Suspecting a backdoor trojan

View previous topic View next topic Go down

Suspecting a backdoor trojan

Post by Hackneyed on 22nd June 2010, 7:53 pm

Randomly my anti-virus ( Norton 2010 ) notifies me that a program got deleted because it had a backdoor. Maybe it's because it updated.

Could you guys recommend me any test to see if I have one?

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 22nd June 2010, 9:41 pm

Hello and welcome to GeekPolice.net.

My name is Sneakyone, and I will do my best to help get your problem resolved today.

I am currently a student in GeekPolice Academy, and will be a little delayed on each reply, as my instructors must review and approve each reply.

If you have any questions, please ask, and I will do my best to get to the question promptly.

Please wait here, while I get the first set of instructions for you.

Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 22nd June 2010, 10:16 pm

Hi Hackneyed, Smile

Welcome to GeekPolice.net!

My username is Sneakyone, and I will be assisting you on your issue today.

Download [You must be registered and logged in to see this link.] to your Desktop

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in

    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    c:\$recycle.bin\*.* /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    nvstor32.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    explorer.exe
    svchost.exe
    userinit.exe
    qmgr.dll
    ws2_32.dll
    proquota.exe
    imm32.dll
    kernel32.dll
    ndis.sys
    autochk.exe
    spoolsv.exe
    xmlprov.dll
    ntmssvc.dll
    mswsock.dll
    Beep.SYS
    ntfs.sys
    termsrv.dll
    sfcfiles.dll
    st3shark.sys
    ahcix86.sys
    srsvc.dll
    nvrd32.sys
    /md5stop
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time



Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 22nd June 2010, 10:36 pm

OTL logfile created on: 22/06/2010 6:20:14 PM - Run 2
OTL by OldTimer - Version 3.2.6.1 Folder = C:\Users\Fred\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

6.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 56.00% Memory free
12.00 Gb Paging File | 9.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 918.55 Gb Total Space | 788.75 Gb Free Space | 85.87% Space Free | Partition Type: NTFS
Drive D: | 12.87 Gb Total Space | 2.30 Gb Free Space | 17.90% Space Free | Partition Type: NTFS
Drive E: | 19.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FRED-PC
Current User Name: Fred
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/06/22 18:19:54 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Fred\Downloads\OTL(2).exe
PRC - [2010/06/13 07:25:22 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2010/06/11 18:58:17 | 002,027,520 | ---- | M] (MAIET entertainment) -- C:\Program Files (x86)\WWG\Gunz version 3.0\wwg.exe
PRC - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/04/02 00:51:39 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe
PRC - [2009/12/17 12:04:18 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2009/09/30 20:58:42 | 000,026,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
PRC - [2009/08/05 16:45:22 | 000,206,120 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009/07/26 17:44:34 | 003,883,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
PRC - [2009/07/23 23:45:52 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2009/06/04 22:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009/06/04 22:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/05/26 04:36:13 | 000,656,896 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
PRC - [2008/11/20 13:47:28 | 000,062,768 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
PRC - [2008/09/30 21:59:26 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe
PRC - [2008/01/07 13:28:02 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Razer\Lycosa\razertra.exe
PRC - [2007/11/20 16:53:36 | 000,147,456 | ---- | M] (Razer USA Ltd.) -- C:\Program Files (x86)\Razer\Lycosa\razerhid.exe
PRC - [2007/08/14 01:09:24 | 000,274,432 | ---- | M] (razercfg MFC Application) -- C:\Program Files (x86)\Razer\Lycosa\OSD.exe


========== Modules (SafeList) ==========

MOD - [2010/06/22 18:19:54 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Fred\Downloads\OTL(2).exe
MOD - [2009/07/13 21:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx
MOD - [2009/07/13 21:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009/12/30 20:00:12 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009/05/15 19:24:10 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2010/06/17 07:03:41 | 000,395,048 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/06/13 07:25:22 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010/05/11 17:45:42 | 002,478,640 | ---- | M] () [Auto | Running] -- c:\Program Files (x86)\Common Files\Akamai\rswin_3697.dll -- (Akamai)
SRV - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/30 11:16:14 | 001,823,112 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2010/03/10 17:46:00 | 003,601,608 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWow64\GameMon.des -- (npggsvc)
SRV - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe -- (NIS)
SRV - [2009/12/30 20:00:07 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/12/17 12:04:18 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009/07/13 23:20:14 | 000,000,000 | ---D | M] [On_Demand | Stopped] -- C:\Windows\Vss -- (VSS)
SRV - [2009/07/13 23:20:14 | 000,000,000 | ---D | M] [Unknown | Stopped] -- C:\Windows\SysWOW64\Msdtc -- (MSDTC)
SRV - [2009/07/13 16:30:11 | 000,061,056 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\wbem\vds.mof -- (vds)
SRV - [2009/06/04 22:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/09/30 21:59:26 | 000,192,512 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe -- (HPBtnSrv)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2010/06/07 17:55:29 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
DRV:64bit: - [2010/05/06 00:01:59 | 000,451,120 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symtdiv.sys -- (SYMTDIv)
DRV:64bit: - [2010/05/06 00:01:44 | 000,053,808 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SymIMV.sys -- (SymIM)
DRV:64bit: - [2010/04/29 01:03:51 | 000,150,064 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\ironx64.sys -- (SymIRON)
DRV:64bit: - [2010/04/21 23:02:20 | 000,221,232 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symefa64.sys -- (SymEFA)
DRV:64bit: - [2010/04/21 22:29:51 | 000,505,392 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2010/04/21 22:29:51 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2010/02/25 20:22:52 | 000,615,040 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\cchpx64.sys -- (ccHP)
DRV:64bit: - [2010/01/27 11:03:38 | 000,173,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2009/12/01 15:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009/09/23 10:42:58 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009/08/29 20:17:18 | 000,433,200 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symds64.sys -- (SymDS)
DRV:64bit: - [2009/07/13 21:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/07/13 21:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 10:31:42 | 000,233,472 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/29 05:00:00 | 000,116,752 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/05 11:10:10 | 001,478,144 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/05/15 20:02:04 | 005,957,632 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/05/08 21:14:24 | 000,033,160 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64k.sys -- (Point64)
DRV:64bit: - [2008/12/26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM)
DRV:64bit: - [2008/03/13 03:46:00 | 000,027,136 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ManyCam_x64.sys -- (ManyCam)
DRV:64bit: - [2008/01/17 16:51:44 | 000,018,816 | ---- | M] (Razer USA Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Lycosa.sys -- (Lycosa)
DRV:64bit: - [2006/11/10 09:08:58 | 000,030,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SysTool64.sys -- (SysTool)
DRV:64bit: - [2006/11/10 09:08:58 | 000,030,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ATITool64.sys -- (ATITool)
DRV - [2010/06/07 17:55:29 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\adfs.sys -- (adfs)
DRV - [2010/06/06 19:19:25 | 000,007,040 | ---- | M] (Kings Information & Network) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ProDefense.sys -- (ProDefense)
DRV - [2010/05/28 15:33:18 | 000,463,408 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100617.005\IDSviA64.sys -- (IDSVia64)
DRV - [2010/05/27 01:47:53 | 000,475,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2010/05/27 01:47:53 | 000,132,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/05/22 14:16:04 | 000,942,640 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100522.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2010/05/14 17:52:43 | 001,773,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100622.003\EX64.SYS -- (NAVEX15)
DRV - [2010/05/14 17:52:43 | 000,117,808 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100622.003\ENG64.SYS -- (NAVENG)
DRV - [2009/06/10 17:28:14 | 000,001,088 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\wbem\mpsdrv.mof -- (mpsdrv)
DRV - [2009/06/10 17:15:18 | 000,003,066 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysWOW64\wbem\tcpip.mof -- (Tcpip)
DRV - [2007/09/27 19:44:52 | 000,065,536 | ---- | M] (Razer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\Lycosa.cpl -- (Lycosa)
DRV - [2005/05/25 09:39:14 | 000,007,168 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\RMClock\RTCore64.sys -- (RTCore64)
DRV - [2004/12/31 11:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}"
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.5.3
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.5.3
FF - prefs.js..extensions.enabledItems: {5e5ab302-7f65-44cd-8211-c1d4caaccea3}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {9b339f6e-ddcd-401b-8764-230adbd01761}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q="
FF - prefs.js..network.proxy.http: "217.168.150.185"
FF - prefs.js..network.proxy.http_port: 3128


FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010/06/08 17:00:17 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010/01/27 11:05:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/05/28 22:13:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/06/10 18:22:13 | 000,000,000 | ---D | M]

