Computer dying

[Stas_1]

Hi
I’m afraid I didn’t make a not of the program, I just blockt it ASAP.
Basically all the problems mentioned in the first post are still persisting.

These are the same problems I had when the computer got infected about a year ago. But as soon as the virus was deleted everything went back to normal.


Stas

[peku006]

Hi Stas_1

I seem to have a virus/spyware on my PC.

Can you tell me which program finds those and where they are located?

And Spybot is no longer able to detect anything.

I am not exactly sure what you mean....what should spybot detect

But just this morning I had a firewall warning saying that my computer was trying to connect to someone else’s.

When you update your avast anti virus or ?
Please explain more details

1 - uninstall list

Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

2 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

3 - Status Check
Please reply with


1. the uninstall list
2. a fresh HijackThis log
Can you please answer my questions
Thanks peku006

[Stas_1]

Good evening
Answers to your questions:-

1. No program is finding anything regardless of the symptoms (mentioned in first post).

2. Spybot used to detect spyware Trojans etc. a minimum of one per week often more. For the past several months spybot has not detected anything.

3. The firewall warning came up randomly, I was not doing anything in particular, maybe even looking at this site.



ABBYY FineReader 6.0 Professional
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.2
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 3.0
avast! Antivirus
BitLord 1.1
Bonjour
BroadJump Client Foundation
Copy Utility
DivX Codec
DivX Converter
DivX Player
DivX Web Player
EPSON Photo Print
EPSON Printer Software
EPSON Smart Panel
EPSON TWAIN 5
Google Earth
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Inspiration 6 UK
IObit SmartDefrag Beta4.01
iTunes
Java(TM) 6 Update 4
Java(TM) 6 Update 5
K-Lite Codec Pack 2.79 Standard
L&H TTS3000 British English
Lernout & Hauspie TruVoice American English TTS Engine
Logitech MouseWare 9.41 .1
Logitech Resource Center
Logitech User's Guide
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft AutoRoute 2006
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office XP Professional
Microsoft User-Mode Driver Framework Feature Pack 1.0
MobileMe Control Panel
Mozilla Firefox (3.0.3)
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB936181)
neroxml
Online Armor 2.1
Opera 9.52
PFConfig 1.0.187
PowerDVD
QuickTime
Read and Write 6
ScanToWeb
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Skype™ 3.8
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
SUPER © Version 2008.bld.25 (Feb 5, 2008)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB951072-v2)
VideoLAN VLC media player 0.8.6f
VirtualCloneDrive
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB885894
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WS-5614PASG


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50:53, on 01/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\My Documents\Online Armor\oasrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
D:\My Documents\Online Armor\oaui.exe
D:\My Documents\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: baloudHelperObj Class - {6165D324-3AAF-4C63-B545-C7D2285BEA1C} - C:\Program Files\ReadAndWrite6\thbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [VirtualCloneDrive] "F:\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\My Documents\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [WinampAgent] "d:\My Documents\Winamp\winampa.exe"
O4 - HKLM\..\Run: [OnlineArmor GUI] "D:\My Documents\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\My Documents\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\My Documents\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.excite.com
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - D:\My Documents\Online Armor\oasrv.exe
O24 - Desktop Component 1: (no name) - C:\Student_Info\index.html

--
End of file - 6259 bytes

[peku006]

Hi

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

BitLord


I'd like you to read this thread

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).NOW

1. No program is finding anything regardless of the symptoms (mentioned in first post).

2. Spybot used to detect spyware Trojans etc. a minimum of one per week often more. For the past several months spybot has not detected anything.

I'm not seeing anything malicious in your logs.....your computer is clean

The firewall warning came up randomly, I was not doing anything in particular, maybe even looking at this site.

Ok,what's that message says ?

[Stas_1]

Hi peku006

1. Bitlord used to be on an external hard drive which I no longer have. When I go to try and remove it the computer says it cannot do so as it is located on another drive.

2. I realise that nothing malicious is coming up in logs, but I do know my computer well and the symptoms it’s displaying are exactly the same as when I have had viruses in the past.

3. The message that came up said something along the lines of “your computer is attempting to connect to …something something… every time you go the address … your computer will be redirected… to this other computer”

[peku006]

Hi Stas_1

but I do know my computer well and the symptoms it’s displaying are exactly the same as when I have had viruses in the past.

What what kind of "virus"

1. Please download FixPolicies.exe by Bill Castner and save it to your desktop.
2. Double click on FixPolicies.exe to run it.
3. Click on Install. It will create a folder named FixPolicies on your desktop.
4. Open the FixPolicies folder.
5. Double click on Fix_policies.cmd to run it. Command Prompt will open and close quickly; this is normal.

