Click.GiftLoad Removal Help!

**soul4soul** · 2011-04-26, 18:34

No problem. Im glad your checking before we just go at it.

**ken545** · 2011-04-26, 19:28

What is the brand of your computer ?

When you go to My Computer , do you see a recovery partition ? Most likely D:

**soul4soul** · 2011-04-26, 19:54

i have a dell vostro 400 (not a mini tower)

when i open up my computer i dont see a recovery partition only my C: drive. But when i turn on the pc i have 3 options to choice from which i never use to have before. one of them says microsoft windows recovery console.

**ken545** · 2011-04-26, 23:10

Great, this is where were at. Your Master Boot Record is infected with a Rootkit and we need to remove it and write a new MBR, the only problem is that with a Dell, you have a recovery partition , you can use that to bring your system back to the day you purchased it, that partition will be gone so if you want to proceed , we can but its advisable to contact Dell and order Recovery Disks for your system.

This is what we need to do

Reboot your machine and when the Boot Menu flashes up - select "Microsoft Windows Recovery Console"
(you need to be very fast with the arrow key as you only have a couple of seconds before it defaults to the windows XP bootup)
When you get to the above screen, take note of the number that references your operating system.
If it's '1' like the picture above, type 1 and press Enter
It will then prompt you for the Administrator's password. If there is no password, simply press enter. Otherwise type in the password and then press enter.
Next type FIXMBR
If it asks if you're sure you want to write a new MBR, answer 'Y'
Then type EXIT to reboot the machine.

**soul4soul** · 2011-04-27, 03:08

Im not worried about losing that partition i didnt even know it existed. I have all the original discs from dell if i need them and if i were or needed to do a complete re-install id go with win7 so removing that is no problem for me. Will that partition space be completely lost? (i know its not a lot of space im just a little curious)

Alright im all done. My PC restarted normally.

**ken545** · 2011-04-27, 10:37

Sometimes these rootkits bring friends along for a ride, lets check

Please download ATF Cleaner by Atribune to your desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.

Please download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the report please

**soul4soul** · 2011-04-27, 15:00

i already had mbam i updated the database before i ran a scan

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6456

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

4/27/2011 8:59:27 AM
mbam-log-2011-04-27 (08-59-27).txt

Scan type: Quick scan
Objects scanned: 163868
Time elapsed: 3 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

**ken545** · 2011-04-27, 18:30

bump to see thread

**ken545** · 2011-04-27, 18:31

Lets run this scan and let me know how things are running now ?

OTL by OldTimer

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Click the "Scan All Users" checkbox.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
  Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

**soul4soul** · 2011-04-27, 22:06

MBAM always showed up as clean.

here is the first log OTL.txt

OTL logfile created on: 4/27/2011 3:56:14 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Lord\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 73.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.77 Gb Total Space | 139.77 Gb Free Space | 60.04% Space Free | Partition Type: NTFS

Computer Name: ALEX | User Name: Lord | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Lord\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe (CinemaNow, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Lord\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (RoxWatch11) -- File not found
SRV - (RoxMediaDB11) -- File not found
SRV - (RoxLiveShare11) -- File not found
SRV - (Roxio Upnp Server 11) -- File not found
SRV - (Roxio UPnP Renderer 11) -- File not found
SRV - (getPlus(R) Helper) getPlus(R) -- File not found
SRV - (AppMgmt) -- File not found
SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) -- File not found
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (KMService) -- C:\WINDOWS\system32\srvany.exe ()
SRV - (RoxWatch12) -- C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe (Sonic Solutions)
SRV - (RoxMediaDB12) -- C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe (Sonic Solutions)
SRV - (CinemaNow Service) -- C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe (CinemaNow, Inc.)

========== Driver Services (SafeList) ==========

DRV - (c2scsi) -- C:\WINDOWS\System32\drivers\c2scsi.sys (Sonic Solutions)
DRV - (SaibVd32) -- C:\WINDOWS\system32\drivers\SaibVd32.sys (Sonic Solutions)
DRV - (SahdIa32) -- C:\WINDOWS\System32\Drivers\SahdIa32.sys (Sonic Solutions)
DRV - (SaibIa32) -- C:\WINDOWS\System32\Drivers\SaibIa32.sys (Sonic Solutions)
DRV - (RsFx0103) -- C:\WINDOWS\system32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (RxFilter) -- C:\WINDOWS\system32\drivers\RxFilter.sys (Sonic Solutions)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (LHidKe) -- C:\WINDOWS\system32\drivers\LHidKE.Sys (Logitech Inc.)
DRV - (LMouKE) -- C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech Inc.)
DRV - (TIEHDUSB) -- C:\WINDOWS\system32\drivers\tiehdusb.sys (Texas Instruments Incorporated)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=3080517
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=3080517

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=3080517
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=3080517
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page =
IE - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.order.1: "Yahoo"
FF - prefs.js..browser.search.order.2: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2438727&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 55273
FF - prefs.js..network.proxy.no_proxies_on: ""
FF - prefs.js..network.proxy.ssl: "localhost"
FF - prefs.js..network.proxy.ssl_port: 8888
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/05/21 10:56:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011/04/01 11:52:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/21 13:58:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2010/07/09 09:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lord\Application Data\Mozilla\Extensions
[2011/03/11 10:34:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lord\Application Data\Mozilla\Firefox\Profiles\ns2o3ouy.default\extensions
[2010/04/28 15:14:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Lord\Application Data\Mozilla\Firefox\Profiles\ns2o3ouy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/22 13:45:06 | 000,000,000 | ---D | M] (RedShift V3) -- C:\Documents and Settings\Lord\Application Data\Mozilla\Firefox\Profiles\ns2o3ouy.default\extensions\redshift_V2@shift-themes.com
[2009/08/01 23:16:25 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Lord\Application Data\Mozilla\Firefox\Profiles\ns2o3ouy.default\searchplugins\search-the-web.xml
[2011/04/21 13:58:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\LORD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\NS2O3OUY.DEFAULT\EXTENSIONS\{CD6C4EBF-366E-45A0-98B5-B8217288EED7}.XPI
() (No name found) -- C:\DOCUMENTS AND SETTINGS\LORD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\NS2O3OUY.DEFAULT\EXTENSIONS\TESTPILOT@LABS.MOZILLA.COM.XPI
[2010/04/08 06:58:22 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/03/18 13:53:24 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/04/22 20:27:27 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll (TechSmith Corporation)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Oracle)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (SnagIt) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll (TechSmith Corporation)
O3 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - Startup: C:\Documents and Settings\Lord\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_21.dll (Oracle)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\..Trusted Domains: cinemanow.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\..Trusted Domains: cinemanow.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\..Trusted Domains: qflix.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\..Trusted Domains: roxio.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\..Trusted Domains: sonic.com ([redirect] http in Trusted sites)
O15 - HKU\S-1-5-21-3908872593-1432629759-1091945336-1006\..Trusted Domains: sonic.com ([redirect2] http in Trusted sites)
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} http://download.macromedia.com/pub/s...re/awswaxf.cab (Macromedia Authorware Web Player Control)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary...r.cab56986.cab (Checkers Class)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary...n.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://messenger.zone.msn.com/EN-US/...jolauncher.cab (MJLauncherCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary...t.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary...r.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.237.161.12
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Dell.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Dell.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/27 15:55:01 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Lord\Desktop\OTL.exe
[2011/04/27 09:02:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2011/04/27 08:55:43 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/04/27 08:54:59 | 000,050,688 | ---- | C] (Atribune.org) -- C:\Documents and Settings\Lord\Desktop\ATF-Cleaner.exe
[2011/04/25 21:25:52 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/04/25 21:25:52 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/04/25 21:25:52 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/04/25 21:25:52 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/04/25 21:25:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/04/25 20:08:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Desktop\tdsskiller
[2011/04/23 12:57:02 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011/04/23 12:57:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/04/23 12:56:42 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Lord\Desktop\erunt-setup.exe
[2011/04/22 22:25:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/04/22 20:54:25 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Lord\Recent
[2011/04/22 20:10:59 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/04/22 20:06:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/04/22 13:01:58 | 000,000,000 | ---D | C] -- C:\Program Files\CP-Autos
[2011/04/22 12:22:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/04/22 12:22:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/04/21 18:06:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2011/04/21 17:44:47 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2011/04/21 17:44:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Microsoft
[2011/04/21 17:39:24 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 8
[2011/04/21 17:26:20 | 000,000,000 | R--D | C] -- C:\MSOCache
[2011/04/21 13:58:45 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011/04/21 12:27:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Application Data\Malwarebytes
[2011/04/21 12:27:06 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/04/21 12:27:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/04/21 12:27:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/04/21 12:27:02 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/21 12:27:02 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/04/21 12:04:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/21 12:04:26 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/04/21 12:04:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/04/21 10:51:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Real
[2011/04/21 10:50:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/04/20 23:43:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Local Settings\Application Data\Microsoft Help
[2011/04/20 23:35:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2011/04/20 15:02:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Desktop\(DONE) African Diaspora Mathematics Compendium, Volume 4-ALL LATEX
[2011/04/20 14:04:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Application Data\Help
[2011/04/20 12:54:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/04/20 12:54:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/04/20 12:00:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sonic
[2011/04/19 16:30:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Desktop\world
[2011/04/18 17:39:12 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011/04/15 18:01:01 | 000,050,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
[2011/04/15 18:00:47 | 000,079,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
[2011/04/15 17:59:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RsFx
[2011/04/15 17:56:37 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server
[2011/04/15 15:18:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Application Data\TweakNow RegCleaner 2011
[2011/04/12 14:53:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Products
[2011/04/12 13:05:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Local Settings\Application Data\Adobe
[2011/04/12 12:43:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Application Data\Adobe
[2011/04/12 12:31:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011/04/12 09:32:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Desktop\Transmission Lines Theory, Types and Applications
[2011/04/08 18:19:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\symbols
[2011/04/08 18:19:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Help Viewer
[2011/04/06 16:20:16 | 000,107,808 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\dnssd.dll
[2011/04/04 22:45:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Local Settings\Application Data\PCTeX
[2011/04/04 22:45:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PCTeX
[2011/04/04 22:44:54 | 000,000,000 | ---D | C] -- C:\Program Files\PCTeX
[2011/04/01 16:53:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\My Documents\My PCTeX Files
[2011/04/01 12:36:42 | 000,000,000 | ---D | C] -- C:\Program Files\Ghostgum
[2011/04/01 12:32:30 | 000,000,000 | ---D | C] -- C:\Program Files\gs
[2011/04/01 11:53:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe
[2011/04/01 11:50:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe-BackupByPhotoshopCS5Portable
[2011/04/01 11:50:08 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2011/03/31 10:18:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Desktop\Machine Tools Design, Reliability and Safety
[2011/03/31 10:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lord\Desktop\Advances in Sociology Research Volume 10
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/27 15:55:01 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lord\Desktop\OTL.exe
[2011/04/27 15:51:37 | 000,235,289 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2011/04/27 15:51:10 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3908872593-1432629759-1091945336-1006.job
[2011/04/27 15:50:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/04/27 15:50:48 | 2145,566,720 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/27 08:57:17 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/04/27 08:55:00 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\Lord\Desktop\ATF-Cleaner.exe
[2011/04/25 21:24:11 | 004,330,054 | R--- | M] () -- C:\Documents and Settings\Lord\Desktop\Combo-Fix.exe
[2011/04/25 20:08:04 | 001,263,721 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\tdsskiller.zip
[2011/04/25 20:04:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/23 13:01:47 | 000,003,801 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\Attach.zip
[2011/04/23 12:57:30 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\dds.scr
[2011/04/23 12:57:04 | 000,000,767 | ---- | M] () -- C:\Documents and Settings\Lord\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/04/23 12:57:02 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\ERUNT.lnk
[2011/04/23 12:56:43 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Lord\Desktop\erunt-setup.exe
[2011/04/23 12:31:24 | 000,340,240 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/22 20:27:27 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/22 20:11:06 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/04/22 20:09:42 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/22 18:37:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3908872593-1432629759-1091945336-1006.job
[2011/04/21 13:58:48 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Lord\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/21 13:58:48 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/04/21 13:50:40 | 000,003,584 | ---- | M] () -- C:\Documents and Settings\Lord\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/21 12:27:06 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/21 12:04:30 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\Spybot - Search & Destroy.lnk
[2011/04/20 13:10:49 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/04/20 07:14:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/18 18:53:58 | 000,000,019 | ---- | M] () -- C:\WINDOWS\popcinfo.dat
[2011/04/18 18:32:29 | 000,630,932 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/18 18:32:29 | 000,136,800 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/04/18 17:44:31 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/12 12:43:14 | 000,011,495 | ---- | M] () -- C:\Documents and Settings\Lord\gsview32.ini
[2011/04/09 23:23:58 | 000,000,165 | ---- | M] () -- C:\WINDOWS\System32\spupdsvc.inf
[2011/04/09 22:52:51 | 000,001,542 | -HS- | M] () -- C:\Documents and Settings\Lord\Local Settings\Application Data\ir806823nm0e02u0748c4iw4onj73w34x6m56pw625
[2011/04/09 22:52:51 | 000,001,542 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\ir806823nm0e02u0748c4iw4onj73w34x6m56pw625
[2011/04/08 16:42:37 | 000,002,373 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\Remere's Map Editor.lnk
[2011/04/06 16:20:16 | 000,107,808 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\dnssd.dll
[2011/04/04 22:45:04 | 000,000,750 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\PCTeXv5.lnk
[2011/04/04 18:17:40 | 000,014,910 | -HS- | M] () -- C:\Documents and Settings\Lord\Local Settings\Application Data\0810l5u6odc6bt4h
[2011/04/04 18:17:40 | 000,014,910 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\0810l5u6odc6bt4h
[2011/04/03 12:03:59 | 000,014,183 | ---- | M] () -- C:\Documents and Settings\Lord\Desktop\test.otbm
[2011/04/01 16:25:00 | 000,000,043 | ---- | M] () -- C:\WINDOWS\gswin32.ini
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/25 21:25:52 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/04/25 21:25:52 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/04/25 21:25:52 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/04/25 21:25:52 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/04/25 21:25:52 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/04/25 21:24:05 | 004,330,054 | R--- | C] () -- C:\Documents and Settings\Lord\Desktop\Combo-Fix.exe
[2011/04/25 20:07:59 | 001,263,721 | ---- | C] () -- C:\Documents and Settings\Lord\Desktop\tdsskiller.zip
[2011/04/25 20:04:06 | 2145,566,720 | -HS- | C] () -- C:\hiberfil.sys
[2011/04/23 13:01:47 | 000,003,801 | ---- | C] () -- C:\Documents and Settings\Lord\Desktop\Attach.zip
[2011/04/23 12:57:30 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Lord\Desktop\dds.scr
[2011/04/23 12:57:04 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\Lord\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/04/23 12:57:02 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Lord\Desktop\ERUNT.lnk
[2011/04/22 20:11:01 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/04/21 13:58:48 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Lord\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/21 13:58:48 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/04/21 13:50:40 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\Lord\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/21 12:27:06 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/21 12:04:30 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\Lord\Desktop\Spybot - Search & Destroy.lnk
[2011/04/20 14:02:01 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/20 13:10:49 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/04/09 23:23:58 | 000,000,165 | ---- | C] () -- C:\WINDOWS\System32\spupdsvc.inf
[2011/04/09 22:52:43 | 000,001,542 | -HS- | C] () -- C:\Documents and Settings\Lord\Local Settings\Application Data\ir806823nm0e02u0748c4iw4onj73w34x6m56pw625
[2011/04/09 22:52:43 | 000,001,542 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\ir806823nm0e02u0748c4iw4onj73w34x6m56pw625
[2011/04/04 22:45:04 | 000,000,750 | ---- | C] () -- C:\Documents and Settings\Lord\Desktop\PCTeXv5.lnk
[2011/04/04 18:15:55 | 000,014,910 | -HS- | C] () -- C:\Documents and Settings\Lord\Local Settings\Application Data\0810l5u6odc6bt4h
[2011/04/04 18:15:55 | 000,014,910 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\0810l5u6odc6bt4h
[2011/04/03 11:15:30 | 000,014,183 | ---- | C] () -- C:\Documents and Settings\Lord\Desktop\test.otbm
[2011/04/01 16:25:00 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2011/04/01 12:36:46 | 000,011,495 | ---- | C] () -- C:\Documents and Settings\Lord\gsview32.ini
[2011/02/06 11:34:25 | 009,566,435 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-3908872593-1432629759-1091945336-1006-0.dat
[2011/02/06 11:34:10 | 000,347,274 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/09/27 20:40:55 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\srvany.exe
[2010/07/09 00:20:09 | 001,708,496 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/05/20 20:08:14 | 000,000,050 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2010/01/26 20:10:47 | 000,055,809 | ---- | C] () -- C:\WINDOWS\CP-FPCOS100.dll
[2009/12/04 15:07:54 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/23 22:09:27 | 000,000,019 | ---- | C] () -- C:\WINDOWS\popcinfo.dat
[2009/06/21 11:53:14 | 000,000,025 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2009/06/10 08:29:34 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009/06/10 08:29:34 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009/06/10 08:29:34 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009/06/10 08:29:34 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009/06/10 08:29:34 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009/06/10 08:29:34 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2009/06/10 08:29:32 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009/06/10 06:03:00 | 001,580,550 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2009/03/07 13:41:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2009/01/25 01:45:09 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2009/01/24 13:25:42 | 000,000,039 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2008/10/13 15:48:47 | 000,072,516 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/08/12 09:29:05 | 001,245,696 | ---- | C] () -- C:\WINDOWS\System32\QtNetwork4.dll
[2008/08/12 09:29:05 | 000,505,344 | ---- | C] () -- C:\WINDOWS\System32\QtXml4.dll
[2008/08/01 10:16:24 | 000,063,984 | ---- | C] () -- C:\WINDOWS\DVDRGN.EXE
[2008/07/29 15:50:13 | 000,000,022 | ---- | C] () -- C:\WINDOWS\msnmsgr.exe.ini
[2008/06/21 12:44:05 | 010,436,608 | ---- | C] () -- C:\WINDOWS\System32\QtGui4.dll
[2008/06/21 12:44:05 | 002,660,864 | ---- | C] () -- C:\WINDOWS\System32\QtCore4.dll
[2008/06/21 12:44:05 | 000,015,960 | ---- | C] () -- C:\WINDOWS\System32\mingwm10.dll
[2008/05/22 15:52:33 | 000,001,160 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008/05/21 22:32:49 | 000,000,028 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/05/21 21:55:45 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2008/05/21 20:59:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/05/16 19:08:13 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/05/16 19:04:37 | 000,000,611 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008/05/16 18:45:26 | 000,077,824 | ---- | C] () -- C:\WINDOWS\setpwr32.exe
[2008/05/16 18:44:22 | 000,001,124 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 14:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 14:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/10 14:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 14:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 13:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 13:57:15 | 000,340,240 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 13:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 13:51:20 | 000,630,932 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 13:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 13:51:20 | 000,136,800 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 13:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 13:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 13:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 13:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 13:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 13:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 13:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 13:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/01/30 16:07:46 | 000,245,408 | ---- | C] () -- C:\WINDOWS\System32\unicows.dll

========== LOP Check ==========

[2010/04/24 15:18:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CinemaNow
[2010/02/18 16:32:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PhotoShow Shared Assets
[2008/10/26 21:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2009/12/18 19:16:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap Games
[2010/02/18 16:48:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2010/12/06 17:39:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith
[2010/02/18 16:34:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
[2010/07/22 13:32:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/04/22 20:54:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lord\Application Data\BitTorrent
[2011/04/20 15:06:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lord\Application Data\FileZilla
[2010/12/13 15:54:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lord\Application Data\Notepad++
[2010/08/31 10:32:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lord\Application Data\Remere's Map Editor
[2011/01/31 22:37:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lord\Application Data\Tibia
[2011/04/21 11:00:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lord\Application Data\TweakNow RegCleaner 2011
[2011/04/27 15:58:29 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Lord\My Documents\just stuff.lua:DocumentSummaryInformation
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Lord\Desktop\template.dmsd:Roxio EMC Stream
@Alternate Data Stream - 48 bytes -> C:\Documents and Settings\All Users\DRM:مايكروسوفت
@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\Lord\My Documents\just stuff.lua:SummaryInformation
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\Lord\My Documents\its my life.doc:SummaryInformation

< End of report >

Thread: Click.GiftLoad Removal Help!

Thread Tools

Display

OTL.txt

Posting Permissions