[2010/01/09 21:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\mozilla\Extensions
[2010/01/09 21:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
[2010/06/22 12:35:06 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\mozilla\Firefox\Profiles\b7d1rtu9.default\extensions
[2010/02/13 13:12:07 | 000,000,000 | ---D | M] (XfireXO Toolbar) -- C:\Users\Fred\AppData\Roaming\mozilla\Firefox\Profiles\b7d1rtu9.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
[2010/02/13 13:12:07 | 000,000,000 | ---D | M] (Messenger Plus Live Toolbar) -- C:\Users\Fred\AppData\Roaming\mozilla\Firefox\Profiles\b7d1rtu9.default\extensions\{9b339f6e-ddcd-401b-8764-230adbd01761}
[2010/03/14 14:00:03 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\mozilla\Firefox\Profiles\b7d1rtu9.default\extensions\firebug@software.joehewitt.com
[2010/05/10 19:43:01 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\mozilla\Firefox\Profiles\b7d1rtu9.default\extensions\personas@christopher.beard
[2010/01/04 03:15:23 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\mozilla\Firefox\Profiles\b7d1rtu9.default\extensions\redshift_V2@shift-themes.com
[2010/01/05 12:32:00 | 000,000,917 | ---- | M] () -- C:\Users\Fred\AppData\Roaming\Mozilla\FireFox\Profiles\b7d1rtu9.default\searchplugins\conduit.xml
[2010/06/10 18:22:15 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/06/10 18:22:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/06/10 18:22:09 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/02/07 18:24:52 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2009/12/30 20:47:54 | 000,000,852 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll (Conduit Ltd.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files (x86)\XfireXO\tbXfir.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Messenger Plus Live Toolbar) - {9B339F6E-DDCD-401B-8764-230ADBD01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [HP Remote Solution] C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe ()
O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Lycosa] C:\Program Files (x86)\Razer\Lycosa\razerhid.exe (Razer USA Ltd.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: C:\Users\Fred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files (x86)\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1979 ([http] in Trusted sites)
O16 - DPF: {00001026-A15C-11D4-97A4-0050BF0FBE67} [You must be registered and logged in to see this link.] (NetmarbleStarter26 Class)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} [You must be registered and logged in to see this link.] (Checkers Class)
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} [You must be registered and logged in to see this link.] ()
O16 - DPF: {5267557D-D090-44EA-BCAA-8576A24810C5} [You must be registered and logged in to see this link.] (NetmarbleSystemInformer Class)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} [You must be registered and logged in to see this link.] (Solitaire Showdown Class)
O16 - DPF: {5C1B293E-DA77-4AFF-8B52-63DEF8C8A071} [You must be registered and logged in to see this link.] (NetmarbleAutoUpdater Class)
O16 - DPF: {89F434A7-4A49-4394-AC02-007480331AE2} [You must be registered and logged in to see this link.] (NetmarbleSystemIDInfo Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {92E82FBB-DA00-41E0-ABFE-95482E21A4F6} [You must be registered and logged in to see this link.] (NMTransX Module)
O16 - DPF: {A047BE6C-A1CE-41C7-A6EC-85FC184D16F1} [You must be registered and logged in to see this link.] (nmDownloadCtrl Class)
O16 - DPF: {A4508A45-F1C4-40F3-99B4-0CA08AC77E3B} [You must be registered and logged in to see this link.] (Kdfense8 Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} [You must be registered and logged in to see this link.] (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} [You must be registered and logged in to see this link.] (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 207.164.234.129 207.164.234.193
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/07/05 04:50:48 | 000,000,046 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{0ac51358-c33b-11de-aacd-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{0ac51358-c33b-11de-aacd-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2007/04/25 04:43:10 | 000,393,216 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*



SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: VDS - C:\Windows\SysWOW64\wbem\vds.mof ()
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Hamachi2Svc - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MPSDrv - C:\Windows\SysWOW64\wbem\mpsdrv.mof ()
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: Tcpip - C:\Windows\SysWOW64\wbem\tcpip.mof ()
SafeBootNet: TDI - Driver Group
SafeBootNet: VDS - C:\Windows\SysWOW64\wbem\vds.mof ()
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {EE4F54AD-EA52-4449-1A85-D7B534C66852} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {14426949-D8A3-76A3-8618-E0DFD9F437C0} - Microsoft Windows Media Player
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {64F46E4D-D714-F006-654A-357E2D6DDCA3} - Internet Explorer
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\SysWow64\lhacm.acm (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: VIDC.XFR1 - C:\Windows\SysWow64\xfcodec.dll ()

========== Files/Folders - Created Within 90 Days ==========

[2010/06/22 15:43:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Razer
[2010/06/22 15:43:14 | 000,065,536 | ---- | C] (Razer Inc.) -- C:\Windows\SysWow64\Lycosa.cpl
[2010/06/22 15:42:12 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\InstallShield
[2010/06/22 11:56:30 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\WWG GunZ
[2010/06/22 11:49:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WWG
[2010/06/22 11:35:46 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\RSBot
[2010/06/22 11:29:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Registry Helper
[2010/06/22 11:29:16 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Local\Yahoo
[2010/06/22 11:29:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PriceGong
[2010/06/22 11:28:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo!
[2010/06/22 11:28:57 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Yahoo!
[2010/06/22 11:28:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yahoo!
[2010/06/21 21:32:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Razer
[2010/06/21 21:32:30 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallShield
[2010/06/20 10:38:22 | 000,000,000 | ---D | C] -- C:\.mpr_file_store_32
[2010/06/19 00:45:21 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\Azn Client
[2010/06/18 22:03:50 | 000,453,120 | ---- | C] (MounDown) -- C:\Users\Fred\Desktop\AutoClicker.exe
[2010/06/18 21:59:25 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\Client v3.4
[2010/06/18 14:00:35 | 000,000,000 | ---D | C] -- C:\Users\Fred\.pc_store_32
[2010/06/15 19:23:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RMClock
[2010/06/14 17:21:33 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\PowerMiner
[2010/06/13 09:36:53 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Local\PunkBuster
[2010/06/13 01:15:51 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\Panel
[2010/06/12 22:55:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtime Worlds
[2010/06/12 21:31:52 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\EnviousGunz
[2010/06/10 18:17:23 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\Project 69 Client
[2010/06/08 17:22:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Infected Gunz Client v4.5.2
[2010/06/06 19:00:39 | 000,000,000 | ---D | C] -- C:\.Project-69_file_store_32
[2010/06/06 15:41:29 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\Alternate PvP 562
[2010/06/06 15:13:56 | 000,000,000 | ---D | C] -- C:\Cache_V5
[2010/06/06 15:07:03 | 000,000,000 | ---D | C] -- C:\zee_store
[2010/06/04 19:29:09 | 000,000,000 | ---D | C] -- C:\Aurora GunZ
[2010/06/04 13:31:23 | 000,000,000 | ---D | C] -- C:\.sabsabionline474
[2010/06/04 10:37:16 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Malwarebytes
[2010/06/04 10:36:51 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010/06/04 10:36:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/06/04 10:36:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/05/28 22:14:58 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Apple Computer
[2010/05/28 22:14:46 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2010/05/28 22:14:33 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/05/28 22:14:30 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/05/28 22:14:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2010/05/28 22:14:30 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2010/05/28 22:13:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2010/05/28 22:13:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010/05/28 22:13:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2010/05/28 22:12:53 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010/05/28 22:12:45 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/05/28 22:12:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2010/05/28 06:55:12 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\AFTER EFFETCS
[2010/05/27 17:59:54 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\arthax.aep Logs
[2010/05/27 17:05:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Axus Gunz
[2010/05/24 11:50:00 | 000,389,120 | ---- | C] (SafeApp Software, LLC) -- C:\Windows\SysWow64\RegistryHelperLM.ocx
[2010/05/22 13:17:01 | 000,679,936 | ---- | C] (Generated by JEDI) -- C:\Windows\SysWow64\D3DX81ab.dll
[2010/05/22 13:17:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cheat Engine
[2010/05/21 10:50:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AG Client
[2010/05/20 23:17:29 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\Sets
[2010/05/20 22:48:54 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\HeroGunz
[2010/05/20 20:20:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HeroGamers
[2010/05/15 21:11:02 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\Nouveau dossier
[2010/05/15 00:48:29 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\LolClient
[2010/05/12 19:24:43 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\vlc
[2010/05/12 19:23:21 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\Graboid
[2010/05/12 19:21:32 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Local\Graboid_Inc
[2010/05/12 19:21:31 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Local\Graboid
[2010/05/12 19:21:24 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\MozillaControl
[2010/05/12 19:20:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla ActiveX Control v1.7.12
[2010/05/12 19:19:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN
[2010/05/12 19:19:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Graboid
[2010/05/10 19:24:35 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\The GunZ Crosshair Database !
[2010/05/08 16:16:45 | 000,000,000 | ---D | C] -- C:\AV_LOGS
[2010/05/08 16:15:43 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Avnex
[2010/05/08 16:15:24 | 000,021,504 | ---- | C] (Avnex) -- C:\Windows\SysNative\drivers\vcsvad.sys
[2010/05/08 16:07:26 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Screaming Bee
[2010/05/08 11:08:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Axus Client
[2010/05/02 18:00:57 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\WZ
[2010/05/01 20:40:16 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\Adobe Scripts
[2010/05/01 12:24:42 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\BubblesDev
[2010/04/28 19:15:47 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Notepad++
[2010/04/28 19:15:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Notepad++
[2010/04/28 17:30:48 | 000,000,000 | ---D | C] -- C:\Maple Story
[2010/04/27 17:23:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dofus
[2010/04/24 18:17:34 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\LavaGunz
[2010/04/24 13:04:29 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Local\Shoddy Battle
[2010/04/19 19:38:11 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\My WeGame Screenshots
[2010/04/19 19:37:50 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\My WeGame Videos
[2010/04/19 19:36:22 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Local\WeGame


Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 22nd June 2010, 10:37 pm

2010/04/19 19:35:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WeGame
[2010/04/16 19:23:34 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Octoshape
[2010/04/14 19:29:57 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2010/04/14 18:48:39 | 000,000,000 | ---D | C] -- C:\Riot Games
[2010/04/14 18:11:22 | 000,000,000 | ---D | C] -- C:\LoL
[2010/04/13 18:41:21 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\Heroes of Newerth
[2010/04/13 18:40:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Heroes of Newerth
[2010/04/09 20:59:50 | 000,000,000 | ---D | C] -- C:\Users\Fred\Documents\EuroGunz
[2010/04/09 20:44:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Euro Gunz v8.5.8
[2010/04/09 17:03:23 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Local\Symantec
[2010/04/07 18:03:20 | 000,000,000 | ---D | C] -- C:\ProgramData\NexonUS
[2010/04/06 03:00:47 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2010/04/06 03:00:47 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2010/04/05 15:14:52 | 000,000,000 | --SD | C] -- C:\Users\Fred\Documents\Mabinogi
[2010/04/05 09:58:51 | 000,000,000 | ---D | C] -- C:\Users\Fred\Incomplete
[2010/04/04 18:21:15 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\tmp
[2010/04/03 09:24:20 | 000,033,856 | -H-- | C] (LogMeIn, Inc.) -- C:\Windows\SysNative\hamachi.sys
[2010/04/03 09:24:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2010/04/01 20:03:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PFPortChecker
[2010/04/01 19:58:32 | 000,000,000 | ---D | C] -- C:\Windows\Simple Port Forwarding
[2010/04/01 19:58:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Simple Port Forwarding
[2010/03/31 20:18:43 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\Mozilla-Cache
[2010/03/31 20:17:33 | 000,000,000 | ---D | C] -- C:\Programs
[2010/03/31 12:17:00 | 000,426,704 | ---- | C] (True Games Interactive) -- C:\Windows\SysWow64\uc_wepic_launching.dll
[2010/03/28 00:06:46 | 000,000,000 | ---D | C] -- C:\Users\Fred\Desktop\MineCraft
[2010/03/27 23:27:58 | 000,000,000 | ---D | C] -- C:\Users\Fred\AppData\Roaming\.minecraft

