 000,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\ServicePackFiles\i386\proquota.exe
[2008/04/13 19:12:32 | 000,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\proquota.exe
[2008/04/13 19:12:32 | 000,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\system32\proquota.exe

< MD5 for: QMGR.DLL >
[2004/08/04 07:00:00 | 000,382,464 | ---- | M] (Microsoft Corporation) MD5=2C69EC7E5A311334D10DD95F338FCCEA -- C:\WINDOWS\$NtServicePackUninstall$\qmgr.dll
[2008/04/13 19:12:03 | 000,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\ERDNT\cache\qmgr.dll
[2008/04/13 19:12:03 | 000,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\ServicePackFiles\i386\qmgr.dll
[2008/04/13 19:12:03 | 000,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\qmgr.dll
[2008/04/13 19:12:03 | 000,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\system32\bits\qmgr.dll
[2008/04/13 19:12:03 | 000,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\system32\qmgr.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 07:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SFCFILES.DLL >
[2004/08/04 07:00:00 | 001,580,544 | ---- | M] (Microsoft Corporation) MD5=30A609E00BD1D4FFC49D6B5A432BE7F2 -- C:\WINDOWS\$NtServicePackUninstall$\sfcfiles.dll
[2008/04/13 19:12:05 | 001,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\ERDNT\cache\sfcfiles.dll
[2008/04/13 19:12:05 | 001,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\ServicePackFiles\i386\sfcfiles.dll
[2008/04/13 19:12:05 | 001,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\sfcfiles.dll
[2008/04/13 19:12:05 | 001,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\system32\sfcfiles.dll

< MD5 for: SPOOLSV.EXE >
[2004/08/04 07:00:00 | 000,057,856 | ---- | M] (Microsoft Corporation) MD5=7435B108B935E42EA92CA94F59C8E717 -- C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
[2004/08/04 07:00:00 | 000,057,856 | ---- | M] (Microsoft Corporation) MD5=7435B108B935E42EA92CA94F59C8E717 -- C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
[2005/06/10 19:17:13 | 000,057,856 | ---- | M] (Microsoft Corporation) MD5=AD3D9D191AEA7B5445FE1D82FFBB4788 -- C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[2008/04/13 19:12:36 | 000,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\ERDNT\cache\spoolsv.exe
[2008/04/13 19:12:36 | 000,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
[2008/04/13 19:12:36 | 000,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\spoolsv.exe
[2008/04/13 19:12:36 | 000,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\system32\spoolsv.exe

< MD5 for: SRSVC.DLL >
[2008/04/13 19:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\ERDNT\cache\srsvc.dll
[2008/04/13 19:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\ServicePackFiles\i386\srsvc.dll
[2008/04/13 19:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\srsvc.dll
[2008/04/13 19:12:07 | 000,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\system32\srsvc.dll
[2004/08/04 07:00:00 | 000,170,496 | ---- | M] (Microsoft Corporation) MD5=92BDF74F12D6CBEC43C94D4B7F804838 -- C:\WINDOWS\$NtServicePackUninstall$\srsvc.dll

< MD5 for: SVCHOST.EXE >
[2008/04/13 19:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 19:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 19:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\svchost.exe
[2008/04/13 19:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2004/08/04 07:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TERMSRV.DLL >
[2004/08/04 07:00:00 | 000,295,424 | ---- | M] (Microsoft Corporation) MD5=B60C877D16D9C880B952FDA04ADF16E6 -- C:\WINDOWS\$NtServicePackUninstall$\termsrv.dll
[2008/04/13 19:12:07 | 000,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\ERDNT\cache\termsrv.dll
[2008/04/13 19:12:07 | 000,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\ServicePackFiles\i386\termsrv.dll
[2008/04/13 19:12:07 | 000,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\termsrv.dll
[2008/04/13 19:12:07 | 000,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\system32\termsrv.dll

< MD5 for: USERINIT.EXE >
[2004/08/04 07:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WS2_32.DLL >
[2008/04/13 19:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\ERDNT\cache\ws2_32.dll
[2008/04/13 19:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008/04/13 19:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\ws2_32.dll
[2008/04/13 19:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[2004/08/04 07:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll

< MD5 for: XMLPROV.DLL >
[2008/04/13 19:12:11 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\ERDNT\cache\xmlprov.dll
[2008/04/13 19:12:11 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\ServicePackFiles\i386\xmlprov.dll
[2008/04/13 19:12:11 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\xmlprov.dll
[2008/04/13 19:12:11 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\system32\xmlprov.dll
[2004/08/04 07:00:00 | 000,129,536 | ---- | M] (Microsoft Corporation) MD5=EEF46DAB68229A14DA3D8E73C99E2959 -- C:\WINDOWS\$NtServicePackUninstall$\xmlprov.dll

< %systemroot%\system32\*.dll /lockedfiles >
[2008/06/20 12:46:57 | 000,147,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll
[2009/12/21 14:14:02 | 011,070,464 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll
[2009/12/21 14:14:03 | 001,985,536 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll
[2008/04/13 19:12:00 | 000,274,944 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll
[2008/04/13 19:12:02 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll
[2008/06/17 14:02:19 | 008,461,312 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll
[9 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >
< End of report >

Dr Jay · « **Reply #51 on:** March 11, 2010, 07:04:48 PM »

Please run OTLPE.

Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:files
C:\WINDOWS\system32\eventlog.dll|C:\WINDOWS\ServicePackFiles\i386\eventlog.dll /replace
Return to OTLPE, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
Click the red Run Fix button.
A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTLPE

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Kerjifire · « **Reply #52 on:** March 12, 2010, 01:02:41 AM »

========== FILES ==========
File C:\WINDOWS\system32\eventlog.dll successfully replaced with C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

OTLPE by OldTimer - Version 3.1.35.0 log created on 03122010_162834

When will my PC be able to boot from XP again?

Dr Jay · « **Reply #53 on:** March 12, 2010, 07:25:52 AM »

Did you try it? Try it real quick.

Kerjifire · « **Reply #54 on:** March 12, 2010, 03:03:02 PM »

When it gets to here..... the computer restarts.

[Saving space, attachment deleted by admin]

Dr Jay · « **Reply #55 on:** March 12, 2010, 07:15:16 PM »

Oh ok.

Open OTLPE, place the following in and hit quick scan:

/md5start
userinit.exe
netlogon.dll
/md5stop

Post the log.

Kerjifire · « **Reply #56 on:** March 12, 2010, 10:48:37 PM »

OTL logfile created on: 3/13/2010 4:17:23 PM - Run
OTLPE by OldTimer - Version 3.1.35.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 64.74 Gb Total Space | 15.67 Gb Free Space | 24.21% Space Free | Partition Type: NTFS
Drive D: | 39.06 Gb Total Space | 20.66 Gb Free Space | 52.89% Space Free | Partition Type: NTFS
Drive E: | 45.25 Gb Total Space | 11.29 Gb Free Space | 24.94% Space Free | Partition Type: NTFS
Drive F: | 39.06 Gb Total Space | 4.55 Gb Free Space | 11.65% Space Free | Partition Type: NTFS
Drive G: | 199.73 Gb Total Space | 135.39 Gb Free Space | 67.79% Space Free | Partition Type: NTFS
Drive H: | 296.53 Gb Total Space | 13.07 Gb Free Space | 4.41% Space Free | Partition Type: NTFS
Drive I: | 329.06 Gb Total Space | 214.31 Gb Free Space | 65.13% Space Free | Partition Type: NTFS
Drive J: | 3.75 Gb Total Space | 1.63 Gb Free Space | 43.45% Space Free | Partition Type: FAT32
Drive X: | 276.79 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (ssrcc)
SRV - File not found [Auto] -- -- (msrvc)
SRV - File not found [Auto] -- -- (DNTVSchedulerPro)
SRV - [2010/02/19 03:31:44 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [Auto] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/07 00:07:10 | 000,236,368 | ---- | M] (Malwarebytes Corporation) [Auto] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2009/11/09 18:28:08 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009/11/05 22:29:22 | 001,141,712 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009/10/29 19:18:16 | 000,359,624 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2009/07/19 20:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/05/18 20:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009/02/15 09:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2001/04/05 22:57:46 | 000,238,080 | ---- | M] (O&O Software GmbH) [Auto] -- C:\WINDOWS\System32\OOD2000.exe -- (OOD2000)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Search,Local Page = http://www.Google.com/
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Local Page Restore =

