Page 1 of 4 1234 LastLast
Results 1 to 10 of 40

Thread: Computer dying

  1. #1
    Junior Member
    Join Date
    Aug 2008
    Posts
    25

    Default Computer dying

    Hi

    I seem to have a virus/spyware on my PC. Nether spybot nor Avast seem to be able to detect it.

    It makes the screen “flicker”. And Spybot is no longer able to detect anything.

    I run windows XP home edition.

    Other than spybot no longer being able to detect anything, sometimes Online armor will display a message saying that my computer wants to connect to someone else’s.

    Oh ye, at one point, when switching on the computer, it would switch on but none of the icons would show up so I couldn’t do or run anything.

    Now they will show up providing I start up the computer with the modem switched of and plug it in when everything has loaded up.

    Also more recently when I go to shut down it comes up with the menu saying “unable to shut down. If you proceed any unsaved data will be lost”.

    Thanks


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 09:07:09, on 20/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    D:\My Documents\Online Armor\oasrv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
    D:\My Documents\Online Armor\oaui.exe
    D:\My Documents\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: baloudHelperObj Class - {6165D324-3AAF-4C63-B545-C7D2285BEA1C} - C:\Program Files\ReadAndWrite6\thbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [VirtualCloneDrive] "F:\VirtualCloneDrive\VCDDaemon.exe" /s
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\My Documents\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [WinampAgent] "d:\My Documents\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [OnlineArmor GUI] "D:\My Documents\Online Armor\oaui.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "D:\My Documents\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "D:\My Documents\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.excite.com
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - D:\My Documents\Online Armor\oasrv.exe
    O24 - Desktop Component 1: (no name) - C:\Student_Info\index.html

    --
    End of file - 6411 bytes

  2. #2
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Hello and Welcome to the forums!

    Sorry about the delay in responding........

    My name is peku006 and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:

    • If you don't know, stop and ask! Don't keep going on.
    • Please reply to this thread. Do not start a new topic.
    • Please continue to respond until I give you the "All Clear"

    If you follow these instructions, everything should go smoothly.

    I'm not seeing anything malicious in your HJT log. Let's run a couple of scans and see what we find.

    1 - Disable TeaTimer

    The Resident TeaTimer tool of Spybot-S&D, may interfere with the fix, so we need to temporarily disable it.
    This is a 2 step process...

    Step 1:
    • Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
    • Choose Exit Spybot S&D Resident

    Step 2:
    • Open Spybot S&D
    • Click Mode, check Advanced Mode
    • Go To Left Panel, Click Tools, then also in left panel, click Resident
    • If your firewall raises a question, say "OK"
    • Uncheck the box labeled Resident Tea-Timer and OK any prompts.
    • Use File, Exit to terminate Spybot.
    • Reboot your machine for the changes to take effect.


    Don't forget to enable TeaTimer protection, when your computer is clean.

    2 - Download and Run Malwarebytes' Anti-Malware
    Please download Malwarebytes' Anti-Malware to your desktop.
    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to:
      • Update Malwarebytes' Anti-Malware
      • Launch Malwarebytes' Anti-Malware
    • Then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please copy and paste the log into your next reply.
    • If you accidently close it, the log file is saved here and will be named like this: C:\Documents and Settings\<your username>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt


    3 - download and run RSIT

    • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)


    4 - Status Check
    Please reply with

    1.the logs from RSIT (log.txt ,info.txt)
    2. the Malwarebytes' Anti-Malware Log
    description of any problems you are having with your PC

    Thanks peku006
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.

  3. #3
    Junior Member
    Join Date
    Aug 2008
    Posts
    25

    Default

    Its OK, thanks for replying.

    Malwarebytes' Anti-Malware 1.28
    Database version: 1222
    Windows 5.1.2600 Service Pack 2

    30/09/2008 19:25:53
    mbam-log-2008-09-30 (19-25-53).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 177822
    Time elapsed: 1 hour(s), 8 minute(s), 46 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)




    info.txt logfile of random's system information tool 1.04 2008-09-30 18:29:27

    ======Uninstall list======

    -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
    -->MsiExec.exe /I{219B0DA4-8F1A-499D-8795-4A07C632521E}
    -->MsiExec.exe /I{644B991F-B109-4360-9DA3-40CDAD13961C}
    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    ABBYY FineReader 6.0 Professional-->MsiExec.exe /I{AF600F7B-67A7-48D9-BA3B-0FF97F35F970}
    Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
    Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
    Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
    Apple Mobile Device Support-->MsiExec.exe /I{AA9768AA-FF0B-4C66-A085-31E934F77841}
    Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
    ArcSoft PhotoImpression 3.0-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ArcSoft\PhotoImpression\Uninst.isu"
    avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
    BitLord 1.1-->F:\BitLord\uninst.exe
    BitTornado 0.3.17-->C:\Program Files\BitTornado\uninst.exe
    Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
    BroadJump Client Foundation-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\BroadJump\Client Foundation\Uninst.isu" -c"C:\Program Files\BroadJump\Client Foundation\RmvBJCFD.dll" -b"CFD" -h"CFD" -a
    Copy Utility-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\EPSON\Copy Utility\Uninst.isu"
    DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
    DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
    DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
    EPSON Photo Print-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\EPSON\Photo Print\Uninst.isu"
    EPSON Printer Software-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
    EPSON Smart Panel-->C:\Program Files\EPSON\Smart Panel\SPUninst.exe
    EPSON TWAIN 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A3EABC0-CA06-11D4-BF77-00104B130C19}\setup.exe" UNINSTALL
    Google Earth-->MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
    HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
    Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
    Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
    Inspiration 6 UK-->C:\WINDOWS\unvise32.exe C:\Program Files\Inspiration 6 UK\uninstal.log
    IObit SmartDefrag Beta4.01-->"C:\Program Files\IObit\IObit SmartDefrag\unins000.exe"
    iTunes-->MsiExec.exe /I{41B9E2CF-0B3F-442A-B5B3-592A4A355634}
    Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
    Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
    K-Lite Codec Pack 2.79 Standard-->"F:\K-Lite Codec Pack\unins000.exe"
    L&H TTS3000 British English-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSENG.inf, Uninstall
    Lernout & Hauspie TruVoice American English TTS Engine-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\tv_enua.inf, Uninstall
    LimeWire 4.18.8-->"d:\My Documents\LimeWire\uninstall.exe"
    Logitech MouseWare 9.41 .1-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5809E7CF-4DCF-11D4-9875-00105ACE7734}\setup.exe" -l0009 UNINSTALL
    Logitech Resource Center-->C:\PROGRA~1\Logitech\RESOUR~1\rem\UNWISE.EXE /s C:\PROGRA~1\Logitech\RESOUR~1\rem\INSTALL.LOG
    Logitech User's Guide-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CBE0FCA1-4E95-11D4-9875-00105ACE7734}\Setup.exe" UNINSTALL
    Malwarebytes' Anti-Malware-->"D:\My Documents\Malwarebytes' Anti-Malware\unins000.exe"
    Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
    Microsoft AutoRoute 2006-->MsiExec.exe /I{83ED1E80-A1B7-4236-BCF1-AC4A88151A6B}
    Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Office XP Professional-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0050048383C9}
    Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
    MobileMe Control Panel-->MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
    Mozilla Firefox (3.0.2)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MSXML 4.0 SP2 (KB925672)-->MsiExec.exe /I{A9CF9052-F4A0-475D-A00F-A8388C62DD63}
    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
    neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
    Online Armor 2.1-->"D:\My Documents\Online Armor\unins000.exe"
    Opera 9.52-->MsiExec.exe /X{775EA80D-E368-4310-97B6-3D47EB9BB3F1}
    PFConfig 1.0.187-->D:\My Documents\PFConfig\uninst.exe
    PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
    QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
    Read and Write 6-->MsiExec.exe /I{3A46094F-D603-4C6C-9F1D-8E806781F195}
    ScanToWeb-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}\Setup.exe" ADDREMOVEDLG
    Security Update for Windows Media Player (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917344)-->"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917953)-->"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924191)-->"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB929969)-->"C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB933566)-->"C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB942615)-->"C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944338)-->"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB947864)-->"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
    Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
    Spybot - Search & Destroy 1.5.2.20-->"C:\WINDOWS\unins000.exe"
    Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
    SUPER © Version 2008.bld.25 (Feb 5, 2008)-->D:\MYDOCU~1\SUPER\Setup.exe /remove /q0
    Update for Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
    Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
    Update for Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
    Update for Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
    Update for Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
    Update for Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
    Update for Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
    Update for Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
    Update for Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
    Update for Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
    Update for Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
    Update for Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
    Update for Windows XP (KB936357)-->"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
    Update for Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
    Update for Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
    Update for Windows XP (KB942840)-->"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
    Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
    VideoLAN VLC media player 0.8.6f-->D:\My Documents\VLC\uninstall.exe
    VirtualCloneDrive-->"F:\VirtualCloneDrive\vcd-uninst.exe" /D="F:\VirtualCloneDrive"
    Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
    Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
    Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
    Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
    Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
    Windows XP Hotfix - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885884-->C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885894-->C:\WINDOWS\$NtUninstallKB885894$\spuninst\spuninst.exe
    Windows XP Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
    Windows XP Hotfix - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
    Windows XP Hotfix - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
    Windows XP Hotfix - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
    Windows XP Hotfix - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
    Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe
    WS-5614PASG-->C:\WINDOWS\Modio\SLAMRNTV\slclean.exe