========== Files - Modified Within 90 Days ==========

[2010/06/22 18:21:43 | 007,077,888 | -HS- | M] () -- C:\Users\Fred\NTUSER.DAT
[2010/06/22 17:40:48 | 000,000,068 | ---- | M] () -- C:\Windows\Gunzlauncher.INI
[2010/06/22 15:51:46 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/06/22 15:51:46 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/06/22 15:44:28 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/06/22 15:44:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/06/22 15:44:15 | 529,854,463 | -HS- | M] () -- C:\hiberfil.sys
[2010/06/22 15:43:09 | 001,143,146 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\Cat.DB
[2010/06/22 15:38:02 | 005,702,544 | -H-- | M] () -- C:\Users\Fred\AppData\Local\IconCache.db
[2010/06/22 15:33:38 | 000,085,024 | ---- | M] () -- C:\Users\Fred\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/06/22 15:29:23 | 002,955,264 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010/06/22 11:53:29 | 000,000,087 | ---- | M] () -- C:\Users\Fred\jagex_runescape_preferences2.dat
[2010/06/22 11:51:42 | 000,000,037 | ---- | M] () -- C:\Windows\WorldLauncher.INI
[2010/06/22 11:44:17 | 000,000,087 | ---- | M] () -- C:\Users\Fred\AppData\Roaming\RSBot Accounts.ini
[2010/06/22 11:36:33 | 000,000,045 | ---- | M] () -- C:\Users\Fred\jagex_runescape_preferences.dat
[2010/06/19 21:12:45 | 1774,918,342 | ---- | M] () -- C:\Users\Fred\Desktop\barrows.mov
[2010/06/19 21:06:56 | 000,514,154 | ---- | M] () -- C:\Users\Fred\Desktop\Untitled Project.aep
[2010/06/19 13:19:22 | 000,001,182 | ---- | M] () -- C:\Users\Fred\Desktop\ Mabinogi .lnk
[2010/06/18 22:04:25 | 000,453,120 | ---- | M] (MounDown) -- C:\Users\Fred\Desktop\AutoClicker.exe
[2010/06/15 19:23:40 | 000,001,013 | ---- | M] () -- C:\Users\Fred\Desktop\RightMark CPU Clock Utility.lnk
[2010/06/15 19:20:54 | 000,000,068 | ---- | M] () -- C:\Windows\Infected GunzLauncher v4.5.1 .INI
[2010/06/14 17:30:14 | 000,188,704 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2010/06/14 17:30:14 | 000,188,704 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010/06/13 07:25:22 | 000,075,064 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010/06/13 01:25:34 | 000,032,647 | ---- | M] () -- C:\Users\Fred\Desktop\Panel.rar
[2010/06/11 20:41:07 | 000,007,613 | ---- | M] () -- C:\Users\Fred\AppData\Local\Resmon.ResmonCfg
[2010/06/11 20:06:14 | 090,760,118 | ---- | M] () -- C:\Users\Fred\Desktop\reverse.mov
[2010/06/09 18:56:06 | 000,042,751 | ---- | M] () -- C:\Users\Fred\Desktop\Sans titre.png
[2010/06/09 17:09:54 | 000,039,141 | ---- | M] () -- C:\Users\Fred\Desktop\Untitled-1.jpg
[2010/06/08 20:27:46 | 004,001,346 | ---- | M] () -- C:\Users\Fred\Desktop\QUOI ÉTUDIER.tif
[2010/06/07 17:43:38 | 000,000,596 | ---- | M] () -- C:\Windows\tasks\Norton Internet Security - Fred - Analyse complète du système.job
[2010/06/07 17:43:37 | 000,002,451 | ---- | M] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2010/06/06 19:19:25 | 000,007,040 | ---- | M] (Kings Information & Network) -- C:\Windows\SysWow64\drivers\ProDefense.sys
[2010/06/05 15:41:22 | 000,008,672 | ---- | M] () -- C:\Users\Fred\Documents\shlip.xlsx
[2010/06/05 11:40:36 | 000,675,080 | ---- | M] () -- C:\Users\Fred\Desktop\arthax.aep
[2010/06/05 10:09:07 | 000,000,042 | ---- | M] () -- C:\Packet.cfg
[2010/06/05 09:53:52 | 000,000,086 | ---- | M] () -- C:\Pointer.cfg
[2010/06/05 01:02:30 | 220,926,964 | ---- | M] () -- C:\Users\Fred\Desktop\U_GUNZ_setup.exe
[2010/06/03 20:27:06 | 000,000,330 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForFred.job
[2010/06/01 10:02:24 | 002,419,568 | ---- | M] () -- C:\Windows\SysWow64\pbsvc_apb.exe
[2010/05/31 17:13:09 | 000,000,552 | ---- | M] () -- C:\Windows\tasks\PCDRScheduledMaintenance.job
[2010/05/29 23:10:58 | 000,154,768 | ---- | M] () -- C:\Users\Fred\Desktop\pc.aep
[2010/05/29 13:36:38 | 000,002,515 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010/05/29 12:32:46 | 000,012,429 | ---- | M] () -- C:\Users\Fred\Documents\Serdule.xlsx
[2010/05/29 01:49:00 | 000,087,928 | ---- | M] () -- C:\Users\Fred\Desktop\Untitled-1.png
[2010/05/28 22:14:50 | 000,002,429 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/05/28 22:13:52 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/05/27 20:11:07 | 000,192,512 | ---- | M] (킹스정보통신) -- C:\Windows\SysWow64\kdfvmgr.exe
[2010/05/27 20:11:07 | 000,083,288 | ---- | M] (Kings Information & Network) -- C:\Windows\SysWow64\kdfapi.dll
[2010/05/27 20:11:07 | 000,059,976 | ---- | M] (Kings Information & Network) -- C:\Windows\SysWow64\Kdfhok.dll
[2010/05/27 20:11:06 | 000,061,440 | ---- | M] (Kings Information & Network) -- C:\Windows\SysWow64\proDefense.dll
[2010/05/27 18:01:01 | 190,821,186 | ---- | M] () -- C:\Users\Fred\Desktop\Comp 1.avi
[2010/05/27 17:05:30 | 000,001,878 | ---- | M] () -- C:\Users\Fred\Desktop\Lancer Axus Gunz !.lnk
[2010/05/25 19:53:24 | 000,000,070 | ---- | M] () -- C:\Windows\AxusLauncher.INI
[2010/05/24 20:53:26 | 000,101,968 | ---- | M] () -- C:\Users\Fred\Desktop\error.jpg
[2010/05/24 11:50:00 | 000,389,120 | ---- | M] (SafeApp Software, LLC) -- C:\Windows\SysWow64\RegistryHelperLM.ocx
[2010/05/22 21:23:53 | 000,000,000 | ---- | M] () -- C:\Users\Fred\jagex__preferences3.dat
[2010/05/22 13:17:15 | 000,000,949 | ---- | M] () -- C:\Users\Fred\Desktop\Cheat Engine.lnk
[2010/05/21 15:38:48 | 000,042,739 | ---- | M] () -- C:\Users\Fred\Desktop\medkiwm.jpg
[2010/05/20 23:22:19 | 001,123,240 | ---- | M] () -- C:\Users\Fred\Desktop\Sets.rar
[2010/05/20 20:20:33 | 000,001,062 | ---- | M] () -- C:\Users\Fred\Desktop\HeroGamers GunZ.lnk
[2010/05/20 18:03:15 | 032,216,105 | ---- | M] () -- C:\Users\Fred\Desktop\TR.mov
[2010/05/20 18:02:13 | 048,180,815 | ---- | M] () -- C:\Users\Fred\Desktop\TF.mov
[2010/05/19 19:08:26 | 000,065,719 | ---- | M] () -- C:\Users\Fred\Desktop\SmokeGlyph.jpg
[2010/05/19 17:57:47 | 000,015,266 | ---- | M] () -- C:\Users\Fred\Desktop\Untitled-2.png
[2010/05/17 19:24:49 | 000,034,281 | ---- | M] () -- C:\Users\Fred\Desktop\22-1281-Llg.jpg
[2010/05/16 20:41:51 | 003,492,352 | ---- | M] () -- C:\Users\Fred\Desktop\GunzDB.bak
[2010/05/15 19:28:47 | 000,001,722 | ---- | M] () -- C:\Users\Public\Desktop\Play League of Legends.lnk
[2010/05/15 01:17:43 | 000,003,699 | ---- | M] () -- C:\Users\Fred\Desktop\312e302e302e38352d3138.jpg
[2010/05/14 22:22:37 | 000,070,515 | ---- | M] () -- C:\Windows\SysWow64\wbers.dat.dmp
[2010/05/14 02:32:01 | 000,000,172 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\isolate.ini
[2010/05/12 19:20:28 | 000,001,270 | ---- | M] () -- C:\Users\Fred\Desktop\Graboid Video.lnk
[2010/05/12 19:20:06 | 000,001,032 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/05/11 19:58:10 | 000,106,248 | ---- | M] () -- C:\Users\Fred\Desktop\CTFV2.map
[2010/05/11 19:57:48 | 000,222,380 | ---- | M] () -- C:\Users\Fred\Desktop\ctf.blend
[2010/05/11 19:52:43 | 000,216,792 | ---- | M] () -- C:\Users\Fred\Desktop\ctf.blend1
[2010/05/10 22:04:11 | 000,025,658 | ---- | M] () -- C:\Users\Fred\Desktop\lola.jpg
[2010/05/10 21:12:03 | 000,010,307 | ---- | M] () -- C:\Users\Fred\Desktop\COLLEGE BOURGET.docx
[2010/05/10 21:05:47 | 000,011,246 | ---- | M] () -- C:\Users\Fred\Desktop\La télévision.docx
[2010/05/10 19:36:43 | 000,115,778 | ---- | M] () -- C:\Users\Fred\Desktop\shotgun_by_morte_forte.jpg
[2010/05/10 19:08:19 | 000,014,290 | ---- | M] () -- C:\Users\Fred\Desktop\mala_word07.docx
[2010/05/09 20:34:24 | 000,034,304 | ---- | M] () -- C:\Users\Fred\Desktop\mala_word97.doc
[2010/05/06 00:01:59 | 000,451,120 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symtdiv.sys
[2010/05/06 00:01:44 | 000,053,808 | R--- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SymIMV.sys
[2010/05/06 00:01:43 | 000,001,473 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symnetv.inf
[2010/05/06 00:01:43 | 000,001,445 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symnet.inf
[2010/04/30 23:15:28 | 000,000,879 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[2010/04/29 15:39:28 | 000,024,664 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010/04/29 01:03:51 | 000,150,064 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\ironx64.sys
[2010/04/29 01:03:51 | 000,007,402 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\iron.cat
[2010/04/29 01:03:51 | 000,000,771 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\iron.inf
[2010/04/28 19:00:38 | 000,000,033 | ---- | M] () -- C:\Windows\LavaGunZ.INI
[2010/04/27 17:24:38 | 000,000,988 | ---- | M] () -- C:\Users\Fred\Desktop\Arkanic.lnk
[2010/04/27 17:23:55 | 000,000,982 | ---- | M] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\Dofus.lnk
[2010/04/27 17:23:55 | 000,000,958 | ---- | M] () -- C:\Users\Fred\Desktop\Dofus.lnk
[2010/04/26 21:59:13 | 001,524,562 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010/04/26 21:59:13 | 000,684,756 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2010/04/26 21:59:13 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010/04/26 21:59:13 | 000,126,872 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2010/04/26 21:59:13 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010/04/26 04:18:45 | 000,007,829 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symefa64.cat
[2010/04/25 09:56:22 | 000,037,900 | ---- | M] () -- C:\Users\Fred\Desktop\logo.png
[2010/04/24 13:18:40 | 000,002,447 | ---- | M] () -- C:\Users\Fred\Desktop\rofl - Copie
[2010/04/24 07:31:04 | 000,003,373 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symefa.inf
[2010/04/24 00:59:17 | 000,002,037 | ---- | M] () -- C:\Users\Fred\Desktop\images.jpg
[2010/04/21 23:02:36 | 000,007,787 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symnetv64.cat
[2010/04/21 23:02:36 | 000,007,368 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symnet64.cat
[2010/04/21 23:02:20 | 000,221,232 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symefa64.sys
[2010/04/21 23:01:56 | 000,007,406 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\symds64.cat
[2010/04/21 22:29:51 | 000,505,392 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtsp64.sys
[2010/04/21 22:29:51 | 000,032,304 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtspx64.sys
[2010/04/21 22:29:51 | 000,007,414 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtspx64.cat
[2010/04/21 22:29:51 | 000,001,421 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtspx64.inf
[2010/04/21 22:29:50 | 000,007,410 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtsp64.cat
[2010/04/21 22:29:50 | 000,001,437 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1107000.00C\srtsp64.inf
[2010/04/19 19:35:56 | 000,000,909 | ---- | M] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\WeGame.lnk
[2010/04/19 19:35:56 | 000,000,885 | ---- | M] () -- C:\Users\Public\Desktop\WeGame.lnk
[2010/04/13 18:41:29 | 000,001,915 | ---- | M] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\Heroes of Newerth.lnk
[2010/04/13 18:41:27 | 000,001,891 | ---- | M] () -- C:\Users\Fred\Desktop\Heroes of Newerth.lnk
[2010/04/11 19:09:46 | 000,002,119 | ---- | M] () -- C:\Users\Public\Desktop\Soldier Front.lnk
[2010/04/11 18:33:08 | 000,000,254 | -H-- | M] () -- C:\Users\Fred\Desktop\U_SFInstaller.exe.bfi
[2010/04/09 20:44:43 | 000,001,973 | ---- | M] () -- C:\Users\Fred\Desktop\GunzLauncher.exe.lnk
[2010/04/05 14:26:54 | 000,001,647 | ---- | M] () -- C:\Users\Fred\Desktop\Resume Download of Mabinogi.lnk
[2010/04/05 09:55:21 | 058,701,726 | ---- | M] () -- C:\Users\Fred\Desktop\roflmao3.mov
[2010/04/05 09:54:13 | 058,428,303 | ---- | M] () -- C:\Users\Fred\Desktop\roflmao2.mov
[2010/04/05 09:50:56 | 058,429,017 | ---- | M] () -- C:\Users\Fred\Desktop\roflmao.mov
[2010/04/05 09:32:50 | 000,094,492 | ---- | M] () -- C:\Users\Fred\Desktop\cg.aep
[2010/04/04 21:03:30 | 000,725,884 | ---- | M] () -- C:\Users\Fred\Desktop\bigsword.blend
[2010/03/31 20:18:29 | 000,001,788 | ---- | M] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\PartyPoker.net.lnk
[2010/03/31 12:17:00 | 000,426,704 | ---- | M] (True Games Interactive) -- C:\Windows\SysWow64\uc_wepic_launching.dll
[2010/03/26 15:00:50 | 000,041,872 | ---- | M] () -- C:\Windows\SysWow64\xfcodec.dll
[2010/03/26 15:00:50 | 000,027,536 | ---- | M] () -- C:\Windows\SysNative\xfcodec64.dll

========== Files Created - No Company Name ==========

[2010/06/22 11:51:42 | 000,000,037 | ---- | C] () -- C:\Windows\WorldLauncher.INI
[2010/06/22 11:44:17 | 000,000,087 | ---- | C] () -- C:\Users\Fred\AppData\Roaming\RSBot Accounts.ini
[2010/06/19 21:08:01 | 1774,918,342 | ---- | C] () -- C:\Users\Fred\Desktop\barrows.mov
[2010/06/15 19:23:40 | 000,001,013 | ---- | C] () -- C:\Users\Fred\Desktop\RightMark CPU Clock Utility.lnk
[2010/06/13 09:36:56 | 000,188,704 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2010/06/13 07:25:22 | 002,419,568 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_apb.exe
[2010/06/13 01:25:34 | 000,032,647 | ---- | C] () -- C:\Users\Fred\Desktop\Panel.rar
[2010/06/11 20:05:45 | 090,760,118 | ---- | C] () -- C:\Users\Fred\Desktop\reverse.mov
[2010/06/11 19:50:36 | 000,514,154 | ---- | C] () -- C:\Users\Fred\Desktop\Untitled Project.aep
[2010/06/09 18:56:06 | 000,042,751 | ---- | C] () -- C:\Users\Fred\Desktop\Sans titre.png
[2010/06/09 17:09:52 | 000,039,141 | ---- | C] () -- C:\Users\Fred\Desktop\Untitled-1.jpg
[2010/06/08 20:26:14 | 004,001,346 | ---- | C] () -- C:\Users\Fred\Desktop\QUOI ÉTUDIER.tif
[2010/06/08 17:25:06 | 000,000,068 | ---- | C] () -- C:\Windows\Infected GunzLauncher v4.5.1 .INI
[2010/06/05 15:41:21 | 000,008,672 | ---- | C] () -- C:\Users\Fred\Documents\shlip.xlsx
[2010/06/05 09:53:52 | 000,000,086 | ---- | C] () -- C:\Pointer.cfg
[2010/06/05 09:53:52 | 000,000,042 | ---- | C] () -- C:\Packet.cfg
[2010/05/29 21:59:59 | 000,154,768 | ---- | C] () -- C:\Users\Fred\Desktop\pc.aep
[2010/05/29 13:36:38 | 000,002,515 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2010/05/29 12:11:31 | 000,012,429 | ---- | C] () -- C:\Users\Fred\Documents\Serdule.xlsx
[2010/05/29 01:48:59 | 000,087,928 | ---- | C] () -- C:\Users\Fred\Desktop\Untitled-1.png
[2010/05/28 22:14:50 | 000,002,429 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/05/28 22:13:52 | 000,001,807 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/05/27 17:59:54 | 190,821,186 | ---- | C] () -- C:\Users\Fred\Desktop\Comp 1.avi
[2010/05/26 20:19:13 | 000,675,080 | ---- | C] () -- C:\Users\Fred\Desktop\arthax.aep
[2010/05/24 20:53:21 | 000,101,968 | ---- | C] () -- C:\Users\Fred\Desktop\error.jpg
[2010/05/22 21:23:53 | 000,000,000 | ---- | C] () -- C:\Users\Fred\jagex__preferences3.dat
[2010/05/22 13:17:15 | 000,000,949 | ---- | C] () -- C:\Users\Fred\Desktop\Cheat Engine.lnk
[2010/05/22 13:17:01 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll
[2010/05/21 16:30:35 | 003,492,352 | ---- | C] () -- C:\Users\Fred\Desktop\GunzDB.bak
[2010/05/21 15:38:47 | 000,042,739 | ---- | C] () -- C:\Users\Fred\Desktop\medkiwm.jpg
[2010/05/21 10:50:26 | 000,001,878 | ---- | C] () -- C:\Users\Fred\Desktop\Lancer Axus Gunz !.lnk
[2010/05/20 23:22:19 | 001,123,240 | ---- | C] () -- C:\Users\Fred\Desktop\Sets.rar
[2010/05/20 20:20:33 | 000,001,062 | ---- | C] () -- C:\Users\Fred\Desktop\HeroGamers GunZ.lnk
[2010/05/20 18:03:09 | 032,216,105 | ---- | C] () -- C:\Users\Fred\Desktop\TR.mov
[2010/05/20 18:02:01 | 048,180,815 | ---- | C] () -- C:\Users\Fred\Desktop\TF.mov
[2010/05/19 19:04:03 | 000,065,719 | ---- | C] () -- C:\Users\Fred\Desktop\SmokeGlyph.jpg
[2010/05/19 17:57:46 | 000,015,266 | ---- | C] () -- C:\Users\Fred\Desktop\Untitled-2.png
[2010/05/17 19:16:59 | 000,034,281 | ---- | C] () -- C:\Users\Fred\Desktop\22-1281-Llg.jpg
[2010/05/15 19:28:47 | 000,001,722 | ---- | C] () -- C:\Users\Public\Desktop\Play League of Legends.lnk
[2010/05/15 10:47:53 | 000,000,538 | ---- | C] () -- C:\Users\Fred\Desktop\Sequencer.jsx
[2010/05/15 01:17:42 | 000,003,699 | ---- | C] () -- C:\Users\Fred\Desktop\312e302e302e38352d3138.jpg
[2010/05/12 19:20:28 | 000,001,270 | ---- | C] () -- C:\Users\Fred\Desktop\Graboid Video.lnk
[2010/05/12 19:20:05 | 000,001,032 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/05/11 19:58:10 | 000,106,248 | ---- | C] () -- C:\Users\Fred\Desktop\CTFV2.map
[2010/05/11 19:52:43 | 000,222,380 | ---- | C] () -- C:\Users\Fred\Desktop\ctf.blend
[2010/05/11 19:52:43 | 000,216,792 | ---- | C] () -- C:\Users\Fred\Desktop\ctf.blend1
[2010/05/10 22:04:11 | 000,025,658 | ---- | C] () -- C:\Users\Fred\Desktop\lola.jpg
[2010/05/10 21:12:03 | 000,010,307 | ---- | C] () -- C:\Users\Fred\Desktop\COLLEGE BOURGET.docx
[2010/05/10 21:05:46 | 000,011,246 | ---- | C] () -- C:\Users\Fred\Desktop\La télévision.docx
[2010/05/10 19:36:43 | 000,115,778 | ---- | C] () -- C:\Users\Fred\Desktop\shotgun_by_morte_forte.jpg
[2010/05/09 20:36:33 | 000,002,447 | ---- | C] () -- C:\Users\Fred\Desktop\rofl - Copie
[2010/05/09 20:34:24 | 000,034,304 | ---- | C] () -- C:\Users\Fred\Desktop\mala_word97.doc
[2010/05/08 16:43:44 | 000,014,290 | ---- | C] () -- C:\Users\Fred\Desktop\mala_word07.docx
[2010/05/08 11:08:38 | 000,000,070 | ---- | C] () -- C:\Windows\AxusLauncher.INI
[2010/04/27 17:24:38 | 000,000,988 | ---- | C] () -- C:\Users\Fred\Desktop\Arkanic.lnk
[2010/04/27 17:23:55 | 000,000,982 | ---- | C] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\Dofus.lnk
[2010/04/27 17:23:55 | 000,000,958 | ---- | C] () -- C:\Users\Fred\Desktop\Dofus.lnk
[2010/04/24 18:15:33 | 000,000,033 | ---- | C] () -- C:\Windows\LavaGunZ.INI
[2010/04/24 00:56:53 | 000,002,037 | ---- | C] () -- C:\Users\Fred\Desktop\images.jpg
[2010/04/19 19:35:56 | 000,000,909 | ---- | C] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\WeGame.lnk
[2010/04/19 19:35:56 | 000,000,885 | ---- | C] () -- C:\Users\Public\Desktop\WeGame.lnk
[2010/04/13 18:41:27 | 000,001,915 | ---- | C] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\Heroes of Newerth.lnk
[2010/04/13 18:41:27 | 000,001,891 | ---- | C] () -- C:\Users\Fred\Desktop\Heroes of Newerth.lnk
[2010/04/11 19:09:45 | 000,002,119 | ---- | C] () -- C:\Users\Public\Desktop\Soldier Front.lnk
[2010/04/11 18:33:08 | 000,000,254 | -H-- | C] () -- C:\Users\Fred\Desktop\U_SFInstaller.exe.bfi
[2010/04/09 20:44:43 | 000,001,973 | ---- | C] () -- C:\Users\Fred\Desktop\GunzLauncher.exe.lnk
[2010/04/05 15:15:35 | 000,001,182 | ---- | C] () -- C:\Users\Fred\Desktop\ Mabinogi .lnk
[2010/04/05 14:26:54 | 000,001,647 | ---- | C] () -- C:\Users\Fred\Desktop\Resume Download of Mabinogi.lnk
[2010/04/05 09:56:50 | 000,037,900 | ---- | C] () -- C:\Users\Fred\Desktop\logo.png
[2010/04/05 09:55:16 | 058,701,726 | ---- | C] () -- C:\Users\Fred\Desktop\roflmao3.mov
[2010/04/05 09:52:41 | 058,428,303 | ---- | C] () -- C:\Users\Fred\Desktop\roflmao2.mov
[2010/04/05 09:50:50 | 058,429,017 | ---- | C] () -- C:\Users\Fred\Desktop\roflmao.mov
[2010/04/05 09:32:50 | 000,094,492 | ---- | C] () -- C:\Users\Fred\Desktop\cg.aep
[2010/04/04 21:03:30 | 000,725,884 | ---- | C] () -- C:\Users\Fred\Desktop\bigsword.blend
[2010/03/31 20:18:29 | 000,001,788 | ---- | C] () -- C:\Users\Fred\Application Data\Microsoft\Internet Explorer\Quick Launch\PartyPoker.net.lnk
[2010/03/26 15:00:50 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2010/03/26 15:00:50 | 000,027,536 | ---- | C] () -- C:\Windows\SysNative\xfcodec64.dll
[2010/01/29 20:56:12 | 000,000,331 | ---- | C] () -- C:\Windows\game.ini
[2010/01/20 13:43:06 | 000,023,552 | ---- | C] () -- C:\Windows\SysWow64\DirectCOM.dll
[2010/01/20 13:43:00 | 000,309,248 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2010/01/17 19:28:42 | 000,000,082 | ---- | C] () -- C:\Windows\BotLoader.ini
[2010/01/08 22:30:17 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll
[2009/12/27 15:45:35 | 000,000,262 | ---- | C] () -- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2009/12/27 12:56:34 | 000,000,068 | ---- | C] () -- C:\Windows\Gunzlauncher.INI
[2009/12/27 12:45:51 | 000,000,070 | ---- | C] () -- C:\Windows\RawrLauncher.INI
[2009/07/15 20:50:42 | 000,013,312 | ---- | C] () -- C:\Windows\LPRES.DLL
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2008/02/08 18:03:43 | 000,516,096 | ---- | C] () -- C:\Windows\SysWow64\RegisterDialog.dll