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\CS_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\Guest_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\M_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
IE - HKU\M_Chung_ON_C\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - Reg Error: Key error. File not found
IE - HKU\M_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ninemsn.com.au/?ocid=iehp
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKU\S_Chung_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP =
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
IE - HKU\S_Chung_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8080

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/10/14 06:33:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/21 02:47:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/21 02:47:09 | 000,000,000 | ---D | M]

[2010/03/06 06:04:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/06/08 06:29:36 | 000,239,432 | ---- | M] (Pando Networks) -- C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2010/02/04 03:21:29 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\CS_Chung_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\CS_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\Guest_ON_C\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKU\M_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\M_Chung_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\S_Chung_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S_Chung_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [DNTVSchedulerProTray Icon] C:\Program Files\DNTV Scheduler Pro\DNTVSchedulerProTray.exe (Renura Enterprises Pty Ltd)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [OpwareSE2] C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S_Chung_ON_C..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O4 - HKU\S_Chung_ON_C..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\CS_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Guest_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\M_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S_Chung_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1256421470390 (WUWebControl Class)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab (CBreakshotControl Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/06 08:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005/04/06 08:15:00 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/03/09 22:27:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\My Documents\8R
[2010/03/07 05:14:08 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/07 05:14:08 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/07 05:14:08 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/07 05:14:08 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/07 05:13:55 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010/03/07 04:39:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/03/06 23:37:55 | 000,155,648 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Oemdspif.dll
[2010/03/06 23:37:54 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ati2edxx.dll
[2010/03/06 23:37:53 | 000,208,896 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atipdlxx.dll
[2010/03/06 23:37:53 | 000,026,112 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Ati2mdxx.exe
[2010/03/06 23:37:53 | 000,024,064 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ativcoxx.dll
[2010/03/06 23:37:16 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2010/03/06 23:37:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2010/03/06 23:36:29 | 000,000,000 | ---D | C] -- C:\ATI
[2010/03/06 23:17:13 | 000,000,000 | ---D | C] -- C:\Program Files\Phyxion.net
[2010/03/05 23:41:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\maxdriver
[2010/03/05 18:03:07 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Cookies
[2010/03/04 02:39:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\Application Data\mIRC
[2010/03/03 05:04:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\S Chung\My Documents\8R Buttons
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NSS
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Scan
[2010/03/02 04:08:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NSS\0207000.034
[2010/03/02 04:08:51 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/03/02 03:08:38 | 000,000,000 | ---D | C] -- C:\_OTS
[2010/03/02 02:57:18 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/02/28 03:43:11 | 000,632,832 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\S Chung\Desktop\OTS.exe
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\Documents and Settings\M Chung\My Documents\*.tmp files -> C:\Documents and Settings\M Chung\My Documents\*.tmp -> ]
[32 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\Documents and Settings\S Chung\My Documents\*.tmp files -> C:\Documents and Settings\S Chung\My Documents\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/03/12 16:28:51 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/03/07 05:43:08 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
[2010/03/07 05:43:08 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT
[2010/03/07 05:43:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/07 05:43:00 | 009,437,184 | ---- | M] () -- C:\Documents and Settings\S Chung\NTUSER.DAT
[2010/03/07 05:42:58 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\S Chung\ntuser.ini
[2010/03/07 05:31:10 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/07 05:30:24 | 000,350,192 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010/03/07 05:30:13 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/07 05:29:55 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/07 05:29:26 | 2147,012,608 | -HS- | M] () -- C:\hiberfil.sys
[2010/03/07 05:29:25 | 2145,386,496 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2010/03/07 05:00:18 | 004,121,899 | R--- | M] () -- C:\Documents and Settings\S Chung\Desktop\ComboFix.exe
[2010/03/07 04:14:37 | 000,051,200 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\maths PROBLEMS Part 4.doc
[2010/03/06 23:13:09 | 000,000,051 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/03/06 22:21:40 | 000,000,508 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\Combat Arms.lnk
[2010/03/06 00:52:28 | 003,932,160 | ---- | M] () -- C:\Documents and Settings\CS Chung\ntuser.dat.rmbak
[2010/03/06 00:52:28 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.rmbak
[2010/03/06 00:51:45 | 009,699,328 | ---- | M] () -- C:\Documents and Settings\S Chung\ntuser.dat.rmbak
[2010/03/06 00:51:17 | 003,731,456 | ---- | M] () -- C:\Documents and Settings\M Chung\NTUSER.DAT
[2010/03/06 00:51:17 | 000,774,144 | ---- | M] () -- C:\Documents and Settings\Guest\NTUSER.DAT
[2010/03/06 00:51:17 | 000,462,848 | ---- | M] () -- C:\Documents and Settings\Administrator\s-1-5-21-1935655697-688789844-1801674531-500.rrr
[2010/03/06 00:51:15 | 003,702,784 | ---- | M] () -- C:\Documents and Settings\CS Chung\NTUSER.DAT
[2010/03/06 00:50:53 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\s-1-5-19.rrr
[2010/03/05 20:13:49 | 000,007,410 | ---- | M] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100306_121346.reg
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 18:00:06 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\CS Chung\ntuser.ini
[2010/03/05 17:59:52 | 000,000,082 | ---- | M] () -- C:\WINDOWS\SuperUtil.ini
[2010/03/05 17:59:22 | 000,443,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/05 17:59:22 | 000,071,846 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/05 05:40:27 | 000,164,864 | ---- | M] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/04 05:33:46 | 000,038,197 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex1.swf
[2010/03/04 05:11:47 | 000,086,038 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex.swf
[2010/03/04 03:08:51 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/03/04 03:05:24 | 000,060,056 | ---- | M] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100304_190440.reg
[2010/03/04 00:40:52 | 001,138,992 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\maxlook.exe
[2010/03/03 03:56:21 | 000,172,335 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\avatar_1218.gif
[2010/03/03 00:41:40 | 000,047,616 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\Win32kDiag.exe
[2010/03/02 07:24:28 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\China Essay.doc
[2010/03/02 05:45:59 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/03/02 05:45:28 | 007,520,288 | ---- | M] () -- C:\Documents and Settings\S Chung\My Documents\SUPERAntiSpyware.exe
[2010/03/02 05:41:16 | 000,000,476 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for S Chung.job
[2010/03/02 04:08:56 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\NSS\0207000.034\isolate.ini
[2010/03/02 03:16:23 | 000,100,908 | ---- | M] () -- C:\Documents and Settings\S Chung\Desktop\SystemLook.exe
[2010/03/01 06:21:08 | 000,000,490 | ---- | M] () -- C:\WINDOWS\tasks\Install_NSS.job
[2010/02/28 03:43:15 | 000,632,832 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\S Chung\Desktop\OTS.exe
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\Documents and Settings\M Chung\My Documents\*.tmp files -> C:\Documents and Settings\M Chung\My Documents\*.tmp -> ]
[32 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\Documents and Settings\S Chung\My Documents\*.tmp files -> C:\Documents and Settings\S Chung\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/07 05:14:08 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/07 05:14:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/07 05:14:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/07 05:14:08 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/07 05:14:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/06 23:44:18 | 2147,012,608 | -HS- | C] () -- C:\hiberfil.sys
[2010/03/06 23:37:55 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/03/06 23:37:54 | 000,455,520 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/03/06 23:37:53 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2010/03/06 23:37:53 | 000,198,341 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/03/06 23:37:53 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2010/03/06 23:37:53 | 000,031,240 | ---- | C] () -- C:\WINDOWS\System32\atiapfxx.blb
[2010/03/06 23:37:53 | 000,020,274 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2010/03/06 23:37:53 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/03/06 06:43:07 | 000,000,508 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Combat Arms.lnk
[2010/03/05 20:13:47 | 000,007,410 | ---- | C] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100306_121346.reg
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 17:45:39 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 06:47:19 | 000,000,082 | ---- | C] () -- C:\WINDOWS\SuperUtil.ini
[2010/03/04 05:33:46 | 000,038,197 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex1.swf
[2010/03/04 05:11:47 | 000,086,038 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\flashvortex.swf
[2010/03/04 03:04:41 | 000,060,056 | ---- | C] () -- C:\Documents and Settings\CS Chung\My Documents\cc_20100304_190440.reg
[2010/03/04 00:40:51 | 001,138,992 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\maxlook.exe
[2010/03/03 03:56:20 | 000,172,335 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\avatar_1218.gif
[2010/03/03 00:41:39 | 000,047,616 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\Win32kDiag.exe
[2010/03/02 05:45:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/03/02 05:45:24 | 007,520,288 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\SUPERAntiSpyware.exe
[2010/03/02 05:41:16 | 000,000,476 | ---- | C] () -- C:\WINDOWS\tasks\Norton Security Scan for S Chung.job
[2010/03/02 04:08:56 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\NSS\0207000.034\isolate.ini
[2010/03/02 03:16:23 | 000,100,908 | ---- | C] () -- C:\Documents and Settings\S Chung\Desktop\SystemLook.exe
[2010/03/02 02:52:56 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\S Chung\My Documents\China Essay.doc
[2010/03/01 06:21:08 | 000,000,490 | ---- | C] () -- C:\WINDOWS\tasks\Install_NSS.job
[2010/02/23 06:16:57 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/02/23 06:16:57 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/02/16 04:48:20 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\WinVd32.sys
[2010/02/16 04:48:18 | 000,017,984 | ---- | C] () -- C:\WINDOWS\System32\WinFLdrv.sys
[2010/02/16 04:48:17 | 000,000,990 | -HS- | C] () -- C:\Documents and Settings\S Chung\Application Data\systemfl.$dk
[2010/02/16 01:37:31 | 000,000,067 | ---- | C] () -- C:\WINDOWS\AudioMidRecorder.INI
[2010/01/25 22:08:06 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2010/01/25 00:03:25 | 000,000,532 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/12/14 23:08:59 | 000,000,355 | ---- | C] () -- C:\WINDOWS\Sonic3K.INI
[2009/12/14 03:02:54 | 000,075,600 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\ReplayMusicLog.log
[2009/11/24 05:45:51 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\rmc_rtspdl.dll
[2009/11/23 06:02:51 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009/11/09 14:17:25 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\housecall.guid.cache
[2009/10/26 06:13:43 | 000,000,068 | ---- | C] () -- C:\WINDOWS\MyProg.ini
[2009/10/24 04:07:25 | 000,298,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\yk51x86.sys
[2009/09/10 19:00:34 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2009/08/03 00:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/28 06:28:32 | 000,305,408 | ---- | C] () -- C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/07/25 05:36:54 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\fusioncache.dat
[2009/07/24 04:00:27 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/04 00:06:18 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\fusioncache.dat
[2009/05/27 05:40:54 | 000,001,814 | ---- | C] () -- C:\WINDOWS\HprSnap.INI
[2009/05/26 04:19:33 | 000,000,051 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009/05/22 08:10:40 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\ood2kmsg.dll
[2009/05/22 08:10:39 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\OODCSPRO.dll
[2008/11/11 15:59:33 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/11/05 06:58:55 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2008/10/11 17:36:19 | 000,000,022 | ---- | C] () -- C:\WINDOWS\REGPSD20.INI
[2008/10/11 17:36:11 | 000,000,037 | ---- | C] () -- C:\WINDOWS\Viewer.ini
[2008/10/11 17:36:06 | 000,000,778 | ---- | C] () -- C:\WINDOWS\PSDEWIN.INI
[2008/10/11 17:36:06 | 000,000,080 | ---- | C] () -- C:\WINDOWS\psdxport.ini
[2008/08/18 16:07:05 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\CS Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/03 02:38:01 | 000,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/07/03 02:38:01 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\PnkBstrK.sys
[2008/01/28 06:05:33 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL
[2007/12/06 00:59:26 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\M Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/22 04:47:36 | 000,000,059 | ---- | C] () -- C:\Documents and Settings\S Chung\Application Data\AVSDVDPlayer.m3u
[2007/09/08 02:06:57 | 000,000,745 | ---- | C] () -- C:\WINDOWS\CoD.INI
[2007/08/25 00:38:36 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\CS Chung\Application Data\AVSDVDPlayer.m3u
[2007/08/04 06:51:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2007/07/04 06:26:05 | 000,164,864 | ---- | C] () -- C:\Documents and Settings\S Chung\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/30 00:02:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2007/06/27 02:11:04 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/06/18 05:09:05 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/06/15 05:12:31 | 000,087,808 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2007/06/15 04:01:19 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS7M.DLL
[2007/06/14 06:28:12 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004/11/28 17:09:03 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT4.dll
[2004/11/28 17:05:56 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT3.dll
[2004/11/27 23:28:03 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT2.dll
[2004/11/27 23:11:01 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\DNT1.dll
[2004/08/03 19:56:46 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/07/08 07:04:46 | 000,000,015 | ---- | C] () -- C:\WINDOWS\System32\caacedfedaadeca.dll

========== LOP Check ==========

[2009/05/30 20:05:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Canon
[2008/06/29 01:45:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\CD-LabelPrint
[2009/07/25 05:54:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Cuttermaran
[2009/01/28 02:33:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\HiYo
[2009/07/28 06:19:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\Pegasys Inc
[2009/11/09 14:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\QuickScan
[2009/08/09 08:10:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\VideoReDo-TVSuite
[2009/08/05 07:04:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\CS Chung\Application Data\VideoReDoPlus
[2009/02/28 18:28:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\HiYo
[2009/07/24 18:49:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\My Battle for Middle-earth Files
[2007/07/01 21:16:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\Sierra
[2007/11/24 06:25:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\M Chung\Application Data\Thunderbird
[2009/11/25 06:26:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Any Video Converter
[2010/01/29 02:54:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Auslogics
[2010/01/25 01:03:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Error Fix
[2010/01/22 19:38:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Leadertech
[2009/11/26 03:29:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Mp3tag
[2009/12/13 22:06:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\My Battle for Middle-earth(tm) II Files
[2009/11/19 05:14:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Registry Mechanic
[2010/01/25 00:03:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\ScanSoft
[2010/01/25 23:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Simply Super Software
[2009/11/19 18:15:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\Ubisoft
[2010/03/05 07:42:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\S Chung\Application Data\uTorrent
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2010/03/05 18:57:28 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2010/03/01 06:21:08 | 000,000,490 | ---- | M] () -- C:\WINDOWS\Tasks\Install_NSS.job

========== Purity Check ==========

========== Custom Scans ==========

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: USERINIT.EXE >
[2004/08/04 07:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
< End of report >

Kerjifire · « **Reply #57 on:** March 14, 2010, 05:03:50 AM »

Can u sorta hurry up a bit.... All i wanted is to remove the redirect problem and instead I get a PC which can't even load XP anymore...

I would've prefered a PC which actually works but has a virus over one which doesn't. So I don't care if u just restore everything to what it was earlier, even if it has a rootkit. I just want my XP working.

Dr Jay · « **Reply #58 on:** March 15, 2010, 01:34:17 PM »

Umm... the rootkit shut your computer down. So, if you were not to get help like this, then your PC would have eventually not have booted anymore.

You're going to need a program called TestDisk. It's a free and open source disk recovery program.

Step 1: Download the TestDisk executable here: Download and save it to a flash drive.
Step 2: On the Reatogo desktop, extract the downloaded zip file using your favorite archive extractor.
Step 3: Double-click on the testdisk_win.exe file (found in the win folder of the extracted archive)
Step 4: You will now be at a scary looking text-based command window:

Press Enter here to create a new log file.

Step 5: TestDisk will now detect all local hard drives, and present them in a list like this:

You have indicated that there is only one hard drive attached to your computer, with two partitions. So, use the arrow (up and down) keys to highlight the disk called /dev/sda.

Note: If /dev/sda isn't listed or you have more than one hard drive, STOP and post back here.

With /dev/sda selected, press Enter

Step 6: Now we need to specify the type of partitions that are on your disk. Select Intel (even if you have an AMD processor).

Press Enter.

Step 7: Select Analyse and press Enter.

Quit TestDisk by pressing Q. Post me the testdisk log please (it can be found in the win folder).

Kerjifire · « **Reply #59 on:** March 15, 2010, 11:17:23 PM »

======== EDIT ========

Don't worry about this. I don't know how to delete this post.

Computer Hope Forum

News:

Author Topic: Google Redirect (Read 48635 times)

Dr Jay

Re: Google Redirect

Kerjifire

Re: Google Redirect

Kerjifire

Re: Google Redirect

Dr Jay

Re: Google Redirect

Kerjifire

Re: Google Redirect

Kerjifire

Re: Google Redirect

Dr Jay

Re: Google Redirect

Kerjifire

Re: Google Redirect

Dr Jay

Re: Google Redirect

Kerjifire

Re: Google Redirect

Dr Jay

Re: Google Redirect

Kerjifire

Re: Google Redirect

Kerjifire

Re: Google Redirect

Dr Jay

Re: Google Redirect

Kerjifire

Re: Google Redirect