:OTL SRV - [2011/10/29 19:50:14 | 000,258,048 | ---- | M] () [Auto | Running] – C:\Windows\sysdriver32.exe – (srvsysdriver32) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.theprizeday.com/today.php FF - prefs.js…browser.search.defaultthis.engineName: “free-downloads.net Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&SearchSource=3&q={searchTerms}” FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\{E63605FC-D583-4C81-867F-9457BDB3EA1B}: C:\Program Files (x86)\Web Search Operator\3.1.0.1840\FF [2009/12/05 11:33:56 | 000,000,000 | —D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\{8141440E-08F0-4339-9959-5C31C6A69F23}: C:\Program Files (x86)\Automated Content Enhancer\4.1.0.5190\FF [2009/12/05 11:34:03 | 000,000,000 | —D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\{E889F097-B0BE-471B-89AD-B86B6F04B506}: C:\Program Files (x86)\Customized Platform Advancer\4.1.0.1800\FF [2009/12/05 11:34:12 | 000,000,000 | —D | M] [2011/07/31 14:51:54 | 000,000,939 | ---- | M] () – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\wzeit7rg.default\searchplugins\conduit.xml [2011/01/08 20:07:04 | 000,002,059 | ---- | M] () – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\wzeit7rg.default\searchplugins\daemon-search.xml [2010/07/12 00:20:33 | 000,010,017 | ---- | M] () – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\wzeit7rg.default\searchplugins\mywebsearch.xml O3:64bit: - HKLM…\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - No CLSID value found. [2011/10/29 19:55:39 | 000,000,000 | —D | C] – C:\Windows\ufa [2011/10/29 19:55:39 | 000,000,000 | —D | C] – C:\Windows\rpcminer [2011/10/29 19:55:39 | 000,000,000 | —D | C] – C:\Windows\phoenix [2011/10/29 19:53:06 | 000,000,000 | -H-D | C] – C:\Windows\update.5.0 [2011/10/29 19:52:03 | 000,000,000 | -H-D | C] – C:\Windows\update.2 [2011/10/29 19:49:49 | 000,000,000 | -H-D | C] – C:\Windows\update.1 [2011/10/29 19:49:48 | 001,109,504 | ---- | C] (Cronosoft) – C:\Windows\services32.exe [2011/10/30 09:22:51 | 000,000,734 | ---- | M] () – C:\Windows\SysNative\drivers\etc\hîsts [2011/10/30 09:22:19 | 000,000,113 | ---- | M] () – C:\Windows\info1 [2011/10/29 19:55:38 | 005,589,370 | ---- | M] () – C:\Windows\phoenix.rar [2011/10/29 19:55:38 | 001,075,284 | ---- | M] () – C:\Windows\rpcminer.rar [2011/10/29 19:55:38 | 000,246,272 | ---- | M] () – C:\Windows\unrar.exe [2011/10/29 19:55:38 | 000,182,617 | ---- | M] () – C:\Windows\ufa.rar [2011/10/29 19:51:29 | 000,904,792 | ---- | M] () – C:\Windows\geoiplist.rar [2011/10/29 19:50:46 | 000,000,000 | ---- | M] () – C:\Windows\loader2.exe_ok [2011/10/29 19:50:14 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32_.exe [2011/10/29 19:50:14 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32.exe [2011/10/29 19:49:40 | 001,109,504 | ---- | M] (Cronosoft) – C:\Windows\services32.exe [2010/08/20 10:17:58 | 000,000,000 | -HSD | M] – C:\Users\user\AppData\Roaming.# [2009/11/07 17:33:25 | 000,000,378 | ---- | M] () – C:\Windows\Tasks\NSSstub.job :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” :Commands [emptytemp] [resethosts]