========== LOP Check ==========

[2010/03/27 23:31:56 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\.minecraft
[2010/05/08 16:15:43 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Avnex
[2010/03/22 18:59:35 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\FileZilla
[2010/02/26 00:06:44 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\godzHell
[2010/05/11 20:20:55 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\gtk-2.0
[2009/12/27 12:02:37 | 000,000,000 | -H-D | M] -- C:\Users\Fred\AppData\Roaming\ijjigame
[2010/06/22 15:45:45 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\LimeWire
[2010/05/15 00:48:29 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\LolClient
[2010/04/14 19:29:57 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2010/03/13 10:59:23 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\ManyCam
[2010/05/18 19:05:29 | 000,000,000 | -H-D | M] -- C:\Users\Fred\AppData\Roaming\netmarble
[2010/04/28 20:07:29 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Notepad++
[2010/04/16 19:23:34 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Octoshape
[2010/01/08 22:10:32 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Publish Providers
[2010/01/11 17:09:46 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\RadiantSettings
[2010/05/08 16:07:26 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Screaming Bee
[2010/01/10 00:04:01 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Sony
[2010/01/05 00:47:27 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Subversion
[2010/03/20 20:36:58 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\SystemRequirementsLab
[2009/12/30 01:26:20 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\TeamViewer
[2010/01/27 20:21:11 | 000,000,000 | ---D | M] -- C:\Users\Fred\AppData\Roaming\Tific
[2010/05/31 17:13:09 | 000,000,552 | ---- | M] () -- C:\Windows\Tasks\PCDRScheduledMaintenance.job
[2010/04/25 16:58:15 | 000,032,594 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

< %systemroot%\*. /mp /s >

< c:\$recycle.bin\*.* /s >
[2010/02/06 00:21:18 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-20\desktop.ini
[2009/12/26 13:01:17 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1000\desktop.ini
[2010/02/20 21:24:34 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$I4258UQ
[2010/01/16 13:29:03 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\desktop.ini
[2010/02/20 21:23:55 | 000,065,535 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\aah_whatcha_doing.txt
[2010/02/20 21:23:55 | 000,016,175 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\AnimationEvent.xml
[2010/02/20 21:23:55 | 000,006,267 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\channelrule.xml
[2010/02/20 21:23:55 | 000,004,940 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\chatcmds.xml
[2010/02/20 21:23:55 | 000,470,953 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\Copy of zitem.xml
[2010/02/20 21:23:55 | 000,007,533 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\cserror.xml
[2010/02/20 21:23:55 | 000,059,286 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\droptable.xml
[2010/02/20 21:23:55 | 000,279,949 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\filelist.xml
[2010/02/20 21:23:55 | 000,008,845 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\gametypecfg.xml
[2010/02/20 21:23:55 | 000,001,398 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\LenzFlare.xml
[2010/02/20 21:23:55 | 000,000,165 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\locale.xml
[2010/02/20 21:23:55 | 000,014,512 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\messages.xml
[2010/02/20 21:23:55 | 000,001,164 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\notify.xml
[2010/02/20 21:23:55 | 000,027,869 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\npc.xml
[2010/02/20 21:23:55 | 000,007,534 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\questmap.xml
[2010/02/20 21:23:55 | 000,038,654 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\scenario.xml
[2010/02/20 21:23:55 | 000,165,703 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\strings.xml
[2010/02/20 21:23:55 | 000,000,665 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\system.xml
[2010/02/20 21:23:55 | 000,002,932 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\tips.xml
[2010/02/20 21:23:55 | 000,012,006 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\worlditem.xml
[2010/02/20 21:24:23 | 000,488,973 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\zitem.xml
[2010/02/20 21:23:55 | 000,007,193 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\zquestitem.xml
[2010/02/20 21:23:55 | 000,039,712 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1003\$R4258UQ\zskill.xml
[2010/05/19 18:04:11 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-1004\desktop.ini
[2009/10/27 16:57:57 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-21-1409865317-1891469538-1619618794-500\desktop.ini
[2009/10/13 11:47:51 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-21-1566805345-1058017563-41585882-500\desktop.ini
[2009/10/27 16:54:44 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-21-2054117129-650335069-2617700937-500\desktop.ini

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >


< MD5 for: AGP440.SYS >
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2009/07/13 21:14:12 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=41E4C8EBA464E7D6A5BA5E8827732AEB -- C:\Windows\SysWOW64\autochk.exe
[2009/07/13 21:14:12 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=41E4C8EBA464E7D6A5BA5E8827732AEB -- C:\Windows\SysWOW64\autochk.exe
[2009/07/13 21:14:12 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=41E4C8EBA464E7D6A5BA5E8827732AEB -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe
[2009/07/13 21:38:56 | 000,777,728 | ---- | M] (Microsoft Corporation) MD5=8B7F8E882A649D81CEA1EDE9BBB68FFF -- C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996\autochk.exe

< MD5 for: BEEP.SYS >
[2009/07/13 20:00:13 | 000,006,656 | ---- | M] (Microsoft Corporation) MD5=16A47CE2DECC9B099349A5F840654746 -- C:\Windows\winsxs\amd64_microsoft-windows-beepsys_31bf3856ad364e35_6.1.7600.16385_none_201592fa214e4f02\beep.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

< MD5 for: EVENTLOG.DLL >
[2009/12/20 01:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
[2007/05/18 00:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files (x86)\Cyberlink\PowerDirector\EventLog.dll

< MD5 for: EXPLORER.EXE >
[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2009/08/03 02:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe
[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2009/10/31 02:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009/08/03 02:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: IASTOR.SYS >
[2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\hp\drivers\Intel_Storage\IaStor.sys
[2009/06/04 21:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a012329c4d1be4fd\iaStor.sys
[2009/06/04 14:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastor.inf_amd64_neutral_023f2cfe3fa02200\iaStor.sys
[2009/06/04 21:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

< MD5 for: IASTORV.SYS >
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

< MD5 for: IMM32.DLL >
[2009/07/13 21:11:21 | 000,119,808 | ---- | M] (Microsoft Corporation) MD5=0DE3069D6E09BA262856EF31C941BEFE -- C:\Windows\SysWOW64\imm32.dll
[2009/07/13 21:11:21 | 000,119,808 | ---- | M] (Microsoft Corporation) MD5=0DE3069D6E09BA262856EF31C941BEFE -- C:\Windows\SysWOW64\imm32.dll
[2009/07/13 21:11:21 | 000,119,808 | ---- | M] (Microsoft Corporation) MD5=0DE3069D6E09BA262856EF31C941BEFE -- C:\Windows\winsxs\wow64_microsoft-windows-imm32_31bf3856ad364e35_6.1.7600.16385_none_c29fba0fc87cc5a4\imm32.dll
[2009/07/13 21:41:09 | 000,167,424 | ---- | M] (Microsoft Corporation) MD5=AA2C08CE85653B1A0D2E4AB407FA176C -- C:\Windows\winsxs\amd64_microsoft-windows-imm32_31bf3856ad364e35_6.1.7600.16385_none_b84b0fbd941c03a9\imm32.dll

< MD5 for: KERNEL32.DLL >
[2009/07/13 21:41:13 | 001,162,240 | ---- | M] (Microsoft Corporation) MD5=5B4B379AD10DEDA4EDA01B8C6961B193 -- C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.16385_none_efb2d6e86ffc8f55\kernel32.dll
[2009/07/13 21:11:23 | 000,836,608 | ---- | M] (Microsoft Corporation) MD5=606ECB76A424CC535407E7A24E2A34BC -- C:\Windows\SysWOW64\kernel32.dll
[2009/07/13 21:11:23 | 000,836,608 | ---- | M] (Microsoft Corporation) MD5=606ECB76A424CC535407E7A24E2A34BC -- C:\Windows\SysWOW64\kernel32.dll
[2009/07/13 21:11:23 | 000,836,608 | ---- | M] (Microsoft Corporation) MD5=606ECB76A424CC535407E7A24E2A34BC -- C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.16385_none_fa07813aa45d5150\kernel32.dll

< MD5 for: MSWSOCK.DLL >
[2009/07/13 21:15:51 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=11A41F17527ED75D6B758FDD7F4FD00D -- C:\Windows\SysWOW64\mswsock.dll
[2009/07/13 21:15:51 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=11A41F17527ED75D6B758FDD7F4FD00D -- C:\Windows\SysWOW64\mswsock.dll
[2009/07/13 21:15:51 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=11A41F17527ED75D6B758FDD7F4FD00D -- C:\Windows\winsxs\x86_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.1.7600.16385_none_b829ad298e9f53ff\mswsock.dll
[2009/07/13 21:41:34 | 000,320,000 | ---- | M] (Microsoft Corporation) MD5=FC76FE3C1E1FDB761244D4F74EF560FD -- C:\Windows\winsxs\amd64_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.1.7600.16385_none_144848ad46fcc535\mswsock.dll

< MD5 for: NDIS.SYS >
[2009/07/13 21:48:27 | 000,947,776 | ---- | M] (Microsoft Corporation) MD5=CAD515DBD07D082BB317D9928CE8962C -- C:\Windows\winsxs\amd64_microsoft-windows-ndis_31bf3856ad364e35_6.1.7600.16385_none_03bc1d6e35c013bf\ndis.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

< MD5 for: NTFS.SYS >
[2009/07/13 21:48:27 | 001,659,984 | ---- | M] (Microsoft Corporation) MD5=356698A13C4630D5B31C37378D469196 -- C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.16385_none_02661b64369ca03a\ntfs.sys

< MD5 for: NVSTOR.SYS >
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

< MD5 for: PROQUOTA.EXE >
[2009/07/13 21:39:28 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=19117589BA265AAF89BEBE1E9040000C -- C:\Windows\winsxs\amd64_microsoft-windows-proquota_31bf3856ad364e35_6.1.7600.16385_none_83bbe97eac162e90\proquota.exe
[2009/07/13 21:14:29 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=8CDF71E78469BE54C29C1AD2FC8DE611 -- C:\Windows\SysWOW64\proquota.exe
[2009/07/13 21:14:29 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=8CDF71E78469BE54C29C1AD2FC8DE611 -- C:\Windows\SysWOW64\proquota.exe
[2009/07/13 21:14:29 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=8CDF71E78469BE54C29C1AD2FC8DE611 -- C:\Windows\winsxs\x86_microsoft-windows-proquota_31bf3856ad364e35_6.1.7600.16385_none_279d4dfaf3b8bd5a\proquota.exe

< MD5 for: QMGR.DLL >
[2009/07/13 21:41:53 | 000,848,384 | ---- | M] (Microsoft Corporation) MD5=7F0C323FE3DA28AA4AA1BDA3F575707F -- C:\Windows\winsxs\amd64_microsoft-windows-bits-client_31bf3856ad364e35_6.1.7600.16385_none_7f85b69413231233\qmgr.dll

< MD5 for: SCECLI.DLL >
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

< MD5 for: SPOOLSV.EXE >
[2009/07/13 21:39:44 | 000,558,080 | ---- | M] (Microsoft Corporation) MD5=89E8550C5862999FCF482EA562B0E98E -- C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.16385_none_324094c8db39cbbd\spoolsv.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: TERMSRV.DLL >
[2009/07/13 21:41:55 | 000,706,560 | ---- | M] (Microsoft Corporation) MD5=0F05EC2887BFE197AD82A13287D2F404 -- C:\Windows\winsxs\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_ea94336f6df51e09\termsrv.dll

< MD5 for: USERINIT.EXE >
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

< MD5 for: WS2_32.DLL >
[2009/07/13 21:41:58 | 000,296,448 | ---- | M] (Microsoft Corporation) MD5=7083F463788CB34FCC42F565D56F89E8 -- C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.1.7600.16385_none_4eaca269e8070c6b\ws2_32.dll
[2009/07/13 21:16:20 | 000,206,336 | ---- | M] (Microsoft Corporation) MD5=DAAE8A9B8C0ACC7F858454132553C30D -- C:\Windows\SysWOW64\ws2_32.dll
[2009/07/13 21:16:20 | 000,206,336 | ---- | M] (Microsoft Corporation) MD5=DAAE8A9B8C0ACC7F858454132553C30D -- C:\Windows\SysWOW64\ws2_32.dll
[2009/07/13 21:16:20 | 000,206,336 | ---- | M] (Microsoft Corporation) MD5=DAAE8A9B8C0ACC7F858454132553C30D -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.1.7600.16385_none_f28e06e62fa99b35\ws2_32.dll

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

========== Alternate Data Streams ==========

@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:05EE1EEF
< End of report >

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 22nd June 2010, 10:37 pm

OTL Extras logfile created on: 23/04/2010 6:41:30 PM - Run 1
OTL by OldTimer - Version 3.2.2.0 Folder = C:\Users\Fred\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

6.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 55.00% Memory free
12.00 Gb Paging File | 9.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 918.55 Gb Total Space | 819.05 Gb Free Space | 89.17% Space Free | Partition Type: NTFS
Drive D: | 12.87 Gb Total Space | 2.30 Gb Free Space | 17.90% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FRED-PC
Current User Name: Fred
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{26280024-DFB7-4967-90DB-7F9C6660D01E}" = HP MediaSmart SmartMenu
"{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64
"{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{54A55DF7-BCC0-4C98-84AB-01CDA57687C7}" = Hex Workshop v5.1
"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64
"{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4
"{88EAF577-71FA-46F2-8E42-AEA33E35AFB1}" = Vegas Pro 9.0 (64-bit)
"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-040C-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (French) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64
"{AC2512D4-ED8A-4015-BF87-92478483C171}" = TortoiseSVN 1.6.6.17493 (64 bit)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C74A84EC-7C5F-4C36-A4A6-381E516D643B}" = Microsoft IntelliPoint 7.0
"{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)
"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4
"{E601CC5B-6D8F-11DE-4E95-3FE0187790C9}" = ccc-utility64
"{EA9D3111-5B72-4B44-9DC0-9D76EEA2329F}" = SmartFTP Client
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"{F4934901-B3C8-9918-F018-2D68F94B380E}" = ATI Catalyst Install Manager
"HyperCam 2 (64 bit)" = HyperCam 2 (64 bit)
"PC-Doctor for Windows" = Hardware Diagnostic Tools
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{7299052B-02A4-4627-81F2-1818DA5D550D}" = Microsoft Visual C++ 2005 Redistributable
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8ADE24B2-DCA4-4A1E-8B52-A5B435522D9E}" = Soldier Front
"{90120000-0020-040C-0000-0000000FF1CE}" = Module de compatibilité pour Microsoft Office System 2007
"{91120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-00AF-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (French)
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{CE12677C-F7D2-45A8-BBF9-0FC0B972EDC3}" = League of Legends
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"12345_is1" = WeGame Client Public Beta 1.2.1
"Fraps" = Fraps (remove only)
"Gunz" = ijji - Gunz
"hon" = Heroes of Newerth
"LogMeIn Hamachi" = LogMeIn Hamachi
"Mabinogi" = Mabinogi
"ManyCam" = ManyCam 2.4 (remove only)
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"PartyPokerNet" = PartyPoker.net
"PFPortChecker" = PFPortChecker 1.0.32
"Precision" = EVGA Precision 1.9.1
"Simple Port Forwarding" = Simple Port Forwarding
"Trapcode Particular" = Trapcode Particular

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Free Realms Installer" = Free Realms Installer
"Octoshape Streaming Services" = Octoshape Streaming Services
"ParkourGunZ - Beta Test" = ParkourGunZ - Beta Test
"Rawr GunZ V3" = Rawr GunZ V3
"SOE-Free Realms" = Free Realms

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 23rd June 2010, 3:29 am

Hi Hackneyed, Smile

I see you have Limewire installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.


I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

=======

Please download CKScanner by askey127 from [You must be registered and logged in to see this link.]

Save it to your desktop.


  • Doubleclick CKScanner.exe and click Search For Files.
  • After a very short time, when the cursor hourglass disappears, click Save List To File.
  • A message box will verify that the file is saved.
  • Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.


========

Please download Malwarebytes Anti-Malware from [You must be registered and logged in to see this link.].

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • Please save the log to a location you will remember.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 23rd June 2010, 3:51 am

CKScanner - Additional Security Risks - These are not necessarily bad
c:\program files (x86)\realtime worlds\apb north america\apbgame\content\packages\symboleditor\primitives_splatscracks.upk
c:\templar flyff\model\texture\crack.dds
c:\templar flyff\model\texture\obj_ominous_crack.dds
c:\templar flyff\model\texturelow\crack.dds
c:\templar flyff\model\texturelow\obj_ominous_crack.dds
c:\templar flyff\model\texturemid\crack.dds
c:\templar flyff\model\texturemid\obj_ominous_crack.dds
c:\templar flyff\sfx\sfx_sklassknuburstcrack01.sfx
c:\templar flyff\sfx\sfx_taiwancracker01.sfx
c:\templar flyff\sfx\sfx_taiwancracker02.sfx
c:\templar flyff\sfx\texture\sfx_taiwancracker01.dds
c:\templar flyff\sfx\texture\sfx_taiwancracker02.dds
c:\users\fred\desktop\after effetcs\designer sound fx\designer sound fx\abstract (100)\sounds (80)\freeze icy crackling.sfk
c:\users\fred\desktop\after effetcs\designer sound fx\designer sound fx\abstract (100)\sounds (80)\ice crackling 01, thin ice.sfk
scanner sequence 3.JD.11
----- EOF -----

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 24th June 2010, 9:00 pm

Hi again, Smile

Did you run Malwarebytes? If not please run it and post the log here once you get it.

Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 26th June 2010, 5:29 pm

I ran Malwarebytes and it said that I didn't had any suspicious files.

Buuut, recently my internet seems to go very low for a short moment and goes back to normal...

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 26th June 2010, 5:36 pm

Hi, Smile

Could you please post the MBAM log here?

Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 26th June 2010, 6:23 pm

Umm, where could I find it :S

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 26th June 2010, 6:29 pm

Hi, Smile

Please open Malwarebytes and go to the 'Logs' tab, then double click the most recent log to open it, once opened please copy and paste it here in your next reply.

Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 26th June 2010, 6:50 pm

Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4227

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

23/06/2010 1:07:55 AM
mbam-log-2010-06-23 (01-07-55).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 523096
Time elapsed: 1 hour(s), 15 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 26th June 2010, 7:24 pm


Hi Hackneyed, Smile

Please run a free online scan with the [You must be registered and logged in to see this link.]
Note: You will need to use Internet Explorer for this scan

  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Hackneyed on 26th June 2010, 9:12 pm

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK

Hackneyed
Novice
Novice

Posts Posts : 9
Joined Joined : 2010-06-22
OS OS : Windows 7
Points Points : 23753
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Suspecting a backdoor trojan

Post by Sneakyone on 26th June 2010, 10:35 pm

Hi Hackneyed, Smile

Your computer is now clean. Now, time to remove the tools used, and update your computer to prevent vulnerability.

Updating System Restore
Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:
  • Select Start > All Programs > Accessories > System tools > System Restore.
  • On the dialogue box that appears select Create a Restore Point
  • Click NEXT
  • Enter a name e.g. Clean
  • Click CREATE.


You now have a clean restore point.

To get rid of the bad ones:
  • Select Start > All Programs > Accessories > System tools > Disk Cleanup.
  • In the Drop down box that appears select your main drive e.g. C
  • Click OK
  • The System will do a calculation of temporary/old files, and then display a dialogue box.
  • Select the More Options Tab.
  • At the bottom will be a System Restore box with a CLEANUP button click this
  • Accept the Warning and select OK again, the program will close and you are done.


========

Removing the tools
Now, to remove all of the tools we used and the files and folders they created, please do the following:

Download [You must be registered and logged in to see this link.] by OldTimer:
  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.
    Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.


=====

Here are some prevention tips I have provided:

1. Don't download files from untrusted websites or websites that seem suspious.

2. Don't use torrents they are a good way to get lots of malware.

3. Don't download and use cracks/warez/keygens they are illegal and are another good way to contract malware.

4. Disable autorun [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.]

5. Always make sure you have the latest Windows updates. windowsupdate.microsoft.com

6. Don't ever click on the links inside of a popup.

7. Make sure you know what you install you can make sure it is not know for being a virus by just simply searching about it on google.

8. Use a Site Advisor so you don't go to sites that will infect you. [You must be registered and logged in to see this link.]

9. Also there are many holes and flaws in Internet Explorer I recommend using [You must be registered and logged in to see this link.] to keep you more safe.

10. Always keep your [You must be registered and logged in to see this link.] and Adobe updated.

11. Don't fall for the Scareware. What is Scareware? it is a website made to download a rogue Antivirus on your system that will scare you into buying their fake software due to false detections.

12. Always have a Firewall and a Antivirus.

Thanks for choosing GeekPolice, see [You must be registered and logged in to see this link.] if you would like to leave feedback or contribute to our site. Do you have any more questions?

For more information please visit [You must be registered and logged in to see this link.]



Sneakyone
Master
Master

Posts Posts : 2707
Joined Joined : 2010-01-10
Gender Gender : Male
OS OS : Windows 7 Ultimate 64-bit
Protection Protection : Avast, Comodo Firewall, and Malwarebytes' Anti-Malware
Points Points : 56124
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum