All processes killed ========== FILES ========== C:\Users\STACHU\AppData\Local\nsmzcnxp.exe moved successfully. C:\Users\STACHU\AppData\Local\Ngatozikequw.dat moved successfully. C:\Users\STACHU\AppData\Local\Uxogitih.bin moved successfully. C:\Users\STACHU\AppData\Local\y4051468i1onf8wyt6238hkv4850u8sc6c765hfp3un5n moved successfully. C:\Users\STACHU\AppData\Local\605mcc14d74nw837 moved successfully. C:\Users\STACHU\AppData\Local\05re0r73hpdmdp8g0u15a6u6kmy4 moved successfully. C:\Users\STACHU\AppData\Local\7d34t16snostcdvlr1fx05d0p28v406d1j3q6fah3hdl moved successfully. C:\Users\STACHU\AppData\Local\1W776Uj3GddX moved successfully. C:\ProgramData\y4051468i1onf8wyt6238hkv4850u8sc6c765hfp3un5n moved successfully. C:\ProgramData\605mcc14d74nw837 moved successfully. C:\ProgramData\05re0r73hpdmdp8g0u15a6u6kmy4 moved successfully. C:\ProgramData\7d34t16snostcdvlr1fx05d0p28v406d1j3q6fah3hdl moved successfully. C:\ProgramData\1W776Uj3GddX moved successfully. C:\ProgramData\40886008 moved successfully. C:\ProgramData\~40886008r moved successfully. C:\ProgramData\~40886008 moved successfully. C:\Users\STACHU\AppData\Roaming\AnVi folder moved successfully. C:\Users\STACHU\AppData\Roaming\Aske folder moved successfully. C:\Users\STACHU\AppData\Roaming\Hiuzz folder moved successfully. C:\Users\STACHU\AppData\Roaming\Yboxir folder moved successfully. C:\Users\STACHU\AppData\Roaming\Iggil folder moved successfully. C:\Users\STACHU\AppData\Roaming\lowsec folder moved successfully. C:\Users\STACHU\AppData\Roaming\36A4.1A3 moved successfully. C:\Users\STACHU\AppData\Roaming\kuhzmn.dat moved successfully. C:\Users\STACHU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Shield.lnk moved successfully. C:\Users\STACHU\AppData\Local\Temp(1937)\WPDNSE folder moved successfully. C:\Users\STACHU\AppData\Local\Temp(1937)\Low folder moved successfully. C:\Users\STACHU\AppData\Local\Temp(1937)\Google Toolbar folder moved successfully. C:\Users\STACHU\AppData\Local\Temp(1937) folder moved successfully. C:\$RECYCLE(0).BIN\S-1-5-21-408722605-22452316-1379768568-1000 folder moved successfully. C:\$RECYCLE(0).BIN folder moved successfully. ========== OTL ========== Prefs.js: "Ask.com" removed from browser.search.defaultengine Prefs.js: "Web Search..." removed from browser.search.defaultenginename Prefs.js: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" removed from browser.search.defaulturl Prefs.js: "Ask.com" removed from browser.search.order.1 Prefs.js: {3A149812-36FE-42BB-B813-DF39C3FA81E2}:1.9.1 removed from extensions.enabledItems Prefs.js: "http://vshare.toolbarhome.com/search.aspx?srch=ku&q=" removed from keyword.URL Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD79A59-37B1-459B-9097-09F9FAB8A523}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1FD79A59-37B1-459B-9097-09F9FAB8A523}\ not found. Registry value HKEY_USERS\S-1-5-21-408722605-22452316-1379768568-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. Registry value HKEY_USERS\S-1-5-21-408722605-22452316-1379768568-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found. Registry value HKEY_USERS\S-1-5-21-408722605-22452316-1379768568-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. C:\Users\STACHU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c355e430-745f-11dd-b592-001644d31fa1}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c355e430-745f-11dd-b592-001644d31fa1}\ not found. File D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sic32.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c355e430-745f-11dd-b592-001644d31fa1}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c355e430-745f-11dd-b592-001644d31fa1}\ not found. File D:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sic32.exe not found. Registry value HKEY_USERS\S-1-5-21-408722605-22452316-1379768568-1000_Classes\exefile\shell\open\command\\'' updated successfully. Registry key HKEY_USERS\S-1-5-21-408722605-22452316-1379768568-1000_Classes\.exe\ deleted successfully. Registry key HKEY_USERS\S-1-5-21-408722605-22452316-1379768568-1000_Classes\exefile\ deleted successfully. HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully! ADS C:\Windows:638DB0F4890954A7 deleted successfully. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{5EE769D8-A5AA-47FA-A0DF-7DD060BB23DD}C:\windows\explorer.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{73CF5BB9-F9EF-4054-B448-77EEAE2175E2}C:\program files\sopcast\adv\sopadver.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{1CFE2150-B31C-41D7-80FE-D6502CF46074}C:\program files\sopcast\adv\sopadver.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{9BAB9BFB-37E9-42FA-BA42-E4F46F7683B1}C:\windows\explorer.exe deleted successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 56504 bytes User: Default User ->Flash cache emptied: 0 bytes User: Public User: STACHU ->Flash cache emptied: 70122 bytes Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 402 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: STACHU ->Temp folder emptied: 95454412 bytes ->Temporary Internet Files folder emptied: 234165136 bytes ->Java cache emptied: 49431877 bytes ->FireFox cache emptied: 80703926 bytes ->Google Chrome cache emptied: 6126412 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 103974186 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 111521844 bytes Total Files Cleaned = 650,00 mb OTL by OldTimer - Version 3.2.26.1 log created on 07102011_163013 Files\Folders moved on Reboot... Registry entries deleted on Reboot...