Start OTScanIt. Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Registry - Non-Microsoft Only]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> 
YN -> HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
YN -> HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
YN -> HKEY_LOCAL_MACHINE\: Main\\Local Page -> %SystemRoot%\system32\blank.htm
YN -> HKEY_LOCAL_MACHINE\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
YN -> HKEY_LOCAL_MACHINE\: Main\\Start Page -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
YN -> HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
YN -> HKEY_LOCAL_MACHINE\: Search\\SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> 
YN -> HKEY_CURRENT_USER\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm
YN -> HKEY_CURRENT_USER\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

If it doesn't run scan automatically, click Run Scan

Post back a fresh OTScanIt log, please.

[Stas_1]

Good afternoon

I’m not shore what type of viruses they were last time, maybe Trojans.

OTScanIt logfile created on: 03/10/2008 15:54:39
OTScanIt by OldTimer - Version 1.0.19.0     Folder = d:\My Documents\OTScanIt
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
 
767.48 Mb Total Physical Memory | 384.30 Mb Available Physical Memory | 50.07% Memory free
1.08 Gb Paging File | 0.69 Gb Available in Paging File | 63.51% Paging File free
Paging file location(s): C:\pagefile.sys 384 768;
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 9.77 Gb Total Space | 0.56 Gb Free Space | 5.76% Space Free | Partition Type: NTFS
Drive D: | 27.49 Gb Total Space | 6.14 Gb Free Space | 22.34% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: STANISLAVS
Current User Name: oemstudent
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Whitelist: On

[Processes - Non-Microsoft Only]
oasrv.exe -> D:\My Documents\Online Armor\oasrv.exe -> Tall Emu [Ver = 2.1.0.131 | Size = 5435968 bytes | Modified Date = 17/04/2008 05:25:28 | Attr =    ]
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 16056 bytes | Modified Date = 19/07/2008 15:25:06 | Attr =    ]
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 147640 bytes | Modified Date = 19/07/2008 15:38:28 | Attr =    ]
slserv.exe -> %SystemRoot%\SYSTEM32\slserv.exe ->   [Ver = 2.80.00(24Apr2000) | Size = 45056 bytes | Modified Date = 21/11/2001 07:14:00 | Attr =    ]
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 250040 bytes | Modified Date = 19/07/2008 15:38:04 | Attr =    ]
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 8, 1229, 0 | Size = 348344 bytes | Modified Date = 23/07/2008 15:25:45 | Attr =    ]
em_exec.exe -> %ProgramFiles%\Logitech\MouseWare\system\EM_EXEC.EXE -> Logitech Inc.                     [Ver = 9.41.33 | Size = 35328 bytes | Modified Date = 19/09/2001 09:41:00 | Attr =    ]
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 78008 bytes | Modified Date = 19/07/2008 15:38:34 | Attr =    ]
iobit smartdefrag.exe -> %ProgramFiles%\IObit\IObit SmartDefrag\IObit SmartDefrag.exe ->  [Ver =  | Size = 2736384 bytes | Modified Date = 19/10/2007 13:25:54 | Attr =    ]
oaui.exe -> D:\My Documents\Online Armor\oaui.exe -> Tall Emu  [Ver = 2.1.0.131 | Size = 5545536 bytes | Modified Date = 17/04/2008 05:25:26 | Attr =    ]
daemon.exe -> %ProgramFiles%\DAEMON Tools\daemon.exe -> DT Soft Ltd. [Ver = 4.08.0.0 | Size = 157592 bytes | Modified Date = 12/11/2006 11:48:46 | Attr =    ]
skype.exe -> %ProgramFiles%\Skype\Phone\Skype.exe -> Skype Technologies S.A. [Ver = 3.8.0.154 | Size = 21741864 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
skypepm.exe -> %ProgramFiles%\Skype\Plugin Manager\skypePM.exe -> Skype Technologies [Ver = 2.0.0.58 | Size = 76744 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
opera.exe -> %ProgramFiles%\Opera\opera.exe -> Opera Software [Ver = 10108 | Size = 98816 bytes | Modified Date = 14/08/2008 15:52:32 | Attr =    ]

[Win32 Services - Non-Microsoft Only]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 16056 bytes | Modified Date = 19/07/2008 15:25:06 | Attr =    ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 147640 bytes | Modified Date = 19/07/2008 15:38:28 | Attr =    ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 250040 bytes | Modified Date = 19/07/2008 15:38:04 | Attr =    ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 8, 1229, 0 | Size = 348344 bytes | Modified Date = 23/07/2008 15:25:45 | Attr =    ]
(NMIndexingService) NMIndexingService [Win32_Own | Disabled | Stopped] -> %CommonProgramFiles%\Ahead\Lib\NMIndexingService.exe -> File not found
(SLService) SmartLinkService [Win32_Own | Auto | Running] -> %SystemRoot%\SYSTEM32\slserv.exe ->   [Ver = 2.80.00(24Apr2000) | Size = 45056 bytes | Modified Date = 21/11/2001 07:14:00 | Attr =    ]
(SvcOnlineArmor) Online Armor [Win32_Own | Auto | Running] -> D:\My Documents\Online Armor\oasrv.exe -> Tall Emu [Ver = 2.1.0.131 | Size = 5435968 bytes | Modified Date = 17/04/2008 05:25:28 | Attr =    ]

[Registry - Non-Microsoft Only]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
Adobe Reader Speed Launcher -> D:\My Documents\Reader\Reader_sl.exe ["D:\My Documents\Reader\Reader_sl.exe"] -> Adobe Systems Incorporated [Ver = 8.0.0.0 | Size = 39792 bytes | Modified Date = 11/01/2008 22:16:38 | Attr =    ]
AppleSyncNotifier -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe] -> Apple Inc. [Ver = 1, 1, 0, 0 | Size = 111936 bytes | Modified Date = 03/09/2008 20:12:50 | Attr =    ]
avast! -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe [C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe] -> ALWIL Software [Ver = 4, 8, 1227, 0 | Size = 78008 bytes | Modified Date = 19/07/2008 15:38:34 | Attr =    ]
BJCFD -> %ProgramFiles%\BroadJump\Client Foundation\CFD.exe [C:\Program Files\BroadJump\Client Foundation\CFD.exe] -> File not found
EM_EXEC -> %ProgramFiles%\Logitech\MouseWare\system\EM_EXEC.EXE [C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE] -> Logitech Inc.                     [Ver = 9.41.33 | Size = 35328 bytes | Modified Date = 19/09/2001 09:41:00 | Attr =    ]
iTunesHelper -> D:\My Documents\iTunes\iTunesHelper.exe ["D:\My Documents\iTunes\iTunesHelper.exe"] -> Apple Inc. [Ver = 8.0.0.35 | Size = 289576 bytes | Modified Date = 10/09/2008 17:40:06 | Attr =    ]
OnlineArmor GUI -> D:\My Documents\Online Armor\oaui.exe ["D:\My Documents\Online Armor\oaui.exe"] -> Tall Emu  [Ver = 2.1.0.131 | Size = 5545536 bytes | Modified Date = 17/04/2008 05:25:26 | Attr =    ]
QuickTime Task -> D:\My Documents\qttask.exe ["D:\My Documents\qttask.exe" -atboottime] -> Apple Inc. [Ver = 7.5.5 (990.7) | Size = 413696 bytes | Modified Date = 06/09/2008 15:09:14 | Attr =    ]
SmartDefrag -> %ProgramFiles%\IObit\IObit SmartDefrag\IObit SmartDefrag.exe ["C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp] ->  [Ver =  | Size = 2736384 bytes | Modified Date = 19/10/2007 13:25:54 | Attr =    ]
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_05\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 144784 bytes | Modified Date = 22/02/2008 04:25:21 | Attr =    ]
VirtualCloneDrive -> F:\VirtualCloneDrive\VCDDaemon.exe ["F:\VirtualCloneDrive\VCDDaemon.exe" /s] -> File not found
WinampAgent -> d:\My Documents\Winamp\winampa.exe ["d:\My Documents\Winamp\winampa.exe"] -> File not found
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} -> %CommonProgramFiles%\Ahead\Lib\NMBgMonitor.exe ["C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"] -> File not found
DAEMON Tools -> %ProgramFiles%\DAEMON Tools\daemon.exe ["C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033] -> DT Soft Ltd. [Ver = 4.08.0.0 | Size = 157592 bytes | Modified Date = 12/11/2006 11:48:46 | Attr =    ]
Skype -> %ProgramFiles%\Skype\Phone\Skype.exe ["C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized] -> Skype Technologies S.A. [Ver = 3.8.0.154 | Size = 21741864 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
< oemstudent Startup Folder > -> C:\Documents and Settings\oemstudent\Start Menu\Programs\Startup -> 
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 
{4F07DA45-8170-4859-9B5F-037EF2970034} [HKEY_LOCAL_MACHINE] -> D:\MYDOCU~1\ONLINE~1\oaevent.dll [OA Shell Helper] -> Tall Emu [Ver = 2.1.0.131 | Size = 671432 bytes | Modified Date = 17/04/2008 05:25:46 | Attr =    ]
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
Explorer.exe -> %SystemRoot%\explorer.exe -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 11:23:07 | Attr =    ]
*MultiFile Done* -> -> 
*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> 
C:\WINDOWS\system32\userinit.exe -> %SystemRoot%\SYSTEM32\userinit.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 24576 bytes | Modified Date = 04/08/2004 00:56:58 | Attr =    ]
*MultiFile Done* -> -> 
*UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost -> 
logonui.exe -> %SystemRoot%\SYSTEM32\logonui.exe -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 514560 bytes | Modified Date = 04/08/2004 00:56:52 | Attr =    ]
*MultiFile Done* -> -> 
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 
rundll32 shell32 -> %SystemRoot%\SYSTEM32\shell32.dll -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_gdr.071025-1248) | Size = 8454656 bytes | Modified Date = 26/10/2007 04:36:51 | Attr =    ]
Control_RunDLL "sysdm.cpl" -> %SystemRoot%\SYSTEM32\sysdm.cpl -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 298496 bytes | Modified Date = 04/08/2004 00:56:58 | Attr =    ]
*MultiFile Done* -> -> 
< Winlogon settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
klogon -> %SystemRoot%\SYSTEM32\klogon.dll -> Kaspersky Lab [Ver = 7.0.0.125 | Size = 206088 bytes | Modified Date = 28/06/2007 12:51:48 | Attr =    ]
< CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> 
Reg Error: Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ not found. -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\dontdisplaylastusername -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\legalnoticecaption ->  -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\legalnoticetext ->  -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\shutdownwithoutlogon -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\undockwithoutlogon -> 1 -> 
< CurrentVersion Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
Reg Error: Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ not found. -> -> 
< CDROM Autorun Setting > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\ -> ->
*DependOnGroup* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DependOnGroup -> 
SCSI miniport ->  -> File not found
*MultiFile Done* -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ErrorControl -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Group -> SCSI CDROM Class -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Start -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Tag -> 2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Type -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DisplayName -> CD-ROM Driver -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ImagePath -> %SystemRoot%\SYSTEM32\drivers\cdrom.sys [System32\DRIVERS\cdrom.sys] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 49536 bytes | Modified Date = 03/08/2004 22:59:54 | Attr =    ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun -> 1 -> 
*AutoRunAlwaysDisable* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRunAlwaysDisable -> 
NEC     MBR-7    ->  -> File not found
NEC     MBR-7.4  ->  -> File not found
PIONEER CHANGR DRM-1804X ->  -> File not found
PIONEER CD-ROM DRM-6324X ->  -> File not found
PIONEER CD-ROM DRM-624X  ->  -> File not found
TORiSAN CD-ROM CDR_C36 ->  -> File not found
*MultiFile Done* -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\ -> -> 
< Drives with AutoRun files > ->  -> 
AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] ->  [Ver =  | Size = 0 bytes | Modified Date = 23/10/2001 21:54:40 | Attr =    ]
< HOSTS File > (223824 bytes and 7896 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 
First 25 entries...
127.0.0.1       localhost
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.10sek.com
127.0.0.1	10sek.com
127.0.0.1	www.123topsearch.com
127.0.0.1	123topsearch.com
127.0.0.1	www.132.com
127.0.0.1	132.com
127.0.0.1	www.136136.net
127.0.0.1	136136.net
127.0.0.1	www.163ns.com
127.0.0.1	163ns.com
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
HKEY_CURRENT_USER\: Main\\Start Page -> http://www.ntlworld.com/ -> 
HKEY_CURRENT_USER\: ProxyEnable -> 0 -> 
HKEY_CURRENT_USER\: ProxyOverride -> 127.0.0.1;*.local -> 
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4851 domain(s) found. -> 
47 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4873 domain(s) found. -> 
www_excite.com [http] -> Trusted sites -> 
46 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> 
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKEY_LOCAL_MACHINE] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 8.0.0.2006102200 | Size = 62080 bytes | Modified Date = 23/10/2006 00:08:42 | Attr =    ]
{53707962-6F74-2D53-2644-206D7942484F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 28/01/2008 12:43:28 | Attr =    ]
{6165D324-3AAF-4C63-B545-C7D2285BEA1C} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\ReadAndWrite6\thbho.dll [baloudHelperObj Class] -> textHELP Systems Ltd [Ver = 1, 0, 0, 3 | Size = 40960 bytes | Modified Date = 12/02/2002 11:19:18 | Attr =    ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 509328 bytes | Modified Date = 22/02/2008 04:25:19 | Attr =    ]
< Internet Explorer Bars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ -> 
{32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.] -> File not found
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\npjpi160_05.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 132496 bytes | Modified Date = 22/02/2008 04:25:19 | Attr =    ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} [HKEY_CURRENT_USER] -> %ProgramFiles%\Java\jre1.6.0_05\bin\ssv.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 509328 bytes | Modified Date = 22/02/2008 04:25:19 | Attr =    ]
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 28/01/2008 12:43:28 | Attr =    ]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} [HKEY_LOCAL_MACHINE] ->  [Reg Error: Key does not exist or could not be opened.] -> File not found
CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 28/01/2008 12:43:28 | Attr =    ]
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< User Agent Post Platform [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform -> 
SV1 ->  -> 
< DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{1809FEDC-1A7D-493A-93FB-72A99825E6DC} ->    (SMC EZ Card 10/100 Fast Ethernet PCI Network Adapter) -> 
< Winsock2 Catalogs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\ -> 
NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] -> %ProgramFiles%\Bonjour\mdnsNSP.dll -> Apple Inc. [Ver = 1,0,5,11 | Size = 147456 bytes | Modified Date = 29/08/2008 09:53:50 | Attr =    ]
< Protocol Handlers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ -> 
ipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
msdaipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
skype4com:{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} [HKEY_LOCAL_MACHINE] -> %CommonProgramFiles%\Skype\Skype4COM.dll[IEProtocolHandler Class] -> Skype Technologies [Ver = 1, 0, 29, 0 | Size = 1942864 bytes | Modified Date = 11/08/2008 17:46:50 | Attr = R  ]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab[Java Plug-in 1.6.0_05] -> 
{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab[Java Plug-in 1.6.0_04] -> 
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab[Java Plug-in 1.6.0_05] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab[Java Plug-in 1.6.0_05] -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000}[HKEY_LOCAL_MACHINE] -> http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab[Shockwave Flash Object] -> 
< Module Usage Keys [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> 
Reg Error: Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ not found. -> -> 



[Files/Folders - Created Within 30 days]
rsit -> %SystemDrive%\rsit ->  [Folder | Created Date = 30/09/2008 18:28:15 | Attr =    ]
CatRoot_bak -> %SystemRoot%\System32\CatRoot_bak ->  [Folder | Created Date = 09/09/2008 08:30:20 | Attr =    ]
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 

[Files/Folders - Modified Within 30 days]
hosts -> %SystemRoot%\System32\drivers\etc\hosts ->  [Ver =  | Size = 223824 bytes | Modified Date = 01/10/2008 08:31:46 | Attr =    ]
hosts.idx -> %SystemRoot%\System32\drivers\etc\hosts.idx ->  [Ver =  | Size = 73612 bytes | Modified Date = 03/10/2008 15:42:20 | Attr =    ]
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
wpa.dbl -> %SystemRoot%\System32\wpa.dbl ->  [Ver =  | Size = 1170 bytes | Modified Date = 17/09/2008 16:21:49 | Attr =    ]
2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 
bootstat.dat -> %SystemRoot%\bootstat.dat ->  [Ver =  | Size = 2048 bytes | Modified Date = 03/10/2008 15:42:06 | Attr =   S]
imsins.BAK -> %SystemRoot%\imsins.BAK ->  [Ver =  | Size = 1374 bytes | Modified Date = 18/09/2008 12:39:36 | Attr =    ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job ->  [Ver =  | Size = 284 bytes | Modified Date = 01/10/2008 10:20:02 | Attr =    ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT ->  [Ver =  | Size = 6 bytes | Modified Date = 03/10/2008 15:42:26 | Attr =  H ]
SmartDefrag.job -> %SystemRoot%\tasks\SmartDefrag.job ->  [Ver =  | Size = 356 bytes | Modified Date = 21/09/2008 22:00:00 | Attr =    ]
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader ->  [Folder | Modified Date = 13/08/2007 08:54:17 | Attr =    ]
qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat ->  [Ver =  | Size = 4232 bytes | Modified Date = 18/09/2008 08:32:46 | Attr =    ]
qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ->  [Ver =  | Size = 5514 bytes | Modified Date = 18/09/2008 08:32:46 | Attr =    ]
C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data ->  [Folder | Modified Date = 10/10/2006 10:59:31 | Attr =    ]
data.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\data.dat ->  [Ver =  | Size = 1388 bytes | Modified Date = 02/07/2007 16:27:21 | Attr =    ]
179 C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp -> 
C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries ->  [Folder | Modified Date = 01/10/2008 10:38:11 | Attr =    ]
ScanningProcess.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\ScanningProcess.exe -> Kaspersky Lab. [Ver = 5, 0, 1, 86 | Size = 139264 bytes | Modified Date = 01/10/2008 10:38:06 | Attr =    ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
Setup.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Setup.exe -> InstallShield Software Corporation [Ver = 5, 52, 164, 0 | Size = 73728 bytes | Modified Date = 12/01/1999 11:42:20 | Attr = R  ]
_ISDel.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\_ISDel.exe -> InstallShield Software Corporation [Ver = 5, 51, 138, 0 | Size = 27648 bytes | Modified Date = 27/10/1998 12:06:48 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
AcroRd32.exe -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\AcroRd32.exe -> Adobe Systems Incorporated [Ver = 5.0.1.2001032700 | Size = 3870784 bytes | Modified Date = 27/03/2001 21:44:58 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp ->  [Folder | Modified Date = 03/10/2008 15:48:05 | Attr =    ]
i6hhuksj.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\i6hhuksj.dll ->  [Ver =  | Size = 0 bytes | Modified Date = 19/05/2008 08:37:08 | Attr =    ]
swt-awt-win32-3346.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\swt-awt-win32-3346.dll -> Eclipse Foundation [Ver = 3.346 | Size = 32768 bytes | Modified Date = 05/02/2008 19:51:23 | Attr =    ]
swt-win32-3346.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\swt-win32-3346.dll -> Eclipse Foundation [Ver = 3.346 | Size = 307200 bytes | Modified Date = 05/02/2008 19:51:23 | Attr =    ]
179 C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp -> 
C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries ->  [Folder | Modified Date = 01/10/2008 10:38:11 | Attr =    ]
FSSync.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\FSSync.dll -> Kaspersky Lab [Ver = 6.0.5.678 | Size = 38400 bytes | Modified Date = 01/10/2008 10:38:05 | Attr =    ]
ikave.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\ikave.dll ->  [Ver = 5, 0, 1, 83 | Size = 65536 bytes | Modified Date = 01/10/2008 10:38:08 | Attr =    ]
kave.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\kave.dll -> Kaspersky Lab. [Ver = 5, 0, 1, 86 | Size = 282624 bytes | Modified Date = 01/10/2008 10:38:08 | Attr =    ]
kosglue-7.0.25.0.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\kosglue-7.0.25.0.dll -> Kaspersky Lab [Ver = 7.0.25.0 | Size = 729152 bytes | Modified Date = 01/10/2008 10:38:10 | Attr =    ]
msvcm80.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\msvcm80.dll -> Microsoft Corporation [Ver = 8.00.50727.42 | Size = 479232 bytes | Modified Date = 01/10/2008 10:38:04 | Attr =    ]
msvcp80.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\msvcp80.dll -> Microsoft Corporation [Ver = 8.00.50727.42 | Size = 548864 bytes | Modified Date = 01/10/2008 10:38:08 | Attr =    ]
msvcr80.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\msvcr80.dll -> Microsoft Corporation [Ver = 8.00.50727.42 | Size = 626688 bytes | Modified Date = 01/10/2008 10:38:08 | Attr =    ]
prLoader.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\prLoader.dll -> Kaspersky Lab [Ver = 6.0.2.678 | Size = 184320 bytes | Modified Date = 01/10/2008 10:38:09 | Attr =    ]
prremote.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\prremote.dll -> Kaspersky Lab [Ver = 6.0.2.678 | Size = 90112 bytes | Modified Date = 01/10/2008 10:38:09 | Attr =    ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
_Setup.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\_Setup.dll -> InstallShield Software Corporation [Ver = 5, 50, 134, 0 | Size = 34816 bytes | Modified Date = 29/09/1998 16:34:56 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
AceLite.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\AceLite.dll -> Adobe Systems, Incorporated [Ver = 1.02.00 | Size = 397312 bytes | Modified Date = 28/02/2001 09:29:36 | Attr = R  ]
ACROFX32.DLL -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\ACROFX32.DLL ->  [Ver =  | Size = 53248 bytes | Modified Date = 12/05/2000 18:30:02 | Attr = R  ]
Agm.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Agm.dll -> Adobe Systems, Incorporated [Ver = 4.04.26 | Size = 1138688 bytes | Modified Date = 14/03/2001 10:06:02 | Attr = R  ]
Bib.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Bib.dll -> Adobe Systems, Incorporated [Ver = 1.0.20 | Size = 147456 bytes | Modified Date = 20/01/2001 22:13:36 | Attr = R  ]
CoolType.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\CoolType.dll -> Adobe Systems, Incorporated [Ver = 4.04.26 | Size = 1441792 bytes | Modified Date = 14/03/2001 10:06:02 | Attr = R  ]
msvcp60.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\msvcp60.dll -> Microsoft Corporation [Ver = 6.00.8168.0 | Size = 401462 bytes | Modified Date = 01/12/1999 00:40:28 | Attr = R  ]
msvcrt.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\msvcrt.dll -> Microsoft Corporation [Ver = 6.00.8397.0 | Size = 266293 bytes | Modified Date = 11/02/1999 03:33:58 | Attr = R  ]
oleaut32.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\oleaut32.dll -> Microsoft Corporation [Ver = 2.30.4261 | Size = 598288 bytes | Modified Date = 18/06/1998 11:33:08 | Attr = R  ]
WHA Library.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\WHA Library.dll -> Adobe Systems Incorporated [Ver = 0.2.0.0 | Size = 167936 bytes | Modified Date = 15/03/2001 06:14:38 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Browser\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Browser ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
nppdf32.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Browser\nppdf32.dll -> Adobe Systems Inc. [Ver = 5.0.0.2001031500 | Size = 103312 bytes | Modified Date = 26/02/2001 21:48:44 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\InterTrust\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\InterTrust ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
NPDocBox.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\InterTrust\NPDocBox.dll -> InterTrust Technologies Corporation, Inc. [Ver = 1.0.30.95 | Size = 225280 bytes | Modified Date = 14/03/2001 04:52:06 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
QT2.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\QT2.dll -> Adobe Systems, Inc. [Ver = 5.0.0.0 | Size = 24576 bytes | Modified Date = 15/03/2001 06:00:24 | Attr = R  ]
QT3.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\QT3.dll -> Adobe Systems, Inc. [Ver = 5.0.0.0 | Size = 32768 bytes | Modified Date = 15/03/2001 06:00:42 | Attr = R  ]
QT4.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\plug_ins\Movie\QT4.dll -> Adobe Systems, Inc. [Ver = 5.0.0.0 | Size = 36864 bytes | Modified Date = 15/03/2001 06:01:02 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Uninstall\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Uninstall ->  [Folder | Modified Date = 30/05/2002 11:30:35 | Attr =    ]
Uninst.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Reader\Uninstall\Uninst.dll -> Adobe Systems, Inc. [Ver = 4.0.11 | Size = 81920 bytes | Modified Date = 26/02/2001 21:48:44 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files ->  [Folder | Modified Date = 30/05/2002 11:30:36 | Attr =    ]
NPSVGVw.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\NPSVGVw.dll -> Adobe Systems Inc. [Ver = 2, 0, 0, 55 | Size = 299059 bytes | Modified Date = 14/03/2001 14:10:56 | Attr = R  ]
SVGControl.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGControl.dll -> Adobe Systems Incorporated [Ver = 2, 0, 0, 55 | Size = 491574 bytes | Modified Date = 14/03/2001 14:14:00 | Attr = R  ]
SVGRSRC.DLL -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGRSRC.DLL ->  [Ver =  | Size = 12288 bytes | Modified Date = 14/03/2001 14:06:24 | Attr = R  ]
SVGView.dll -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGView.dll -> Adobe Systems Incorporated [Ver = 2, 0, 0, 55 | Size = 1597491 bytes | Modified Date = 14/03/2001 14:07:52 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\engine\bases\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\engine\bases ->  [Folder | Modified Date = 01/10/2008 10:04:29 | Attr =    ]
sfdb.dat -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\engine\bases\sfdb.dat ->  [Ver =  | Size = 35004 bytes | Modified Date = 01/10/2008 10:38:30 | Attr =    ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
lang.dat -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\lang.dat ->  [Ver =  | Size = 23541 bytes | Modified Date = 12/01/1999 10:34:42 | Attr = R  ]
os.dat -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\os.dat ->  [Ver =  | Size = 450 bytes | Modified Date = 27/07/1998 17:41:06 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp ->  [Folder | Modified Date = 03/10/2008 15:48:05 | Attr =    ]
{AC76BA86-7AD7-1033-7B44-A81200000003}.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\{AC76BA86-7AD7-1033-7B44-A81200000003}.ini ->  [Ver =  | Size = 568 bytes | Modified Date = 12/02/2008 10:36:09 | Attr =    ]
179 C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\oemstudent\Local Settings\Temp\*.tmp -> 
C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries ->  [Folder | Modified Date = 01/10/2008 10:38:11 | Attr =    ]
_kave.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\binaries\_kave.ini ->  [Ver =  | Size = 102 bytes | Modified Date = 01/10/2008 10:38:07 | Attr =    ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\engine\bases\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\engine\bases ->  [Folder | Modified Date = 01/10/2008 10:04:29 | Attr =    ]
verdicts.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\jkos-oemstudent\engine\bases\verdicts.ini ->  [Ver =  | Size = 4181 bytes | Modified Date = 01/10/2008 10:04:09 | Attr =    ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp ->  [Folder | Modified Date = 30/05/2002 11:31:02 | Attr =    ]
Abcpy.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\Abcpy.ini ->  [Ver =  | Size = 3026 bytes | Modified Date = 04/04/2001 14:57:10 | Attr = R  ]
SETUP.INI -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SETUP.INI ->  [Ver =  | Size = 103 bytes | Modified Date = 28/03/2001 15:30:20 | Attr = R  ]
C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\ -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files ->  [Folder | Modified Date = 30/05/2002 11:30:36 | Attr =    ]
SVGViewer.ini -> C:\Documents and Settings\oemstudent\Local Settings\Temp\pftAA~tmp\SVG Files\SVGViewer.ini ->  [Ver =  | Size = 0 bytes | Modified Date = 09/03/2001 11:13:50 | Attr = R  ]
C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp ->  [Folder | Modified Date = 03/10/2008 15:44:34 | Attr =    ]
Perflib_Perfdata_590.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_590.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 03/10/2008 15:42:30 | Attr =    ]
Perflib_Perfdata_594.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_594.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 02/10/2008 14:47:16 | Attr =    ]
725 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 

< End of report >

[peku006]

Hi

I'm not seeing anything malicious in your logs, let's try another online scanner

Please go to Eset website to perform an online scan. Please use Internet Explorer as it uses ActiveX.

1. Check (tick) this box: YES, I accept the Terms of Use.
2. Click on the Start button next to it.
3. When prompted to run ActiveX. click Yes.
4. You will be asked to install an ActiveX. Click Install.
5. Once installed, the scanner will be initialized.
6. After the scanner is initialized, click Start.
7. Uncheck (untick) Remove found threats box.
8. Check (tick) Scan unwanted applications.
9. Click on Scan.
10. It will start scanning. Please be patient.
11. Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt. Please post this log in your next reply.

Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

Please reply with

esetonlinescanner. log.txt
a fresh HijackThis log

Thanks peku006

[Stas_1]

Hi
Last time when I got a virus I had Kaspersky and there internet support had allot of trouble locating the virus, but I can’t remember where it was found in the end. But I think we managed to solve it using hijackthis and sysinfo.

I’ve been looking through some really old e-mails trying to find correspondences with Kaspersky, but am afraid they are gone.


# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3494 (20081003)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=2053424c8bd1d04b98595555da39bcd1
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-10-04 09:59:48
# local_time=2008-10-04 10:59:48 (+0000, GMT Standard Time)
# country="United Kingdom"
# osver=5.1.2600 NT Service Pack 2
# scanned=368919
# found=0
# scan_time=5890


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:58:39, on 04/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\My Documents\Online Armor\oasrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
D:\My Documents\Online Armor\oaui.exe
D:\My Documents\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: baloudHelperObj Class - {6165D324-3AAF-4C63-B545-C7D2285BEA1C} - C:\Program Files\ReadAndWrite6\thbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [VirtualCloneDrive] "F:\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\My Documents\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [WinampAgent] "d:\My Documents\Winamp\winampa.exe"
O4 - HKLM\..\Run: [OnlineArmor GUI] "D:\My Documents\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\My Documents\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\My Documents\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.excite.com
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - D:\My Documents\Online Armor\oasrv.exe
O24 - Desktop Component 1: (no name) - C:\Student_Info\index.html

--
End of file - 6733 bytes

[peku006]

Hi Stas_1

1. Please download F-Secure Blacklight and save it to C drive.
2. Click on Start > Run and copy and paste in the following: C:\fsbl.exe /expert. Click OK.
3. You will be shown a license agreement. Read through it and select I accept the agreement. Click Next.
4. Click on Scan.
5. Once the scan is done, close F-Secure Blacklight. Don't rename anything found!
6. A log will be produced on your C drive. It's named fsbl-XXXXXXXXXXXXXX.log, where the XXXXXXXXXXXXXX are numbers. Please post this log in your next reply.