    ======Hosts File======

    127.0.0.1 www.007guard.com
    127.0.0.1 007guard.com
    127.0.0.1 008i.com
    127.0.0.1 www.008k.com
    127.0.0.1 008k.com
    127.0.0.1 www.00hq.com
    127.0.0.1 00hq.com
    127.0.0.1 010402.com
    127.0.0.1 www.032439.com
    127.0.0.1 032439.com

    ======Security center information======

    AV: avast! antivirus 4.8.1229 [VPS 080930-0]
    FW: Online Armor Firewall
    FW: Kaspersky Anti-Hacker (disabled)

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;D:\My Documents\QTSystem\
    "windir"=%SystemRoot%
    "OS"=Windows_NT
    "PROCESSOR_ARCHITECTURE"=x86
    "PROCESSOR_LEVEL"=15
    "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 1 Stepping 2, GenuineIntel
    "PROCESSOR_REVISION"=0102
    "NUMBER_OF_PROCESSORS"=1
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "FP_NO_HOST_CHECK"=NO
    "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
    "QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

    -----------------EOF-----------------




    Logfile of random's system information tool 1.04 (written by random/random)
    Run by oemstudent at 2008-09-30 18:28:15
    Microsoft Windows XP Home Edition Service Pack 2
    System drive C: has 241 MB (2%) free of 10 GB
    Total RAM: 767 MB (27% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:29:02, on 30/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    D:\My Documents\Online Armor\oasrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
    D:\My Documents\Online Armor\oaui.exe
    D:\My Documents\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    d:\My Documents\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files\Opera\Opera.exe
    d:\My Documents\RSIT.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\Program Files\Trend Micro\HijackThis\oemstudent.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: baloudHelperObj Class - {6165D324-3AAF-4C63-B545-C7D2285BEA1C} - C:\Program Files\ReadAndWrite6\thbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [VirtualCloneDrive] "F:\VirtualCloneDrive\VCDDaemon.exe" /s
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\My Documents\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [WinampAgent] "d:\My Documents\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [OnlineArmor GUI] "D:\My Documents\Online Armor\oaui.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "D:\My Documents\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "D:\My Documents\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.excite.com
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - D:\My Documents\Online Armor\oasrv.exe
    O24 - Desktop Component 1: (no name) - C:\Student_Info\index.html

    --
    End of file - 6282 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\SmartDefrag.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-01-28 1554256]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6165D324-3AAF-4C63-B545-C7D2285BEA1C}]
    baloudHelperObj Class - C:\Program Files\ReadAndWrite6\thbho.dll [2002-02-12 40960]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "EM_EXEC"=C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE [2001-09-19 35328]
    "VirtualCloneDrive"=F:\VirtualCloneDrive\VCDDaemon.exe /s []
    "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008]
    "SmartDefrag"=C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2007-10-19 2736384]
    "Adobe Reader Speed Launcher"=D:\My Documents\Reader\Reader_sl.exe [2008-01-11 39792]
    "BJCFD"=C:\Program Files\BroadJump\Client Foundation\CFD.exe []
    "WinampAgent"=d:\My Documents\Winamp\winampa.exe []
    "OnlineArmor GUI"=D:\My Documents\Online Armor\oaui.exe [2008-04-17 5545536]
    "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]
    "QuickTime Task"=D:\My Documents\qttask.exe [2008-09-06 413696]
    "AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
    "iTunesHelper"=D:\My Documents\iTunes\iTunesHelper.exe [2008-09-10 289576]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]
    "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe []
    "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592]
    "Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-08-11 21741864]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    C:\WINDOWS\system32\klogon.dll [2007-06-28 206088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{4F07DA45-8170-4859-9B5F-037EF2970034}"=D:\MYDOCU~1\ONLINE~1\oaevent.dll [2008-04-17 671432]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mmx19g.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\xmm13g.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mmx19g.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\xmm13g.sys]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=145

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
    "D:\My Documents\LimeWire\LimeWire.exe"="D:\My Documents\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
    "C:\Program Files\BitTornado\btdownloadgui.exe"="C:\Program Files\BitTornado\btdownloadgui.exe:*:Enabled:btdownloadgui"
    "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
    "D:\My Documents\iTunes\iTunes.exe"="D:\My Documents\iTunes\iTunes.exe:*:Enabled:iTunes"
    "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1ee6ec6-dc7e-11db-a09d-0004e232ff3d}]
    shell\AutoRun\command - H:\cd2run.exe


    ======File associations======

    .reg - open - regedit.exe "%1" %*

    ======List of files/folders created in the last 1 months======

    2008-09-30 18:28:15 ----D---- C:\rsit
    2008-09-19 10:39:22 ----D---- C:\Program Files\Trend Micro
    2008-09-19 10:21:58 ----D---- C:\Program Files\iPod
    2008-09-19 10:20:49 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
    2008-09-19 10:15:58 ----D---- C:\Program Files\Bonjour
    2008-09-18 12:40:01 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
    2008-09-18 12:39:28 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
    2008-09-09 08:30:20 ----D---- C:\WINDOWS\system32\CatRoot_bak
    2008-08-31 18:19:57 ----D---- C:\Documents and Settings\oemstudent\Application Data\Malwarebytes
    2008-08-31 18:19:42 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes

    ======List of files/folders modified in the last 1 months======

    2008-09-30 18:27:54 ----D---- C:\WINDOWS\Prefetch
    2008-09-30 17:52:11 ----D---- C:\Documents and Settings\oemstudent\Application Data\Skype
    2008-09-30 17:44:13 ----D---- C:\WINDOWS\Temp
    2008-09-30 17:39:31 ----D---- C:\Documents and Settings\oemstudent\Application Data\skypePM
    2008-09-30 17:39:16 ----D---- C:\Documents and Settings\oemstudent\Application Data\OnlineArmor
    2008-09-30 17:38:53 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-09-30 17:36:49 ----A---- C:\WINDOWS\SchedLgU.Txt
    2008-09-28 12:54:33 ----D---- C:\Program Files\Mozilla Firefox
    2008-09-19 14:01:32 ----D---- C:\WINDOWS
    2008-09-19 10:39:22 ----RD---- C:\Program Files
    2008-09-19 10:29:03 ----D---- C:\Documents and Settings\oemstudent\Application Data\LimeWire
    2008-09-19 10:26:02 ----SHD---- C:\WINDOWS\Installer
    2008-09-19 10:25:45 ----SHD---- C:\Config.Msi
    2008-09-19 10:22:57 ----D---- C:\WINDOWS\system32\drivers
    2008-09-19 10:22:57 ----D---- C:\WINDOWS\SYSTEM32
    2008-09-19 10:22:57 ----D---- C:\WINDOWS\INF
    2008-09-19 10:22:46 ----DC---- C:\WINDOWS\system32\DRVSTORE
    2008-09-19 10:15:37 ----SD---- C:\WINDOWS\Tasks
    2008-09-19 08:04:05 ----D---- C:\Program Files\Common Files\Apple
    2008-09-19 07:52:34 ----D---- C:\Program Files\DivX
    2008-09-18 12:40:02 ----D---- C:\WINDOWS\WinSxS
    2008-09-18 12:39:42 ----HD---- C:\WINDOWS\$hf_mig$
    2008-09-18 12:39:36 ----A---- C:\WINDOWS\imsins.BAK
    2008-09-18 08:28:46 ----RSHD---- C:\WINDOWS\system32\dllcache
    2008-09-17 21:49:55 ----D---- C:\WINDOWS\HELP
    2008-09-09 08:42:07 ----D---- C:\WINDOWS\system32\CatRoot
    2008-09-09 08:30:19 ----D---- C:\WINDOWS\Debug
    2008-09-08 12:04:26 ----D---- C:\Documents and Settings\oemstudent\Application Data\Mozilla

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944]
    R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912]
    R1 OADevice;OADriver; \??\C:\WINDOWS\system32\drivers\OADriver.sys []
    R1 OAmon;OAmon; \??\C:\WINDOWS\system32\drivers\OAmon.sys []
    R1 OAnet;OAnet; \??\C:\WINDOWS\system32\drivers\OAnet.sys []
    R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416]
    R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2006-04-22 8064]
    R3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
    R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter; C:\WINDOWS\System32\DRIVERS\AN983.sys [2004-08-03 36224]
    R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152]
    R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2005-04-12 4608]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
    R3 l8042pr2;Logitech PS/2 Mouse Filter Driver; C:\WINDOWS\System32\DRIVERS\L8042Pr2.sys [2001-09-19 50432]
    R3 LKbdFlt2;Logitech Keyboard Class Filter Driver; C:\WINDOWS\System32\DRIVERS\LKbdFlt2.sys [2001-09-19 5840]
    R3 LMouFlt2;Logitech Mouse Class Filter Driver; C:\WINDOWS\System32\DRIVERS\LMouFlt2.sys [2001-09-19 67440]
    R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
    R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
    R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
    R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys [2002-02-23 181472]
    R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
    R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\System32\DRIVERS\slntamr.sys [2002-02-19 411464]
    R3 SlWdmSup;SlWdmSup; C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys [2001-11-29 33028]
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
    S1 mmx19g;MMX virtualization service; \??\C:\WINDOWS\system32\mmx19g.sys []
    S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2004-08-03 42496]
    S2 Rmfc7;Rmfc7; C:\WINDOWS\System32\Rmfc7.sys []
    S2 xmm13g;MMX2 virtualization service; \??\C:\WINDOWS\system32\mmx19g.sys []
    S3 a8dwhgpq;a8dwhgpq; C:\WINDOWS\system32\drivers\a8dwhgpq.sys []
    S3 Mtlstrm;Mtlstrm; C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys [2002-02-05 2388228]
    S3 NtMtlFax;NtMtlFax; C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys [2001-11-29 607732]
    S3 nv4;nv4; C:\WINDOWS\System32\DRIVERS\nv4.sys [2001-08-17 731648]
    S3 SlNtHal;SlNtHal; C:\WINDOWS\System32\DRIVERS\Slnthal.sys [2002-02-05 181328]
    S3 TSP;TSP; \??\C:\WINDOWS\system32\drivers\klif.sys []
    S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-22 32000]
    S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-03 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
    S3 V90drv;v90drv; C:\WINDOWS\System32\DRIVERS\v90drv.sys [2001-11-29 1432836]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 mchInjDrv;mchInjDrv; \??\C:\WINDOWS\TEMP\mc21.tmp []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-10 116040]
    R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
    R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
    R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
    R2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2001-11-21 45056]
    R2 SvcOnlineArmor;Online Armor; D:\My Documents\Online Armor\oasrv.exe [2008-04-17 5435968]
    R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
    R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-23 348344]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-09-10 536872]
    S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
    S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []

    -----------------EOF-----------------

    Good luck

  4. #4
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Hi Stas_1

    IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

    BitLord
    BitTornado
    LimeWire


    I'd like you to read this thread

    Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).NOW

    1. Please download OTScanIt.exe from Bleeping Computer by OldTimer and save it to your desktop.
    2. Double click on OTScanIt.exe to run it.
    3. Click on Extract. Once done, you will be prompted. Click OK and click Close.
    4. Double click on the OTScanIt folder. Double click on OTScanIt.exe to run it.
    5. Under Drivers section, select Non-Microsoft.
    6. Click on the Run Scan button at the top left hand corner.
    7. OTScanIt will start running. Once done, Notepad will open. Please post the contents of this Notepad file in your next reply.


    Thanks peku006
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.

  5. #5
    Junior Member
    Join Date
    Aug 2008
    Posts
    25

    Default

    Code:
    OTScanIt logfile created on: 30/09/2008 20:51:20
    OTScanIt by OldTimer - Version 1.0.19.0     Folder = d:\My Documents\OTScanIt
    Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.2180)
    Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
     
    767.48 Mb Total Physical Memory | 257.82 Mb Available Physical Memory | 33.59% Memory free
    1.08 Gb Paging File | 0.61 Gb Available in Paging File | 56.06% Paging File free
    Paging file location(s): C:\pagefile.sys 384 768;
     
    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 9.77 Gb Total Space | 0.25 Gb Free Space | 2.54% Space Free | Partition Type: NTFS
    Drive D: | 27.49 Gb Total Space | 6.14 Gb Free Space | 22.34% Space Free | Partition Type: FAT32
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded
    
    Computer Name: STANISLAVS
    Current User Name: oemstudent
    Logged in as Administrator.
    Current Boot Mode: Normal
    Scan Mode: Current user
    Whitelist: On
    
    [Processes - Non-Microsoft Only]
    oasrv.exe -> D:\My Documents\Online Armor\oasrv.exe -> Tall Emu [Ver = 2.1.0.131 | Size = 5435968 bytes | Modified Date = 17/04/2008 05:25:28 | Attr =    ]
    aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 16056 bytes | Modified Date = 19/07/2008 15:25:06 | Attr =    ]
    ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 147640 bytes | Modified Date = 19/07/2008 15:38:28 | Attr =    ]
    ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 250040 bytes | Modified Date = 19/07/2008 15:38:04 | Attr =    ]
    ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 8, 1229, 0 | Size = 348344 bytes | Modified Date = 23/07/2008 15:25:45 | Attr =    ]
    em_exec.exe -> %ProgramFiles%\Logitech\MouseWare\system\EM_EXEC.EXE -> Logitech Inc.                     [Ver = 9.41.33 | Size = 35328 bytes | Modified Date = 19/09/2001 09:41:00 | Attr =    ]
    ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 78008 bytes | Modified Date = 19/07/2008 15:38:34 | Attr =    ]
    iobit smartdefrag.exe -> %ProgramFiles%\IObit\IObit SmartDefrag\IObit SmartDefrag.exe ->  [Ver =  | Size = 2736384 bytes | Modified Date = 19/10/2007 13:25:54 | Attr =    ]
    oaui.exe -> D:\My Documents\Online Armor\oaui.exe -> Tall Emu  [Ver = 2.1.0.131 | Size = 5545536 bytes | Modified Date = 17/04/2008 05:25:26 | Attr =    ]
    daemon.exe -> %ProgramFiles%\DAEMON Tools\daemon.exe -> DT Soft Ltd. [Ver = 4.08.0.0 | Size = 157592 bytes | Modified Date = 12/11/2006 11:48:46 | Attr =    ]
    skype.exe -> %ProgramFiles%\Skype\Phone\Skype.exe -> Skype Technologies S.A. [Ver = 3.8.0.154 | Size = 21741864 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
    skypepm.exe -> %ProgramFiles%\Skype\Plugin Manager\skypePM.exe -> Skype Technologies [Ver = 2.0.0.58 | Size = 76744 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
    opera.exe -> %ProgramFiles%\Opera\opera.exe -> Opera Software [Ver = 10108 | Size = 98816 bytes | Modified Date = 14/08/2008 15:52:32 | Attr =    ]
    
    [Win32 Services - Non-Microsoft Only]
    (aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 16056 bytes | Modified Date = 19/07/2008 15:25:06 | Attr =    ]
    (avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 147640 bytes | Modified Date = 19/07/2008 15:38:28 | Attr =    ]
    (avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 250040 bytes | Modified Date = 19/07/2008 15:38:04 | Attr =    ]
    (avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 8, 1229, 0 | Size = 348344 bytes | Modified Date = 23/07/2008 15:25:45 | Attr =    ]
    (NMIndexingService) NMIndexingService [Win32_Own | Disabled | Stopped] -> %CommonProgramFiles%\Ahead\Lib\NMIndexingService.exe -> File not found
    (SLService) SmartLinkService [Win32_Own | Auto | Stopped] -> %SystemRoot%\SYSTEM32\slserv.exe ->   [Ver = 2.80.00(24Apr2000) | Size = 45056 bytes | Modified Date = 21/11/2001 07:14:00 | Attr =    ]
    (SvcOnlineArmor) Online Armor [Win32_Own | Auto | Running] -> D:\My Documents\Online Armor\oasrv.exe -> Tall Emu [Ver = 2.1.0.131 | Size = 5435968 bytes | Modified Date = 17/04/2008 05:25:28 | Attr =    ]
    
    [Driver Services - Non-Microsoft Only]
    (Aavmker4) avast! Asynchronous Virus Monitor [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aavmker4.sys -> ALWIL Software [Ver = 4.8.1227.0 | Size = 26944 bytes | Modified Date = 19/07/2008 15:32:15 | Attr =    ]
    (aswFsBlk) aswFsBlk [File_System | Auto | Running] -> %SystemRoot%\SYSTEM32\drivers\aswFsBlk.sys -> ALWIL Software [Ver = 4.8.1227.0 | Size = 20560 bytes | Modified Date = 19/07/2008 15:37:42 | Attr =    ]
    (aswMon2) avast! Standard Shield Support [File_System | Auto | Running] -> %SystemRoot%\System32\drivers\aswmon2.sys -> ALWIL Software [Ver = 4.8.1227.0 | Size = 94416 bytes | Modified Date = 19/07/2008 15:37:21 | Attr =    ]
    (aswRdr) aswRdr [Kernel | On_Demand | Running] -> %SystemRoot%\System32\drivers\aswRdr.sys -> ALWIL Software [Ver = 4.8.1227.0 | Size = 23152 bytes | Modified Date = 19/07/2008 15:33:42 | Attr =    ]
    (aswSP) avast! Self Protection [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aswSP.sys -> ALWIL Software [Ver = 4.8.1227.0 | Size = 78416 bytes | Modified Date = 19/07/2008 15:35:18 | Attr =    ]
    (aswTdi) avast! Network Shield Support [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aswTdi.sys -> ALWIL Software [Ver = 4.8.1227.0 | Size = 42912 bytes | Modified Date = 19/07/2008 15:32:36 | Attr =    ]
    (ElbyCDIO) ElbyCDIO Driver [Kernel | Auto | Running] -> %SystemRoot%\SYSTEM32\drivers\ElbyCDIO.sys -> Elaborate Bytes AG [Ver = 6, 0, 0, 0 | Size = 8064 bytes | Modified Date = 22/04/2006 02:44:39 | Attr =    ]
    (ElbyDelay) ElbyDelay [Kernel | On_Demand | Running] -> %SystemRoot%\SYSTEM32\drivers\ElbyDelay.sys -> Elaborate Bytes AG [Ver = 5, 1, 0, 0 | Size = 4608 bytes | Modified Date = 12/04/2005 09:41:20 | Attr =    ]
    (hpt3xx) hpt3xx [Kernel | Boot | Running] -> %SystemRoot%\SYSTEM32\drivers\hpt3xx.sys -> HighPoint Technologies, Inc. [Ver = Revision v1.0.5 (XPClient.010817-1148) | Size = 38144 bytes | Modified Date = 17/08/2001 14:52:24 | Attr =    ]
    (ip6fw) IPv6 Windows Firewall Driver [Kernel | On_Demand | Stopped] -> %SystemRoot%\System32\drivers\ip6fw.sys -> File not found
    (l8042pr2) Logitech PS/2 Mouse Filter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\SYSTEM32\drivers\L8042Pr2.sys -> Logitech [Ver = 9.41.1.17 | Size = 50432 bytes | Modified Date = 19/09/2001 10:11:00 | Attr =    ]
    (LKbdFlt2) Logitech Keyboard Class Filter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\SYSTEM32\drivers\LKbdFlt2.sys -> Logitech [Ver = 9.41.1.5 | Size = 5840 bytes | Modified Date = 19/09/2001 10:11:00 | Attr =    ]
    (LMouFlt2) Logitech Mouse Class Filter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\SYSTEM32\drivers\LMouFlt2.sys -> Logitech [Ver = 9.41.1.26 | Size = 67440 bytes | Modified Date = 19/09/2001 10:11:00 | Attr =    ]
    (mmx19g) MMX virtualization service [Kernel | System | Stopped] -> %SystemRoot%\system32\mmx19g.sys -> File not found
    (mraid35x) mraid35x [Kernel | Boot | Running] -> %SystemRoot%\SYSTEM32\drivers\mraid35x.sys -> American Megatrends Inc. [Ver = 6.19 (XPClient.010817-1148) | Size = 17280 bytes | Modified Date = 17/08/2001 14:52:12 | Attr =    ]
    (Mtlmnt5) Mtlmnt5 [Kernel | On_Demand | Running] -> %SystemRoot%\SYSTEM32\drivers\mtlmnt5.sys ->  [Ver = 1.53 | Size = 181472 bytes | Modified Date = 23/02/2002 07:00:56 | Attr = R  ]
    (Mtlstrm) Mtlstrm [Kernel | On_Demand | Stopped] -> %SystemRoot%\SYSTEM32\drivers\mtlstrm.sys ->  [Ver = 0.98 | Size = 2388228 bytes | Modified Date = 05/02/2002 09:21:42 | Attr = R  ]
    (NtMtlFax) NtMtlFax [Kernel | On_Demand | Stopped] -> %SystemRoot%\SYSTEM32\drivers\ntmtlfax.sys ->  [Ver = 2.86.08 | Size = 607732 bytes | Modified Date = 29/11/2001 09:09:20 | Attr = R  ]
    (OADevice) OADriver [Kernel | System | Running] -> %SystemRoot%\SYSTEM32\drivers\OADriver.sys ->  [Ver =  | Size = 80584 bytes | Modified Date = 17/04/2008 05:25:32 | Attr =    ]
    (OAmon) OAmon [Kernel | System | Running] -> %SystemRoot%\SYSTEM32\drivers\OAmon.sys ->  [Ver =  | Size = 32456 bytes | Modified Date = 17/04/2008 05:25:42 | Attr =    ]
    (OAnet) OAnet [Kernel | System | Running] -> %SystemRoot%\SYSTEM32\drivers\oanet.sys ->  [Ver =  | Size = 28872 bytes | Modified Date = 17/04/2008 05:25:38 | Attr =    ]
    (Rmfc7) Rmfc7 [Kernel | Auto | Stopped] -> %SystemRoot%\System32\Rmfc7.sys -> File not found
    (Slntamr) SmartLink AMR_PCI Driver [Kernel | On_Demand | Running] -> %SystemRoot%\SYSTEM32\drivers\slntamr.sys ->   [Ver = Feb 19 2002   14:55:18 | Size = 411464 bytes | Modified Date = 19/02/2002 07:55:24 | Attr = R  ]
    (SlNtHal) SlNtHal [Kernel | On_Demand | Stopped] -> %SystemRoot%\SYSTEM32\drivers\slnthal.sys ->   [Ver = 2.86.08 | Size = 181328 bytes | Modified Date = 05/02/2002 09:26:08 | Attr = R  ]
    (SlWdmSup) SlWdmSup [Kernel | On_Demand | Running] -> %SystemRoot%\SYSTEM32\drivers\slwdmsup.sys -> Vireo Software [Ver = 1.00 | Size = 33028 bytes | Modified Date = 29/11/2001 09:09:28 | Attr = R  ]
    (Sparrow) Sparrow [Kernel | Boot | Running] -> %SystemRoot%\SYSTEM32\drivers\sparrow.sys -> Adaptec, Inc. [Ver = v2.0a (ReleaseBinaries.001205-1804) | Size = 19072 bytes | Modified Date = 17/08/2001 15:07:44 | Attr =    ]
    (sptd) sptd [Kernel | Boot | Running] -> %SystemRoot%\SYSTEM32\drivers\sptd.sys ->  [Ver =  | Size = 646392 bytes | Modified Date = 27/03/2007 17:16:58 | Attr =    ]
    (TSP) TSP [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\klif.sys -> File not found
    (V90drv) V90drv [Kernel | On_Demand | Stopped] -> %SystemRoot%\SYSTEM32\drivers\v90drv.sys ->   [Ver = 2.79.03 | Size = 1432836 bytes | Modified Date = 29/11/2001 09:09:32 | Attr = R  ]
    (VClone) VClone [Kernel | Boot | Running] -> %SystemRoot%\SYSTEM32\drivers\VClone.sys -> Elaborate Bytes AG [Ver = 5, 1, 1, 0 | Size = 24320 bytes | Modified Date = 22/04/2006 20:59:21 | Attr =    ]
    (xmm13g) MMX2 virtualization service [Kernel | Auto | Stopped] -> %SystemRoot%\system32\mmx19g.sys -> File not found
    
    [Registry - Non-Microsoft Only]
    < Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
    Adobe Reader Speed Launcher -> D:\My Documents\Reader\Reader_sl.exe ["D:\My Documents\Reader\Reader_sl.exe"] -> Adobe Systems Incorporated [Ver = 8.0.0.0 | Size = 39792 bytes | Modified Date = 11/01/2008 22:16:38 | Attr =    ]
    AppleSyncNotifier -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe] -> Apple Inc. [Ver = 1, 1, 0, 0 | Size = 111936 bytes | Modified Date = 03/09/2008 20:12:50 | Attr =    ]
    avast! -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe [C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe] -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 78008 bytes | Modified Date = 19/07/2008 15:38:34 | Attr =    ]
    BJCFD -> %ProgramFiles%\BroadJump\Client Foundation\CFD.exe [C:\Program Files\BroadJump\Client Foundation\CFD.exe] -> File not found
    EM_EXEC -> %ProgramFiles%\Logitech\MouseWare\system\EM_EXEC.EXE [C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE] -> Logitech Inc.                     [Ver = 9.41.33 | Size = 35328 bytes | Modified Date = 19/09/2001 09:41:00 | Attr =    ]
    iTunesHelper -> D:\My Documents\iTunes\iTunesHelper.exe ["D:\My Documents\iTunes\iTunesHelper.exe"] -> Apple Inc. [Ver = 8.0.0.35 | Size = 289576 bytes | Modified Date = 10/09/2008 17:40:06 | Attr =    ]
    OnlineArmor GUI -> D:\My Documents\Online Armor\oaui.exe ["D:\My Documents\Online Armor\oaui.exe"] -> Tall Emu  [Ver = 2.1.0.131 | Size = 5545536 bytes | Modified Date = 17/04/2008 05:25:26 | Attr =    ]
    QuickTime Task -> D:\My Documents\qttask.exe ["D:\My Documents\qttask.exe" -atboottime] -> Apple Inc. [Ver = 7.5.5 (990.7) | Size = 413696 bytes | Modified Date = 06/09/2008 15:09:14 | Attr =    ]
    SmartDefrag -> %ProgramFiles%\IObit\IObit SmartDefrag\IObit SmartDefrag.exe ["C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp] ->  [Ver =  | Size = 2736384 bytes | Modified Date = 19/10/2007 13:25:54 | Attr =    ]
    SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_05\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 144784 bytes | Modified Date = 22/02/2008 04:25:21 | Attr =    ]
    VirtualCloneDrive -> F:\VirtualCloneDrive\VCDDaemon.exe ["F:\VirtualCloneDrive\VCDDaemon.exe" /s] -> File not found
    WinampAgent -> d:\My Documents\Winamp\winampa.exe ["d:\My Documents\Winamp\winampa.exe"] -> File not found
    < Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
    BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} -> %CommonProgramFiles%\Ahead\Lib\NMBgMonitor.exe ["C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"] -> File not found
    DAEMON Tools -> %ProgramFiles%\DAEMON Tools\daemon.exe ["C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033] -> DT Soft Ltd. [Ver = 4.08.0.0 | Size = 157592 bytes | Modified Date = 12/11/2006 11:48:46 | Attr =    ]
    Skype -> %ProgramFiles%\Skype\Phone\Skype.exe ["C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized] -> Skype Technologies S.A. [Ver = 3.8.0.154 | Size = 21741864 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
    < All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
    < oemstudent Startup Folder > -> C:\Documents and Settings\oemstudent\Start Menu\Programs\Startup -> 
    < ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 
    {4F07DA45-8170-4859-9B5F-037EF2970034} [HKEY_LOCAL_MACHINE] -> D:\MYDOCU~1\ONLINE~1\oaevent.dll [OA Shell Helper] -> Tall Emu [Ver = 2.1.0.131 | Size = 671432 bytes | Modified Date = 17/04/2008 05:25:46 | Attr =    ]
    < SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> 
    < Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
    *Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
    Explorer.exe -> %SystemRoot%\explorer.exe -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 11:23:07 | Attr =    ]
    *MultiFile Done* -> -> 
    *UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> 
    C:\WINDOWS\system32\userinit.exe -> %SystemRoot%\SYSTEM32\userinit.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 24576 bytes | Modified Date = 04/08/2004 00:56:58 | Attr =    ]
    *MultiFile Done* -> -> 
    *UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost -> 
    logonui.exe -> %SystemRoot%\SYSTEM32\logonui.exe -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 514560 bytes | Modified Date = 04/08/2004 00:56:52 | Attr =    ]
    *MultiFile Done* -> -> 
    *VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 
    rundll32 shell32 -> %SystemRoot%\SYSTEM32\shell32.dll -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_gdr.071025-1248) | Size = 8454656 bytes | Modified Date = 26/10/2007 04:36:51 | Attr =    ]
    Control_RunDLL "sysdm.cpl" -> %SystemRoot%\SYSTEM32\sysdm.cpl -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 298496 bytes | Modified Date = 04/08/2004 00:56:58 | Attr =    ]
    *MultiFile Done* -> -> 
    < Winlogon settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
    < Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
    klogon -> %SystemRoot%\SYSTEM32\klogon.dll -> Kaspersky Lab [Ver = 7.0.0.125 | Size = 206088 bytes | Modified Date = 28/06/2007 12:51:48 | Attr =    ]
    < CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> 
    Reg Error: Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ not found. -> -> 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\dontdisplaylastusername -> 0 -> 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\legalnoticecaption ->  -> 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\legalnoticetext ->  -> 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\shutdownwithoutlogon -> 1 -> 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\undockwithoutlogon -> 1 -> 
    < CurrentVersion Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> 
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> 
    Reg Error: Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ not found. -> -> 
    < CDROM Autorun Setting > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\ -> ->
    *DependOnGroup* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DependOnGroup -> 
    SCSI miniport ->  -> File not found
    *MultiFile Done* -> -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ErrorControl -> 1 -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Group -> SCSI CDROM Class -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Start -> 1 -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Tag -> 2 -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Type -> 1 -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DisplayName -> CD-ROM Driver -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ImagePath -> %SystemRoot%\SYSTEM32\drivers\cdrom.sys [System32\DRIVERS\cdrom.sys] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 49536 bytes | Modified Date = 03/08/2004 22:59:54 | Attr =    ]
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun -> 1 -> 
    *AutoRunAlwaysDisable* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRunAlwaysDisable -> 
    NEC     MBR-7    ->  -> File not found
    NEC     MBR-7.4  ->  -> File not found
    PIONEER CHANGR DRM-1804X ->  -> File not found
    PIONEER CD-ROM DRM-6324X ->  -> File not found
    PIONEER CD-ROM DRM-624X  ->  -> File not found
    TORiSAN CD-ROM CDR_C36 ->  -> File not found
    *MultiFile Done* -> -> 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\ -> -> 
    < Drives with AutoRun files > ->  -> 
    AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] ->  [Ver =  | Size = 0 bytes | Modified Date = 23/10/2001 21:54:40 | Attr =    ]
    < HOSTS File > (224610 bytes and 7926 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 
    First 25 entries...
    127.0.0.1       localhost
    127.0.0.1	www.007guard.com
    127.0.0.1	007guard.com
    127.0.0.1	008i.com
    127.0.0.1	www.008k.com
    127.0.0.1	008k.com
    127.0.0.1	www.00hq.com
    127.0.0.1	00hq.com
    127.0.0.1	010402.com
    127.0.0.1	www.032439.com
    127.0.0.1	032439.com
    127.0.0.1	www.1001-search.info
    127.0.0.1	1001-search.info
    127.0.0.1	www.100888290cs.com
    127.0.0.1	100888290cs.com
    127.0.0.1	www.100sexlinks.com
    127.0.0.1	100sexlinks.com
    127.0.0.1	www.10sek.com
    127.0.0.1	10sek.com
    127.0.0.1	www.123topsearch.com
    127.0.0.1	123topsearch.com
    127.0.0.1	www.132.com
    127.0.0.1	132.com
    127.0.0.1	www.136136.net
    127.0.0.1	136136.net
    < Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
    HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 
    HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
    HKEY_LOCAL_MACHINE\: Main\\Local Page -> %SystemRoot%\system32\blank.htm -> 
    HKEY_LOCAL_MACHINE\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
    HKEY_LOCAL_MACHINE\: Main\\Start Page -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home -> 
    HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
    HKEY_LOCAL_MACHINE\: Search\\SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> 
    < Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
    HKEY_CURRENT_USER\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm -> 
    HKEY_CURRENT_USER\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
    HKEY_CURRENT_USER\: Main\\Start Page -> http://www.ntlworld.com/ -> 
    HKEY_CURRENT_USER\: ProxyEnable -> 0 -> 
    HKEY_CURRENT_USER\: ProxyOverride -> 127.0.0.1;*.local -> 
    < Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4800 domain(s) found. -> 
    46 domain(s) and sub-domain(s) not assigned to a zone.
    < Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> 
    < Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4822 domain(s) found. -> 
    www_excite.com [http] -> Trusted sites -> 
    45 domain(s) and sub-domain(s) not assigned to a zone.
    < Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> 
    < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKEY_LOCAL_MACHINE] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 8.0.0.2006102200 | Size = 62080 bytes | Modified Date = 23/10/2006 00:08:42 | Attr =    ]
    {53707962-6F74-2D53-2644-206D7942484F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 28/01/2008 12:43:28 | Attr =    ]
    {6165D324-3AAF-4C63-B545-C7D2285BEA1C} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\ReadAndWrite6\thbho.dll [baloudHelperObj Class] -> textHELP Systems Ltd [Ver = 1, 0, 0, 3 | Size = 40960 bytes | Modified Date = 12/02/2002 11:19:18 | Attr =    ]
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 509328 bytes | Modified Date = 22/02/2008 04:25:19 | Attr =    ]
    < Internet Explorer Bars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ -> 
    {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.] -> File not found
    < Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
    {08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\npjpi160_05.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 132496 bytes | Modified Date = 22/02/2008 04:25:19 | Attr =    ]
    {08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} [HKEY_CURRENT_USER] -> %ProgramFiles%\Java\jre1.6.0_05\bin\ssv.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 509328 bytes | Modified Date = 22/02/2008 04:25:19 | Attr =    ]
    {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 28/01/2008 12:43:28 | Attr =    ]
    < Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 
    CmdMapping\\{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} [HKEY_LOCAL_MACHINE] ->  [Reg Error: Key does not exist or could not be opened.] -> File not found
    CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 28/01/2008 12:43:28 | Attr =    ]
    < Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
    PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
    PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
    < User Agent Post Platform [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform -> 
    SV1 ->  -> 
    < DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
    {1809FEDC-1A7D-493A-93FB-72A99825E6DC} ->    (SMC EZ Card 10/100 Fast Ethernet PCI Network Adapter) -> 
    < Winsock2 Catalogs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\ -> 
    NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] -> %ProgramFiles%\Bonjour\mdnsNSP.dll -> Apple Inc. [Ver = 1,0,5,11 | Size = 147456 bytes | Modified Date = 29/08/2008 09:53:50 | Attr =    ]
    < Protocol Handlers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ -> 
    ipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
    msdaipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
    skype4com:{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} [HKEY_LOCAL_MACHINE] -> %CommonProgramFiles%\Skype\Skype4COM.dll[IEProtocolHandler Class] -> Skype Technologies [Ver = 1, 0, 29, 0 | Size = 1942864 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
    < Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
    {8AD9C840-044E-11D1-B3E9-00805F499D93}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab[Java Plug-in 1.6.0_05] -> 
    {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab[Java Plug-in 1.6.0_04] -> 
    {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab[Java Plug-in 1.6.0_05] -> 
    {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab[Java Plug-in 1.6.0_05] -> 
    {D27CDB6E-AE6D-11CF-96B8-444553540000}[HKEY_LOCAL_MACHINE] -> http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab[Shockwave Flash Object] -> 
    < Module Usage Keys [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> 
    Reg Error: Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ not found. -> -> 
    
