Trojan - didn't go after running superantispyware , malaware bytes

Suba · April 10, 2011

Trojan - didn't go after running superantispyware , malaware bytes , Spybot search and destroy ,ad aware . I don't know any other option to try .

My Nephews have downloaded this virus by visiting some games websites. Initially , I was not able to access any browsers including IE in the beginning . So i had to do system restore in the safe mode . Then i was able to download Ad aware , superantispyware . I run all the application in both safe mode , normal mode . But still the virus doesn't seems to go .

Virus name : Fake Microsoft security essential .

How ever the warning message that i was getting went away . But still i am unable to use any web browsers besides IE . When i do Google search on IE and click on some link , it re-directs me to some other spam websites . I really need some help in fixing this virus ...as i don't want to format my system. Appreciate your help . Thanks .

rise · April 10, 2011

Hi

Download OTL from here: http://oldtimer.geekstogo.com/OTL.exe to your Dekstop.

Double click on the icon to run it select All users then under the Custom/scans fixes copy/paste the following:

netsvcs

drivers32

%SYSTEMDRIVE%\*.*

%systemroot%\Fonts\*.com

%systemroot%\Fonts\*.dll

%systemroot%\Fonts\*.ini

%systemroot%\Fonts\*.ini2

%systemroot%\Fonts\*.exe

%systemroot%\system32\spool\prtprocs\w32x86\*.*

%systemroot%\REPAIR\*.bak1

%systemroot%\REPAIR\*.ini

%systemroot%\system32\*.jpg

%systemroot%\*.jpg

%systemroot%\*.png

%systemroot%\*.scr

%systemroot%\*._sy

%APPDATA%\Adobe\Update\*.*

%ALLUSERSPROFILE%\Favorites\*.*

%APPDATA%\Microsoft\*.*

%PROGRAMFILES%\*.*

%APPDATA%\Update\*.*

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\System32\config\*.sav

%PROGRAMFILES%\bak. /s

%systemroot%\system32\bak. /s

%ALLUSERSPROFILE%\Start Menu\*.lnk /x

%systemroot%\system32\config\systemprofile\*.dat /x

%systemroot%\*.config

%systemroot%\system32\*.db

%PROGRAMFILES%\Internet Explorer\*.dat

%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x

%USERPROFILE%\Desktop\*.exe

%PROGRAMFILES%\Common Files\*.*

%systemroot%\*.src

%systemroot%\install\*.*

%systemroot%\system32\DLL\*.*

%systemroot%\system32\HelpFiles\*.*

%systemroot%\system32\rundll\*.*

%systemroot%\winn32\*.*

%systemroot%\Java\*.*

%systemroot%\system32\test\*.*

%systemroot%\system32\Rundll32\*.*

%systemroot%\AppPatch\Custom\*.*

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Now click Quick scan.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.

Post both logs in your reply.

Suba · April 10, 2011

OTL file :-

OTL logfile created on: 4/10/2011 3:00:20 PM - Run 1

OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\sunikar\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 93.00 Mb Available Physical Memory | 9.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 58.00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 62.48 Gb Total Space | 1.62 Gb Free Space | 2.59% Space Free | Partition Type: NTFS

Drive D: | 10.00 Gb Total Space | 9.36 Gb Free Space | 93.60% Space Free | Partition Type: NTFS

Computer Name: SUNISHKAR | User Name: sunikar | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/10 14:56:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sunikar\Desktop\OTL.exe

PRC - [2011/04/07 00:58:47 | 001,192,240 | ---- | M] (Lavasoft Limited) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

PRC - [2011/04/07 00:58:39 | 001,753,048 | ---- | M] (Lavasoft Limited) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

PRC - [2011/01/25 18:42:10 | 000,083,440 | ---- | M] (Google) -- C:\Documents and Settings\sunikar\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe

PRC - [2010/11/23 19:21:18 | 000,130,000 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Safe Web Lite\Engine\1.2.0.7\ccSvcHst.exe

PRC - [2010/10/27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

PRC - [2010/10/19 12:27:33 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Documents and Settings\sunikar\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe

PRC - [2010/08/25 11:27:44 | 000,309,824 | -H-- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

PRC - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

PRC - [2010/04/16 11:25:18 | 000,818,288 | ---- | M] (The Weather Channel Interactive, Inc.) -- C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe

PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

PRC - [2010/03/12 11:54:41 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe

PRC - [2010/01/21 17:27:44 | 009,136,960 | ---- | M] (Western Digital) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe

PRC - [2010/01/21 17:27:42 | 002,057,536 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe

PRC - [2010/01/21 17:24:08 | 000,110,592 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

PRC - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2008/05/27 19:35:30 | 000,040,960 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe

PRC - [2008/04/24 11:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

PRC - [2008/04/24 11:25:22 | 000,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe

PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/10/08 15:18:04 | 000,995,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe

PRC - [2007/10/08 15:15:50 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe

PRC - [2007/10/08 15:13:36 | 001,101,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe

PRC - [2007/10/08 15:09:26 | 000,659,456 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

PRC - [2007/05/10 11:23:50 | 000,094,208 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe

PRC - [2007/02/13 11:42:50 | 000,109,344 | ---- | M] (Logitech Inc.) -- c:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

PRC - [2007/01/01 14:22:02 | 003,739,648 | ---- | M] (Google) -- C:\Program Files\Google\Google Talk\googletalk.exe

PRC - [2005/09/08 11:06:20 | 000,094,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

PRC - [2003/05/29 19:18:42 | 000,380,928 | ---- | M] () -- C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe

PRC - [1999/02/28 02:32:52 | 000,124,200 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mdm.exe

========== Modules (SafeList) ==========

MOD - [2011/04/10 14:56:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sunikar\Desktop\OTL.exe

MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

MOD - [2007/04/19 12:21:40 | 000,116,264 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprthook.dll

MOD - [2007/02/13 11:42:38 | 000,092,960 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcInj.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)

SRV - [2011/04/07 00:58:39 | 001,753,048 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2010/11/23 19:21:18 | 000,130,000 | R--- | M] (Symantec Corporation) [unknown | Running] -- C:\Program Files\Norton Safe Web Lite\Engine\1.2.0.7\ccSvcHst.exe -- (NSL)

SRV - [2010/08/23 21:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)

SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2010/01/21 17:24:08 | 000,110,592 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)

SRV - [2009/12/17 15:37:00 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®

SRV - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe -- (WDSmartWareBackgroundService)

SRV - [2009/03/18 11:54:08 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [Disabled | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)

SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2008/04/24 11:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -- (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2)

SRV - [2007/10/08 15:15:50 | 000,356,352 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel®

SRV - [2007/05/10 11:23:50 | 000,094,208 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe -- (STacSV)

SRV - [2007/02/13 11:44:34 | 000,105,248 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)

SRV - [2007/02/13 11:42:50 | 000,109,344 | ---- | M] (Logitech Inc.) [Auto | Running] -- c:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)

========== Driver Services (SafeList) ==========

DRV - [2011/04/01 00:22:02 | 000,064,512 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)

DRV - [2011/04/01 00:22:01 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)

DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Documents and Settings\sunikar\Local Settings\Temp\SAS_SelfExtract\saskutil.sys -- (SASKUTIL)

DRV - [2010/04/30 15:09:44 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)

DRV - [2010/04/30 15:09:22 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)

DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Documents and Settings\sunikar\Local Settings\Temp\SAS_SelfExtract\sasdifsv.sys -- (SASDIFSV)

DRV - [2009/09/16 08:22:48 | 000,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)

DRV - [2009/09/16 08:22:48 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)

DRV - [2009/09/16 08:22:48 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)

DRV - [2009/09/16 08:22:48 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)

DRV - [2009/09/16 08:22:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)

DRV - [2009/03/30 03:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RsFx0103.sys -- (RsFx0103)

DRV - [2009/02/13 12:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)

DRV - [2007/09/26 07:01:32 | 002,236,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel®

DRV - [2007/08/27 12:10:36 | 000,012,288 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)

DRV - [2007/05/10 11:24:34 | 001,222,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)

DRV - [2007/02/13 11:42:28 | 000,025,632 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)

DRV - [2007/02/13 11:42:04 | 001,964,064 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)

DRV - [2007/02/13 11:39:54 | 001,691,808 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)

DRV - [2007/02/09 00:24:00 | 001,939,488 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) QuickCam for Dell Notebooks(UVC)

DRV - [2007/02/09 00:24:00 | 000,041,504 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)

DRV - [2007/02/09 00:24:00 | 000,022,560 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)

DRV - [2007/02/09 00:23:00 | 000,066,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvselsus.sys -- (lvselsus)

DRV - [2007/02/09 00:22:00 | 001,507,232 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvpopflt.sys -- (lvpopflt)

DRV - [2006/11/15 01:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2006/11/14 20:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2006/11/14 18:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)

DRV - [2004/05/26 16:18:18 | 000,044,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)

DRV - [2001/08/22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie

IE - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net

IE - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie

IE - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ie

IE - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

========== FireFox ==========

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/12 11:56:06 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\extensions\\{E5886C91-CDD7-4832-B32D-0830705A9C60}: C:\WINDOWS\system32\5011 [2011/03/10 20:35:53 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\extensions\\{203FB6B2-2E1E-4474-863B-4C483ECCE78E}: C:\Documents and Settings\All Users\Application Data\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_1.2.0.7\coFFNST\ [2011/04/09 15:08:50 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/22 17:28:49 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/19 10:04:21 | 000,000,000 | ---D | M]

[2009/06/10 12:41:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Extensions

[2011/02/20 18:09:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions

[2009/08/16 07:04:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011/02/20 18:09:12 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2009/03/18 17:28:08 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2009/04/13 10:51:43 | 000,000,000 | ---D | M] (XHTML Mobile Profile) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions\{8ea9957e-2953-402f-80e0-bceb5f169d6f}

[2009/12/24 20:19:56 | 000,000,000 | ---D | M] (wmlbrowser) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions\{c4dc572a-3295-40eb-b30f-b54aa4cdc4b7}

[2009/03/18 14:42:49 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}

[2009/04/13 10:51:44 | 000,000,000 | ---D | M] (EWOQ Mobile Setup extension) -- C:\Documents and Settings\sunikar\Application Data\Mozilla\Firefox\Profiles\vguevptr.default\extensions\{f035aa18-ee32-4e6e-81d2-57e32867f8a7}

[2011/02/06 00:30:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2009/09/14 06:23:13 | 000,000,000 | ---D | M] (Talkback) -- C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org

[2010/03/12 11:56:06 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT

[2009/03/26 12:19:16 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2011/03/10 20:35:53 | 000,000,000 | ---D | M] (Java String Helper) -- C:\WINDOWS\SYSTEM32\5011

[2008/12/17 14:59:30 | 000,067,688 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll

[2008/12/17 14:59:31 | 000,054,368 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll

[2008/12/17 14:59:32 | 000,034,944 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll

[2008/12/17 14:59:33 | 000,046,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll

[2008/12/17 14:59:35 | 000,172,136 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll

[2009/11/19 15:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll

[2009/11/19 15:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

Hosts file not found

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)

O2 - BHO: (Norton Safe Web Lite BHO) - {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} - C:\Program Files\Norton Safe Web Lite\Engine\1.2.0.7\CoIEPlg.dll (Symantec Corporation)

O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

O3 - HKLM\..\Toolbar: (Norton Safe Web Lite) - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files\Norton Safe Web Lite\Engine\1.2.0.7\CoIEPlg.dll (Symantec Corporation)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O3 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\..\Toolbar\WebBrowser: (Norton Safe Web Lite) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - C:\Program Files\Norton Safe Web Lite\Engine\1.2.0.7\CoIEPlg.dll (Symantec Corporation)

O3 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [ddoctorv2] C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)

O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)

O4 - HKLM..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)

O4 - HKLM..\Run: [intelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [NWEReboot] File not found

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe (Nero AG)

O4 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004..\Run: [Desktop Software] File not found

O4 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)

O4 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MA521 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PHOTOfunSTUDIO -viewer-.lnk = C:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe (Matsushita Electric Industrial Co., Ltd.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)

O15 - HKU\S-1-5-21-2025429265-963894560-1801674531-1004\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} http://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)

O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O16 - DPF: {E0FEE963-BB53-4215-81AD-B28C77384644} https://pattcw.att.motive.com/wizlet/DSLActivation/static/installer/ATTInternetInstaller.cab (WebBrowserType Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.1

O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)

O18 - Protocol\Handler\HTLFP {03B7A5D4-96B0-4316-95F8-072D326A58F1} - Reg Error: Key error. File not found

O18 - Protocol\Handler\vfsp - No CLSID value found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)

O28 - HKLM ShellExecuteHooks: {A5949E07-8536-4625-A3D0-2DD83F559990} - File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/03/18 11:57:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{ee3b5ce4-fb56-11df-a819-00188bca0ea8}\Shell - "" = AutoRun

O33 - MountPoints2\{ee3b5ce4-fb56-11df-a819-00188bca0ea8}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{ee3b5ce4-fb56-11df-a819-00188bca0ea8}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: AppMgmt - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (17746478449557504)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/10 14:56:44 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\sunikar\Desktop\OTL.exe

[2011/04/09 18:02:27 | 000,064,512 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys

[2011/04/09 18:01:05 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys

[2011/04/09 15:56:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sunikar\Application Data\SUPERAntiSpyware.com

[2011/04/09 15:56:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

[2011/04/09 15:44:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sunikar\Local Settings\Application Data\Sunbelt Software

[2011/04/09 15:37:37 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{6A395471-4AA3-4072-AE1B-9B69A97AD164}

[2011/04/09 15:35:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Lavasoft

[2011/04/09 15:35:06 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft

[2011/04/09 15:35:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft

[2011/04/09 15:08:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NST

[2011/04/09 15:08:11 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Safe Web Lite

[2011/04/09 15:08:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NST\0102000.007

[2011/04/09 11:21:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Talk

[2011/04/09 11:18:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sunikar\Application Data\Dealio

[2011/04/09 11:18:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\MySQL

[2011/04/09 11:18:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Quest Software

[2011/04/09 11:16:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\DVDVideoSoft

[2011/04/09 10:58:35 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\sunikar\Recent

[2011/04/09 08:56:01 | 000,000,000 | ---D | C] -- C:\Config.Msi

[2011/04/04 08:32:32 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011/04/01 21:57:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\bDk06504oKdKp06504

[2011/04/01 20:36:15 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center

[2011/03/28 16:15:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sunikar\Desktop\US trip

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\Documents and Settings\sunikar\My Documents\*.tmp files -> C:\Documents and Settings\sunikar\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/10 14:56:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sunikar\Desktop\OTL.exe

[2011/04/10 14:49:34 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2011/04/10 14:49:01 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2011/04/10 14:49:01 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2025429265-963894560-1801674531-1004.job

[2011/04/10 14:49:00 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2025429265-963894560-1801674531-1005.job

[2011/04/10 14:48:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/04/10 14:48:33 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs

[2011/04/10 08:27:08 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2025429265-963894560-1801674531-1004.job

[2011/04/10 00:55:45 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011/04/09 20:36:23 | 000,562,804 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011/04/09 20:36:22 | 000,110,212 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011/04/09 20:32:00 | 000,000,986 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-963894560-1801674531-1004UA.job

[2011/04/09 19:37:01 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2011/04/09 18:00:58 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys

[2011/04/09 15:37:31 | 000,000,885 | ---- | M] () -- C:\Documents and Settings\sunikar\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk

[2011/04/09 15:37:31 | 000,000,867 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk

[2011/04/09 14:39:43 | 000,000,474 | -H-- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for sunikar.job

[2011/04/09 10:12:07 | 000,000,136 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~19783476r

[2011/04/09 10:12:07 | 000,000,104 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~19783476

[2011/04/09 10:11:59 | 000,000,336 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\19783476

[2011/04/09 08:33:52 | 000,013,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\jcl665ep0rnlp562hps

[2011/04/09 08:32:54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/04/07 00:59:03 | 000,016,432 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe

[2011/04/04 22:45:28 | 000,013,404 | -HS- | M] () -- C:\Documents and Settings\sunikar\Local Settings\Application Data\jcl665ep0rnlp562hps

[2011/04/04 08:30:28 | 003,894,702 | -H-- | M] () -- C:\Documents and Settings\sunikar\Desktop\ComboFix.zip

[2011/04/03 12:32:00 | 000,000,934 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-963894560-1801674531-1004Core.job

[2011/04/01 22:33:23 | 001,228,854 | ---- | M] () -- C:\fsqwr.bmp

[2011/04/01 00:22:02 | 000,064,512 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys

[2011/03/30 13:07:37 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT

[2011/03/30 08:09:33 | 000,000,136 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~19980084

[2011/03/30 08:09:32 | 000,000,152 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~19980084r

[2011/03/30 08:09:22 | 000,000,336 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\19980084

[2011/03/28 20:42:17 | 000,011,258 | -H-- | M] () -- C:\Documents and Settings\sunikar\Desktop\images.jpg

[2011/03/24 10:22:18 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2011/03/24 06:22:54 | 000,000,678 | ---- | M] () -- C:\WINDOWS\System32\jsaddons.ini

[2011/03/24 06:03:47 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2025429265-963894560-1801674531-1005.job

[2011/03/20 18:41:38 | 000,002,393 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TurboTax 2010.lnk

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\Documents and Settings\sunikar\My Documents\*.tmp files -> C:\Documents and Settings\sunikar\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/10 01:56:12 | 000,016,432 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe

[2011/04/09 16:14:30 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2011/04/09 15:37:31 | 000,000,885 | ---- | C] () -- C:\Documents and Settings\sunikar\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk

[2011/04/09 15:37:31 | 000,000,867 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk

[2011/04/09 15:08:11 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\NST\0102000.007\isolate.ini

[2011/04/09 10:12:07 | 000,000,136 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19783476r

[2011/04/09 10:12:06 | 000,000,104 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19783476

[2011/04/09 10:11:59 | 000,000,336 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\19783476

[2011/04/04 08:58:07 | 003,894,702 | -H-- | C] () -- C:\Documents and Settings\sunikar\Desktop\ComboFix.zip

[2011/04/02 09:55:24 | 000,013,404 | -HS- | C] () -- C:\Documents and Settings\sunikar\Local Settings\Application Data\jcl665ep0rnlp562hps

[2011/04/02 09:55:24 | 000,013,294 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\jcl665ep0rnlp562hps

[2011/04/01 22:33:23 | 001,228,854 | ---- | C] () -- C:\fsqwr.bmp

[2011/03/30 08:09:32 | 000,000,152 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19980084r

[2011/03/30 08:09:32 | 000,000,136 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19980084

[2011/03/30 08:09:22 | 000,000,336 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\19980084

[2011/03/28 20:42:22 | 000,011,258 | -H-- | C] () -- C:\Documents and Settings\sunikar\Desktop\images.jpg

[2011/03/21 21:16:11 | 000,849,608 | -H-- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

[2011/03/02 11:37:54 | 000,000,277 | ---- | C] () -- C:\WINDOWS\System32\vbaddons.ini

[2011/03/02 11:16:41 | 000,000,678 | ---- | C] () -- C:\WINDOWS\System32\jsaddons.ini

[2011/03/02 11:16:19 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll

[2010/12/11 23:17:54 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2010/12/08 05:25:22 | 000,001,161 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\827008272.dat

[2010/03/07 21:53:41 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2009/11/25 15:59:32 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2009/08/06 10:16:24 | 000,000,401 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2009/07/01 06:21:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\flight4b.INI

[2009/07/01 06:19:39 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll

[2009/07/01 06:19:39 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll

[2009/06/29 17:34:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\flight4a.INI

[2009/06/29 16:24:50 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wlrun.ini

[2009/06/29 16:24:11 | 000,007,127 | ---- | C] () -- C:\WINDOWS\wrun.ini

[2009/06/29 16:17:44 | 000,000,023 | ---- | C] () -- C:\WINDOWS\AQTProductInfo.INI

[2009/06/29 15:28:55 | 000,001,370 | ---- | C] () -- C:\WINDOWS\mercury.ini

[2009/06/26 17:28:14 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat

[2009/06/26 17:28:14 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat

[2009/06/26 17:28:14 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat

[2009/06/26 17:28:14 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat

[2009/06/26 17:28:14 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat

[2009/06/26 17:28:14 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat

[2009/06/26 17:28:14 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat

[2009/06/26 17:28:14 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat

[2009/06/26 17:28:14 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat

[2009/06/26 17:28:14 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat

[2009/06/26 17:28:14 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat

[2009/06/26 17:28:14 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat

[2009/06/26 17:28:14 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat

[2009/06/26 17:28:14 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat

[2009/06/26 17:28:14 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat

[2009/06/26 17:28:14 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat

[2009/06/26 17:28:14 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat

[2009/06/26 17:28:14 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat

[2009/06/26 17:28:14 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2009/06/12 18:56:50 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009/06/06 11:14:02 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\sunikar\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/03/18 17:52:24 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI

[2009/03/18 17:52:24 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI

[2009/03/18 17:51:24 | 000,000,214 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini

[2009/03/18 17:51:24 | 000,000,093 | ---- | C] () -- C:\WINDOWS\brpcfx.ini

[2009/03/18 17:51:24 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf06a.dat

[2009/03/18 17:50:23 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll

[2009/03/18 17:50:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brdfxspd.dat

[2009/03/18 17:49:23 | 000,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini

[2009/03/18 16:54:53 | 000,000,488 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009/03/18 16:07:09 | 000,001,172 | ---- | C] () -- C:\WINDOWS\mozver.dat

[2009/03/18 13:11:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009/03/18 12:59:20 | 000,051,370 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini

[2009/03/18 12:32:58 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe

[2009/03/18 12:11:19 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4814.dll

[2009/03/18 12:04:33 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll

[2009/03/18 12:00:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009/03/18 11:55:03 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2009/03/17 21:54:30 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009/03/17 21:53:15 | 000,148,400 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2007/02/13 11:42:28 | 000,025,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys

[2007/02/13 11:39:54 | 001,691,808 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys

[2005/03/22 13:48:43 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2005/03/22 13:48:43 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004/08/04 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004/08/04 05:00:00 | 000,562,804 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004/08/04 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004/08/04 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004/08/04 05:00:00 | 000,110,212 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004/08/04 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004/08/04 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004/08/04 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004/08/04 05:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004/08/04 05:00:00 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\snngbzg.dll

[2004/08/04 05:00:00 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll

[2004/08/04 05:00:00 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll

[2004/08/04 05:00:00 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll

[2004/08/04 05:00:00 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll

[2004/08/04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2004/08/04 05:00:00 | 000,000,342 | ---- | C] () -- C:\WINDOWS\System32\g0r8jf2.dll

[2004/08/04 05:00:00 | 000,000,101 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll

[2004/08/04 05:00:00 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll

[2004/08/04 05:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\u6gfg65.dll

[2004/08/04 05:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\mfcl7iz.dll

[2004/08/04 05:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\lrue84c.dll

[2004/08/04 05:00:00 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\a9m32e5.dll

[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2002/03/04 11:16:34 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll

========== LOP Check ==========

[2009/06/04 00:32:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus

[2011/04/09 11:16:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\bDk06504oKdKp06504

[2009/03/18 11:54:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix

[2009/10/08 13:46:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MySQL

[2010/11/17 11:17:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Quest Software

[2009/03/18 17:48:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft

[2009/08/31 14:59:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft

[2010/11/28 23:10:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WD_SmartWareCommon

[2010/11/28 23:07:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital

[2011/04/09 15:37:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{6A395471-4AA3-4072-AE1B-9B69A97AD164}

[2009/10/09 13:29:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2009/09/05 10:09:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\guest1\Application Data\Panasonic

[2010/12/11 23:24:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\guest1\Application Data\Western Digital

[2011/04/10 14:49:34 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2011/04/10 14:48:43 | 000,001,286 | ---- | M] () -- C:\aaw7boot.log

[2009/03/18 11:57:56 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2009/03/28 08:54:12 | 000,000,211 | -HS- | M] () -- C:\boot.ini

[2009/03/18 17:52:16 | 000,000,025 | ---- | M] () -- C:\Brxpinst.log

[2009/03/18 11:57:56 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2011/04/01 22:33:23 | 001,228,854 | ---- | M] () -- C:\fsqwr.bmp

[2009/03/18 11:57:56 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2009/03/18 11:57:56 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2009/03/21 10:09:12 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2011/04/10 14:48:44 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys

[2010/12/11 22:06:51 | 000,047,494 | ---- | M] () -- C:\TDSSKiller.2.4.11.0_11.12.2010_21.05.46_log.txt

[2009/06/26 19:04:35 | 000,000,026 | ---- | M] () -- C:\UpdaterforApp.ini

[2009/04/12 22:27:34 | 000,001,876 | ---- | M] () -- C:\WirelessDiagLog.csv

< %systemroot%\Fonts\*.com >

[2006/04/18 13:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont

[2006/06/29 12:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont

[2006/04/18 13:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont

[2006/06/29 12:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >

[2009/03/18 11:57:35 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

[2003/06/18 18:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

[2001/11/20 15:37:28 | 000,047,616 | R--- | M] (Black Ice Software) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\ppbiPr.dll

[2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

[2010/11/17 11:10:30 | 000,000,161 | -H-- | M] () -- C:\Program Files\INSTALL.LOG

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

[2009/03/17 21:52:28 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2009/03/17 21:52:28 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2009/03/17 21:52:27 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

[2009/03/21 10:18:34 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

[2009/03/18 12:21:21 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\sunikar\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

[2009/03/18 12:21:20 | 000,000,079 | -H-- | M] () -- C:\Documents and Settings\sunikar\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

[2010/02/14 20:38:42 | 000,316,680 | ---- | M] (Dassault Systèmes) -- C:\Documents and Settings\sunikar\Desktop\3DVIA_player_installer.exe

[2009/03/18 14:35:17 | 043,083,040 | ---- | M] ( ) -- C:\Documents and Settings\sunikar\Desktop\AdbeRdr910_en_US_Std.exe

[2009/09/19 08:22:02 | 007,218,536 | ---- | M] () -- C:\Documents and Settings\sunikar\Desktop\CommunicatorPlugin_281.exe

[2009/08/18 15:16:38 | 001,606,064 | ---- | M] () -- C:\Documents and Settings\sunikar\Desktop\googletalk-setup.exe

[2009/10/15 14:08:06 | 000,570,032 | ---- | M] (Google Inc.) -- C:\Documents and Settings\sunikar\Desktop\GoogleVoiceAndVideoSetup(2).exe

[2009/03/18 14:49:44 | 059,264,920 | ---- | M] (Symantec Corporation) -- C:\Documents and Settings\sunikar\Desktop\NAV09EN.exe

[2009/07/06 14:19:47 | 155,255,392 | ---- | M] () -- C:\Documents and Settings\sunikar\Desktop\OOo_3.1.0_Win32Intel_install_wJRE_en-US.exe

[2009/10/08 10:08:01 | 216,933,372 | ---- | M] (Oracle Corporation ) -- C:\Documents and Settings\sunikar\Desktop\OracleXEUniv.exe

[2011/04/10 14:56:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sunikar\Desktop\OTL.exe

[2009/03/25 14:46:17 | 021,878,064 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\sunikar\Desktop\QuickTimeInstaller.exe

[2009/09/19 08:06:40 | 006,321,440 | ---- | M] () -- C:\Documents and Settings\sunikar\Desktop\WebUpdaterforWindows_242.exe

[2009/06/05 11:44:38 | 000,367,240 | ---- | M] (Digital River, Inc.) -- C:\Documents and Settings\sunikar\Desktop\X12-30196-DLM.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-09 20:49:27

< Update\Results\Install|LastSuccessTime /rs >

< >

< End of report >

Suba · April 10, 2011

File:- Extras.txt

OTL Extras logfile created on: 4/10/2011 3:00:20 PM - Run 1