    
    
    [Files/Folders - Created Within 30 days]
    rsit -> %SystemDrive%\rsit ->  [Folder | Created Date = 30/09/2008 18:28:15 | Attr =    ]
    CatRoot_bak -> %SystemRoot%\System32\CatRoot_bak ->  [Folder | Created Date = 09/09/2008 08:30:20 | Attr =    ]
    3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
    
    [Files/Folders - Modified Within 30 days]
    hosts -> %SystemRoot%\System32\drivers\etc\hosts ->  [Ver =  | Size = 224610 bytes | Modified Date = 01/09/2008 07:12:03 | Attr =    ]
    hosts.idx -> %SystemRoot%\System32\drivers\etc\hosts.idx ->  [Ver =  | Size = 72540 bytes | Modified Date = 30/09/2008 17:38:12 | Attr =    ]
    3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
    wpa.dbl -> %SystemRoot%\System32\wpa.dbl ->  [Ver =  | Size = 1170 bytes | Modified Date = 17/09/2008 16:21:49 | Attr =    ]
    2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 
    bootstat.dat -> %SystemRoot%\bootstat.dat ->  [Ver =  | Size = 2048 bytes | Modified Date = 30/09/2008 17:37:59 | Attr =   S]
    imsins.BAK -> %SystemRoot%\imsins.BAK ->  [Ver =  | Size = 1374 bytes | Modified Date = 18/09/2008 12:39:36 | Attr =    ]
    AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job ->  [Ver =  | Size = 284 bytes | Modified Date = 19/09/2008 10:15:37 | Attr =    ]
    SA.DAT -> %SystemRoot%\tasks\SA.DAT ->  [Ver =  | Size = 6 bytes | Modified Date = 30/09/2008 17:38:18 | Attr =  H ]
    SmartDefrag.job -> %SystemRoot%\tasks\SmartDefrag.job ->  [Ver =  | Size = 356 bytes | Modified Date = 21/09/2008 22:00:00 | Attr =    ]
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader ->  [Folder | Modified Date = 13/08/2007 08:54:17 | Attr =    ]
    qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat ->  [Ver =  | Size = 4232 bytes | Modified Date = 18/09/2008 08:32:46 | Attr =    ]
    qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ->  [Ver =  | Size = 5514 bytes | Modified Date = 18/09/2008 08:32:46 | Attr =    ]
    C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data ->  [Folder | Modified Date = 10/10/2006 10:59:31 | Attr =    ]
    data.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\data.dat ->  [Ver =  | Size = 1388 bytes | Modified Date = 02/07/2007 16:27:21 | Attr =    ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp ->  [Folder | Modified Date = 30/09/2008 20:45:15 | Attr =    ]
    A~NSISu_.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\A~NSISu_.exe -> Lime Wire LLC [Ver = 4.18.8 | Size = 124421 bytes | Modified Date = 19/09/2008 09:55:58 | Attr =    ]
    182 C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp -> 
    C:\Documents and Settings\oemstudent\Local Settings\Temp\~nsu.tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\~nsu.tmp\ ->  [Folder | Modified Date = 30/09/2008 20:41:48 | Attr =    ]
    Au_.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\~nsu.tmp\Au_.exe ->  [Ver =  | Size = 34196 bytes | Modified Date = 10/02/2008 13:05:02 | Attr =    ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
    Setup.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Setup.exe -> InstallShield Software Corporation [Ver = 5, 52, 164, 0 | Size = 73728 bytes | Modified Date = 12/01/1999 11:42:20 | Attr = R  ]
    _ISDel.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\_ISDel.exe -> InstallShield Software Corporation [Ver = 5, 51, 138, 0 | Size = 27648 bytes | Modified Date = 27/10/1998 12:06:48 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
    AcroRd32.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\AcroRd32.exe -> Adobe Systems Incorporated [Ver = 5.0.1.2001032700 | Size = 3870784 bytes | Modified Date = 27/03/2001 21:44:58 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp ->  [Folder | Modified Date = 30/09/2008 20:45:15 | Attr =    ]
    i6hhuksj.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\i6hhuksj.dll ->  [Ver =  | Size = 0 bytes | Modified Date = 19/05/2008 08:37:08 | Attr =    ]
    swt-awt-win32-3346.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\swt-awt-win32-3346.dll -> Eclipse Foundation [Ver = 3.346 | Size = 32768 bytes | Modified Date = 05/02/2008 19:51:23 | Attr =    ]
    swt-win32-3346.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\swt-win32-3346.dll -> Eclipse Foundation [Ver = 3.346 | Size = 307200 bytes | Modified Date = 05/02/2008 19:51:23 | Attr =    ]
    182 C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp -> 
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
    _Setup.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\_Setup.dll -> InstallShield Software Corporation [Ver = 5, 50, 134, 0 | Size = 34816 bytes | Modified Date = 29/09/1998 16:34:56 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
    AceLite.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\AceLite.dll -> Adobe Systems, Incorporated [Ver = 1.02.00 | Size = 397312 bytes | Modified Date = 28/02/2001 09:29:36 | Attr = R  ]
    ACROFX32.DLL -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\ACROFX32.DLL ->  [Ver =  | Size = 53248 bytes | Modified Date = 12/05/2000 18:30:02 | Attr = R  ]
    Agm.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Agm.dll -> Adobe Systems, Incorporated [Ver = 4.04.26 | Size = 1138688 bytes | Modified Date = 14/03/2001 10:06:02 | Attr = R  ]
    Bib.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Bib.dll -> Adobe Systems, Incorporated [Ver = 1.0.20 | Size = 147456 bytes | Modified Date = 20/01/2001 22:13:36 | Attr = R  ]
    CoolType.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\CoolType.dll -> Adobe Systems, Incorporated [Ver = 4.04.26 | Size = 1441792 bytes | Modified Date = 14/03/2001 10:06:02 | Attr = R  ]
    msvcp60.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\msvcp60.dll -> Microsoft Corporation [Ver = 6.00.8168.0 | Size = 401462 bytes | Modified Date = 01/12/1999 00:40:28 | Attr = R  ]
    msvcrt.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\msvcrt.dll -> Microsoft Corporation [Ver = 6.00.8397.0 | Size = 266293 bytes | Modified Date = 11/02/1999 03:33:58 | Attr = R  ]
    oleaut32.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\oleaut32.dll -> Microsoft Corporation [Ver = 2.30.4261 | Size = 598288 bytes | Modified Date = 18/06/1998 11:33:08 | Attr = R  ]
    WHA Library.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\WHA Library.dll -> Adobe Systems Incorporated [Ver = 0.2.0.0 | Size = 167936 bytes | Modified Date = 15/03/2001 06:14:38 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Browser\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Browser ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
    nppdf32.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Browser\nppdf32.dll -> Adobe Systems Inc. [Ver = 5.0.0.2001031500 | Size = 103312 bytes | Modified Date = 26/02/2001 21:48:44 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\InterTrust\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\InterTrust ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
    NPDocBox.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\InterTrust\NPDocBox.dll -> InterTrust Technologies Corporation, Inc. [Ver = 1.0.30.95 | Size = 225280 bytes | Modified Date = 14/03/2001 04:52:06 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
    QT2.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\QT2.dll -> Adobe Systems, Inc. [Ver = 5.0.0.0 | Size = 24576 bytes | Modified Date = 15/03/2001 06:00:24 | Attr = R  ]
    QT3.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\QT3.dll -> Adobe Systems, Inc. [Ver = 5.0.0.0 | Size = 32768 bytes | Modified Date = 15/03/2001 06:00:42 | Attr = R  ]
    QT4.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\QT4.dll -> Adobe Systems, Inc. [Ver = 5.0.0.0 | Size = 36864 bytes | Modified Date = 15/03/2001 06:01:02 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Uninstall\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Uninstall ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
    Uninst.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Uninstall\Uninst.dll -> Adobe Systems, Inc. [Ver = 4.0.11 | Size = 81920 bytes | Modified Date = 26/02/2001 21:48:44 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files ->  [Folder | Modified Date = 30/05/2002 11:30:36 | Attr =    ]
    NPSVGVw.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\NPSVGVw.dll -> Adobe Systems Inc. [Ver = 2, 0, 0, 55 | Size = 299059 bytes | Modified Date = 14/03/2001 14:10:56 | Attr = R  ]
    SVGControl.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGControl.dll -> Adobe Systems Incorporated [Ver = 2, 0, 0, 55 | Size = 491574 bytes | Modified Date = 14/03/2001 14:14:00 | Attr = R  ]
    SVGRSRC.DLL -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGRSRC.DLL ->  [Ver =  | Size = 12288 bytes | Modified Date = 14/03/2001 14:06:24 | Attr = R  ]
    SVGView.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGView.dll -> Adobe Systems Incorporated [Ver = 2, 0, 0, 55 | Size = 1597491 bytes | Modified Date = 14/03/2001 14:07:52 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
    lang.dat -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\lang.dat ->  [Ver =  | Size = 23541 bytes | Modified Date = 12/01/1999 10:34:42 | Attr = R  ]
    os.dat -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\os.dat ->  [Ver =  | Size = 450 bytes | Modified Date = 27/07/1998 17:41:06 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp ->  [Folder | Modified Date = 30/09/2008 20:45:15 | Attr =    ]
    {AC76BA86-7AD7-1033-7B44-A81200000003}.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\{AC76BA86-7AD7-1033-7B44-A81200000003}.ini ->  [Ver =  | Size = 568 bytes | Modified Date = 12/02/2008 10:36:09 | Attr =    ]
    182 C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp -> 
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
    Abcpy.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Abcpy.ini ->  [Ver =  | Size = 3026 bytes | Modified Date = 04/04/2001 14:57:10 | Attr = R  ]
    SETUP.INI -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SETUP.INI ->  [Ver =  | Size = 103 bytes | Modified Date = 28/03/2001 15:30:20 | Attr = R  ]
    C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files ->  [Folder | Modified Date = 30/05/2002 11:30:36 | Attr =    ]
    SVGViewer.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGViewer.ini ->  [Ver =  | Size = 0 bytes | Modified Date = 09/03/2001 11:13:50 | Attr = R  ]
    C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp ->  [Folder | Modified Date = 30/09/2008 17:44:13 | Attr =    ]
    QRImage.exe -> C:\WINDOWS\Temp\QRImage.exe ->  [Ver =  | Size = 1253376 bytes | Modified Date = 15/10/2001 11:01:04 | Attr =    ]
    ulogin125.exe -> C:\WINDOWS\Temp\ulogin125.exe ->  [Ver =  | Size = 353 bytes | Modified Date = 01/11/2006 00:56:58 | Attr =    ]
    732 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 
    C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp ->  [Folder | Modified Date = 30/09/2008 17:44:13 | Attr =    ]
    INSTALL.DLL -> C:\WINDOWS\Temp\INSTALL.DLL -> XSS [Ver = 1, 0, 0, 0 | Size = 45056 bytes | Modified Date = 20/06/2001 02:43:00 | Attr =    ]
    732 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 
    C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp ->  [Folder | Modified Date = 30/09/2008 17:44:13 | Attr =    ]
    Perflib_Perfdata_234.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_234.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 09/10/2006 17:55:08 | Attr =    ]
    Perflib_Perfdata_4e4.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_4e4.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 20/09/2007 07:47:06 | Attr =    ]
    Perflib_Perfdata_544.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_544.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 13/03/2008 10:18:44 | Attr =    ]
    Perflib_Perfdata_578.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_578.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 03/09/2008 16:21:35 | Attr =    ]
    Perflib_Perfdata_580.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_580.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 22/08/2008 16:29:31 | Attr =    ]
    Perflib_Perfdata_584.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_584.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 24/08/2008 08:48:03 | Attr =    ]
    Perflib_Perfdata_58c.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 30/09/2008 14:13:47 | Attr =    ]
    Perflib_Perfdata_594.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_594.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 30/09/2008 17:38:19 | Attr =    ]
    Perflib_Perfdata_598.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_598.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 02/09/2008 17:24:20 | Attr =    ]
    Perflib_Perfdata_5a0.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_5a0.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 25/09/2008 15:05:21 | Attr =    ]
    Perflib_Perfdata_5a8.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_5a8.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 22/05/2008 17:32:58 | Attr =    ]
    Perflib_Perfdata_5e4.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_5e4.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 29/04/2008 07:26:13 | Attr =    ]
    Perflib_Perfdata_604.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_604.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 19/09/2008 09:49:21 | Attr =    ]
    Perflib_Perfdata_618.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_618.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 28/08/2008 18:51:10 | Attr =    ]
    Perflib_Perfdata_6b4.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_6b4.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 02/10/2007 07:21:59 | Attr =    ]
    Perflib_Perfdata_6cc.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_6cc.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 09/11/2007 13:21:30 | Attr =    ]
    Perflib_Perfdata_6d8.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_6d8.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 11/11/2007 19:28:44 | Attr =    ]
    Perflib_Perfdata_6fc.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_6fc.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 02/03/2008 11:53:26 | Attr =    ]
    Perflib_Perfdata_734.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_734.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 15/02/2008 13:53:18 | Attr =    ]
    Perflib_Perfdata_73c.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_73c.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 26/02/2008 16:13:25 | Attr =    ]
    Perflib_Perfdata_750.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_750.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 10/02/2008 10:36:53 | Attr =    ]
    Perflib_Perfdata_754.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_754.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 05/03/2008 16:48:21 | Attr =    ]
    Perflib_Perfdata_778.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_778.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 22/02/2008 10:02:51 | Attr =    ]
    Perflib_Perfdata_77c.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_77c.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 21/01/2008 12:26:53 | Attr =    ]
    Perflib_Perfdata_79c.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_79c.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 13/01/2008 10:35:53 | Attr =    ]
    Perflib_Perfdata_7c4.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_7c4.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 29/01/2008 09:37:03 | Attr =    ]
    732 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 
    C:\WINDOWS\Temp\Cookies\ -> C:\WINDOWS\Temp\Cookies ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    index.dat -> C:\WINDOWS\Temp\Cookies\index.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 13/11/2007 12:17:01 | Attr =    ]
    C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    index.dat -> C:\WINDOWS\Temp\History\History.IE5\index.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 13/11/2007 12:17:01 | Attr =    ]
    C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    index.dat -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat ->  [Ver =  | Size = 32768 bytes | Modified Date = 13/11/2007 12:17:01 | Attr =    ]
    C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp ->  [Folder | Modified Date = 30/09/2008 17:44:13 | Attr =    ]
    QRImage.ini -> C:\WINDOWS\Temp\QRImage.ini ->  [Ver =  | Size = 181 bytes | Modified Date = 23/10/2001 23:21:28 | Attr =    ]
    732 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 
    C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    desktop.ini -> C:\WINDOWS\Temp\History\History.IE5\desktop.ini ->  [Ver =  | Size = 113 bytes | Modified Date = 28/05/2002 13:06:05 | Attr =  HS]
    C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 28/05/2002 13:06:05 | Attr =  HS]
    C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\4HIVSHI3\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\4HIVSHI3 ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\4HIVSHI3\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 28/05/2002 13:06:05 | Attr =  HS]
    C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SHAJCLAR\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SHAJCLAR ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SHAJCLAR\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 28/05/2002 13:06:05 | Attr =  HS]
    C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SPEFWXEV\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SPEFWXEV ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SPEFWXEV\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 28/05/2002 13:06:05 | Attr =  HS]
    C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SPUBO5E3\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SPUBO5E3 ->  [Folder | Modified Date = 28/05/2002 13:06:05 | Attr =   S]
    desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SPUBO5E3\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 28/05/2002 13:06:05 | Attr =  HS]
    
    < End of report >

  6. #6
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Hi Stas_1

    Things are looking good. Do you still notice any problems with your computer?

    1 - Clean temp files

    • Download and Run ATF Cleaner
      Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.Double-click ATF Cleaner.exe to open it.

      Under Main choose:
      • Windows Temp
        Current User Temp
        All Users Temp
        Temporary Internet Files
        Prefetch
        Java Cache

        *The other boxes are optional*
        Then click the Empty Selected button.

      if you use Firefox:
      • Click Firefox at the top and choose: Select All
        Click the Empty Selected button.
        NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

      if you use Opera:
      • Click Opera at the top and choose: Select All
        Click the Empty Selected button.
        NOTE: If you would like to keep your saved passwords, please click NO at the prompt.


      Click Exit on the Main menu to close the program


    2 - Kaspersky Online Scan

    Please go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    9. Please post this log in your next reply.


    3 - Run Hijackthis
    Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

    4- Status Check
    Please reply with

    1. the Kaspersky online scanner report
    2. a fresh HijackThis log

    Thanks peku006
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.

  7. #7
    Junior Member
    Join Date
    Aug 2008
    Posts
    25

    Default

    Good morning Peku006

    The same problems are persisting. The only difference is that after I deleted limewire (really wish I didn’t have to do that) when I go to shut down the computer there is no longer a message popping up saying “unable to shut down. If you proceed any unsaved data will be lost”.

    I’m trying to do the Kaspersky scan, but it keeps coming with the message saying “Starting Java applet has failed! Please go online to use this program.”

    Stas

  8. #8
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Hi Stas_1

    if Kaspersky doesnt work, try this :

    1. Please go to F-Secure website to perform an online scan. Click on Start scanning at the bottom of the page.
    2. You may be prompted to install an ActiveX before you are able to accept the License Agreement. If prompted, please install it. After installing, the Accept button will be available.
    3. Click on Accept to accept the License Agreement.
    4. Click on Custom Scan.
      • Under Virus Scan Options, select the Scan whole system option.
      • Under Other Scan Options, select these options:
        • Scan all files
        • Scan whole system for rootkits
        • Scan whole system for spyware
        • Scan inside archives
        • Use advanced heuristics
    5. Click Start.
    6. It will start installing the scanner and virus definitions. Once the installation is done, it will start scanning automatically. This takes a while. Please be patient.
    7. Click on I want decide item by item.
    8. Under Actions, select None for all infections found.
    9. Click Next.
    10. Click on Show Report.
    11. Please copy and paste this report in your next reply.
    12. Click Finish.
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.

  9. #9
    Junior Member
    Join Date
    Aug 2008
    Posts
    25

    Default

    Hi Peku006

    I did a kaspersky scan it found absolutely nothing. But just this morning I had a firewall warning saying that my computer was trying to connect to someone else’s.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:58:05, on 01/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    D:\My Documents\Online Armor\oasrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
    D:\My Documents\Online Armor\oaui.exe
    D:\My Documents\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\ScanningProcess.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: baloudHelperObj Class - {6165D324-3AAF-4C63-B545-C7D2285BEA1C} - C:\Program Files\ReadAndWrite6\thbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [VirtualCloneDrive] "F:\VirtualCloneDrive\VCDDaemon.exe" /s
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\My Documents\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [WinampAgent] "d:\My Documents\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [OnlineArmor GUI] "D:\My Documents\Online Armor\oaui.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "D:\My Documents\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "D:\My Documents\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKUS\S-1-5-21-1083768841-1909347950-600669434-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
    O4 - HKUS\S-1-5-21-1083768841-1909347950-600669434-1003\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.excite.com
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - D:\My Documents\Online Armor\oasrv.exe
    O24 - Desktop Component 1: (no name) - C:\Student_Info\index.html

    --
    End of file - 6703 bytes

  10. #10
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Hi

    But just this morning I had a firewall warning saying that my computer was trying to connect to someone else’s.
    Where, and which program ?

    Things are looking good. Do you still notice any problems with your computer?
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •