Solved internet explorer randomly closing

[Resolved] internet explorer randomly closing

I first placed this in internet explorer but admin told me to do a few things then post here. The problem started when my internet windows were closing down so i done a system restore and the same problem was happening, i was told to run malware and a few other things then post the results upon here, so hoping i have done everything right.
the files are below;
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.03.21.10

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Philip Green :: PHILIP [administrator]

3/21/2013 3:35:05 PM
mbam-log-2013-03-21 (15-35-05).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 221742
Time elapsed: 19 minute(s), 24 second(s)

Memory Processes Detected: 1
C:\WINDOWS\system32\WmInit.exe (Trojan.Backdoor) -> 1968 -> Delete on reboot.

Memory Modules Detected: 1
C:\Program Files\VSAdd-in\VSAdd-in_1.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Detected: 46
HKCR\CLSID\{013A653B-49A6-4f76-8B68-E4875EA6BA54} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{1557B435-8242-4686-9AA3-9265BF7525A4} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{3FD6B99C-A275-46ea-8FD1-3D63986E51E4} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{46A4E9D9-B30E-452A-8157-DBBEC8573B03} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{46A4E9D9-B30E-452A-8157-DBBEC8573B03} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{46A4E9D9-B30E-452A-8157-DBBEC8573B03} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{57E218E6-5A80-4f0c-AB25-83598F25D7E9} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{67C55A8D-E808-4caa-9EA7-F77102DE0BB6} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{74DD705D-6834-439C-A735-A6DBE2677452} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{74DD705D-6834-439C-A735-A6DBE2677452} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{7DA39570-5FD2-4f18-94B4-20730CB3F727} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{B7672BAF-E9A3-49B6-86B2-C81719A18A4C} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{D38439EC-4A7F-42b4-90C2-D810D7778FDD} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{D651AFF4-9590-424d-BD1E-8E33E090DFB3} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{E12BFF69-38A7-406e-A8EF-2738107A7831} (Trojan.Agent) -> Quarantined and deleted successfully.
HKCR\CLSID\{F18F04B0-9CF1-4b93-B004-77A288BEE28B} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCR\CLSID\{F63E3B76-F82F-46EB-851C-8C0A221686BB} (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\TypeLib\{F585CB1F-F17D-4007-A573-B663197EF500} (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\Interface\{7F4E63C9-F30C-4424-9BAF-B6896F5F56C4} (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\FlFxr15.FlFixer15 (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum (Trojan.LameShield) -> Quarantined and deleted successfully.
HKCR\FWraper.FFEnginWraper (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\FWraper.FFEnginWraper.1 (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\FxCore.MMFixCore (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\FxCore.MMFixCore.1 (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\MMFxCtrl.CoFixEngine (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCR\MMFxCtrl.CoFixEngine.1 (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKCU\dark (Trojan.Banker) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\aldd (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\CAC (Malware.Trace) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\DomainService (Trojan.Agent) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Detected: 12
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Ugkom (Trojan.Cridex) -> Data: "C:\Documents and Settings\Philip Green\Application Data\Duxeq\vyyvi.exe" -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Baowixzou (Trojan.Agent) -> Data: "C:\Documents and Settings\Philip Green\Application Data\Ylxu\cyqio.exe" -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks|{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C} (Trojan.Vundo) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{74DD705D-6834-439C-A735-A6DBE2677452} (Trojan.Vundo) -> Data: ]pÃt4hÅ“C§5¦Ã›Ã¢gtR -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{74DD705D-6834-439C-A735-A6DBE2677452} (Trojan.Vundo) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{74DD705D-6834-439C-A735-A6DBE2677452} (Trojan.Vundo) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Data: a·¸+߬H»Ã ¼Ã€:›; -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{74DD705D-6834-439C-A735-A6DBE2677452} (Trojan.Vundo) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} (Trojan.Vundo) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Windows Media (Trojan.Backdoor) -> Data: C:\WINDOWS\system32\WmInit.exe -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search| (Adware.Hotbar) -> Data: http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZKxdm171YYGB -> Quarantined and deleted successfully.

Registry Data Items Detected: 1
HKCR\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32| (Trojan.Zaccess) -> Bad: (\\.\globalroot\systemroot\Installer\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\n.) Good: (wbemess.dll) -> Quarantined and repaired successfully.

Folders Detected: 4
C:\Documents and Settings\Philip Green\Start Menu\Programs\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully.
C:\Documents and Settings\Philip Green\Application Data\SearchToolbarCorp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Philip Green\Application Data\SearchToolbarCorp\Toolbar Vision (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VSAdd-in (Trojan.Agent) -> Delete on reboot.

Files Detected: 17
C:\Documents and Settings\Philip Green\Application Data\Duxeq\vyyvi.exe (Trojan.Cridex) -> Quarantined and deleted successfully.
C:\Documents and Settings\Philip Green\Application Data\Ylxu\cyqio.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VSAdd-in\VSAdd-in_1.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\SysProtect Free\FlFxr15.dll (Rogue.Errorsafe) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\6F638BBA4A60CE47005034E6E56C34C7\6F638BBA4A60CE47005034E6E56C34C7.exe (Trojan.LameShield) -> Quarantined and deleted successfully.
C:\Documents and Settings\Philip Green\Application Data\Yrar\upufg.exe (Trojan.Inject) -> Quarantined and deleted successfully.
C:\Downloads\AntWar_Setup-dm[1].exe (Adware.TryMedia) -> Quarantined and deleted successfully.
C:\Downloads\BeachLifeEngSetup-dm[1].exe (Adware.TryMedia) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\16427B.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Philip Green\Local Settings\Temp\Drwatsonp.exe (Trojan.FakeMS.PRGen) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\dba2218.exe (Dialler.Pr0n) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba2218.exe (Dialler.Pr0n) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\str.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Philip Green\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WmInit.exe (Trojan.Backdoor) -> Delete on reboot.
C:\Documents and Settings\Philip Green\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Philip Green\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt (Trojan.Agent) -> Quarantined and deleted successfully.

(end)

mbr check
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-03-21 16:05:50
-----------------------------
16:05:50.171 OS Version: Windows 5.1.2600 Service Pack 2
16:05:50.171 Number of processors: 1 586 0x801
16:05:50.171 ComputerName: PHILIP UserName:
16:05:52.093 Initialize success
16:06:15.140 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
16:06:15.156 Disk 0 Vendor: HDS728080PLAT20 PF2OA21B Size: 78533MB BusType: 3
16:06:15.281 Disk 0 MBR read successfully
16:06:15.281 Disk 0 MBR scan
16:06:15.296 Disk 0 Windows XP default MBR code
16:06:15.296 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 78520 MB offset 63
16:06:15.312 Disk 0 scanning sectors +160810650
16:06:15.484 Disk 0 scanning C:\WINDOWS\system32\drivers
16:06:21.359 Service scanning
16:06:41.156 Modules scanning
16:07:21.484 Disk 0 trace - called modules:
16:07:21.531 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
16:07:21.531 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b2e908]
16:07:21.546 3 CLASSPNP.SYS[f78c805b] -> nt!IofCallDriver -> \Device\0000005c[0x85b86f18]
16:07:22.562 5 ACPI.sys[f780e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x85bd8b58]
16:07:22.625 Scan finished successfully
16:09:31.718 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Philip Green\Desktop\MBR.dat "
16:09:31.734 The log file has been saved successfully to "C:\Documents and Settings\Philip Green\Desktop\aswMBR.txt "


dds logs
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 5/31/2005 9:31:09 PM
System Uptime: 3/21/2013 3:59:58 PM (1 hours ago)
.
Motherboard: | | KM400A-8237
Processor: AMD Sempron(tm) 2600+ | Socket A | 1826/166mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 77 GiB total, 35.824 GiB free.
D: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Video Controller (VGA Compatible)
Device ID: PCI\VEN_1106&DEV_7205&SUBSYS_72051106&REV_01\4&1FEB96E4&0&0008
Manufacturer:
Name: Video Controller (VGA Compatible)
PNP Device ID: PCI\VEN_1106&DEV_7205&SUBSYS_72051106&REV_01\4&1FEB96E4&0&0008
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: RAID Controller
Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_31491106&REV_80\3&61AAA01&0&78
Manufacturer:
Name: RAID Controller
PNP Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_31491106&REV_80\3&61AAA01&0&78
Service:
.
Class GUID: {4D36E965-E325-11CE-BFC1-08002BE10318}
Description: CD-ROM Drive
Device ID: IDE\CDROMPIONEER_DVD-RW__DVR-109_________________1.17____\45_04443334C373533345738204C202020202020
Manufacturer: (Standard CD-ROM drives)
Name: PIONEER DVD-RW DVR-109
PNP Device ID: IDE\CDROMPIONEER_DVD-RW__DVR-109_________________1.17____\45_04443334C373533345738204C202020202020
Service: cdrom
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Multimedia Audio Controller
Device ID: PCI\VEN_1106&DEV_3059&SUBSYS_F6141565&REV_60\3&61AAA01&0&8D
Manufacturer:
Name: Multimedia Audio Controller
PNP Device ID: PCI\VEN_1106&DEV_3059&SUBSYS_F6141565&REV_60\3&61AAA01&0&8D
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\ITE8704\3&61AAA01&0
Manufacturer:
Name:
PNP Device ID: ACPI\ITE8704\3&61AAA01&0
Service:
.
==== System Restore Points ===================
.
RP1634: 12/22/2012 8:52:07 PM - System Checkpoint
RP1635: 12/23/2012 11:37:37 PM - System Checkpoint
RP1636: 12/25/2012 5:09:49 PM - System Checkpoint
RP1637: 12/26/2012 6:45:14 PM - System Checkpoint
RP1638: 12/27/2012 10:42:47 PM - System Checkpoint
RP1639: 12/29/2012 9:23:15 PM - System Checkpoint
RP1640: 12/31/2012 3:13:44 PM - System Checkpoint
RP1641: 1/2/2013 1:03:03 PM - System Checkpoint
RP1642: 1/3/2013 1:13:30 PM - System Checkpoint
RP1643: 1/4/2013 2:19:43 PM - System Checkpoint
RP1644: 1/6/2013 6:21:52 PM - System Checkpoint
RP1645: 1/7/2013 9:15:03 PM - System Checkpoint
RP1646: 1/9/2013 1:53:15 PM - System Checkpoint
RP1647: 1/10/2013 9:35:36 PM - System Checkpoint
RP1648: 1/12/2013 3:20:02 PM - System Checkpoint
RP1649: 1/13/2013 7:10:09 PM - System Checkpoint
RP1650: 1/14/2013 8:22:34 PM - System Checkpoint
RP1651: 1/15/2013 11:18:28 PM - System Checkpoint
RP1652: 1/17/2013 7:24:31 PM - System Checkpoint
RP1653: 1/18/2013 3:37:54 PM - Installed Java 7 Update 11
RP1654: 1/19/2013 8:55:37 PM - System Checkpoint
RP1655: 1/21/2013 12:56:06 PM - System Checkpoint
RP1656: 1/22/2013 2:24:24 PM - System Checkpoint
RP1657: 1/23/2013 10:33:11 PM - System Checkpoint
RP1658: 1/25/2013 10:49:47 AM - System Checkpoint
RP1659: 1/26/2013 4:39:25 PM - System Checkpoint
RP1660: 1/27/2013 6:30:55 PM - System Checkpoint
RP1661: 1/28/2013 10:40:02 PM - System Checkpoint
RP1662: 1/30/2013 12:36:00 PM - System Checkpoint
RP1663: 1/31/2013 12:50:15 PM - System Checkpoint
RP1664: 2/1/2013 2:49:36 PM - System Checkpoint
RP1665: 2/1/2013 10:50:47 PM - Removed Java 7 Update 9
RP1666: 2/1/2013 10:51:39 PM - Installed Java 7 Update 13
RP1667: 2/3/2013 7:37:44 PM - System Checkpoint
RP1668: 2/4/2013 11:40:20 PM - System Checkpoint
RP1669: 2/6/2013 12:16:25 AM - System Checkpoint
RP1670: 2/7/2013 12:19:52 AM - System Checkpoint
RP1671: 2/8/2013 2:28:45 PM - System Checkpoint
RP1672: 2/10/2013 5:38:38 PM - System Checkpoint
RP1673: 2/11/2013 5:51:19 PM - System Checkpoint
RP1674: 2/12/2013 10:42:20 PM - System Checkpoint
RP1675: 2/14/2013 11:44:17 AM - System Checkpoint
RP1676: 2/15/2013 1:48:25 PM - System Checkpoint
RP1677: 2/16/2013 3:22:40 PM - System Checkpoint
RP1678: 2/18/2013 4:50:13 PM - System Checkpoint
RP1679: 2/19/2013 10:42:12 PM - System Checkpoint
RP1680: 2/21/2013 3:44:40 PM - System Checkpoint
RP1681: 2/22/2013 10:40:22 PM - System Checkpoint
RP1682: 2/22/2013 11:21:33 PM - Removed Java 7 Update 13
RP1683: 2/22/2013 11:22:14 PM - Installed Java 7 Update 15
RP1684: 2/24/2013 6:29:14 PM - System Checkpoint
RP1685: 2/25/2013 10:35:54 PM - System Checkpoint
RP1686: 2/26/2013 10:47:26 PM - System Checkpoint
RP1687: 2/28/2013 12:52:02 PM - System Checkpoint
RP1688: 3/1/2013 5:43:10 PM - System Checkpoint
RP1689: 3/2/2013 6:33:16 PM - System Checkpoint
RP1690: 3/3/2013 6:35:31 PM - System Checkpoint
RP1691: 3/5/2013 2:10:33 PM - System Checkpoint
RP1692: 3/7/2013 11:42:13 AM - System Checkpoint
RP1693: 3/8/2013 2:16:00 PM - System Checkpoint
RP1694: 3/9/2013 6:43:26 PM - System Checkpoint
RP1695: 3/9/2013 7:31:36 PM - Removed Java 7 Update 15
RP1696: 3/9/2013 7:32:12 PM - Installed Java 7 Update 17
RP1697: 3/10/2013 7:46:23 PM - System Checkpoint
RP1698: 3/11/2013 11:42:56 PM - System Checkpoint
RP1699: 3/13/2013 12:23:23 PM - System Checkpoint
RP1700: 3/14/2013 8:14:49 PM - System Checkpoint
RP1701: 3/15/2013 8:15:39 PM - System Checkpoint
RP1702: 3/17/2013 10:47:46 PM - System Checkpoint
RP1703: 3/19/2013 12:02:48 AM - System Checkpoint
RP1704: 3/20/2013 5:48:28 PM - Restore Operation
RP1705: 3/21/2013 12:13:07 AM - Restore Operation
RP1706: 3/21/2013 12:45:53 PM - Removed Java 7 Update 15
RP1707: 3/21/2013 12:46:28 PM - Installed Java 7 Update 17
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
Adobe Acrobat 5.0
Adobe Flash Player 11 ActiveX
Adobe Shockwave Player 11.5
AIM Search
AIO_Scan
Aiseesoft DVD to iPhone Suite
AOL Uninstaller (Choose which Products to Remove)
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoBase 3
ArcSoft VideoImpression 1.6
Bonjour
BufferChm
C5200
C5200_Help
CameraDrivers
CameraUserGuides
Cards_Calendar_OrderGift_DoMorePlugout
Copy
Creative System Information
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DocProc
DocProcQFolder
Download Updater (AOL LLC)
ExpressFiles
Fax
GPBaseService
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976002-v5)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 10.0
HP Imaging Device Functions 10.0
HP Photosmart All-In-One Driver Software 10.0 Rel .2
HP Photosmart Cameras 6.0
HP Photosmart Essential
HP Photosmart Essential 2.5
HP Solution Center 10.0
HP Update
hpiCamDrvQFolder
HPPhotoSmartDiscLabel_PaperLabel
HPPhotoSmartDiscLabel_PrintOnDisc
HPPhotoSmartDiscLabelContent1
hpphotosmartdisclabelplugin
HPPhotoSmartPhotobookWebPack1
HPProductAssistant
IndustryPlayer 5
IrfanView (remove only)
iTunes
J2SE Runtime Environment 5.0 Update 10
Java 2 Runtime Environment, SE v1.4.2_03
Java 7 Update 17
Java Auto Updater
Java(TM) 6 Update 3
Java(TM) 6 Update 35
Java(TM) 6 Update 5
Java(TM) 6 Update 6
Java(TM) 6 Update 7
Junk Mail filter update
Malwarebytes Anti-Malware version 1.70.0.1100
MarketResearch
MetaFrame Presentation Server Web Client for Win32
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Live Add-in 1.3
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft VC9 runtime libraries
MobileMe Control Panel
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
My Friend Pingu
Nokia Connectivity Cable Driver
Nokia MTP driver
Nokia PC Connectivity Solution
Nokia PC Suite
Nokia Software Launcher
OCR Software by I.R.I.S. 10.0
OpenOffice.org Installer 1.0
PanoStandAlone
PCI SoftV92 Modem
Philips ToUcam Fun Camera
Plus500
Productivity 3.1 Toolbar
PS_AIO_02_ProductContext
PS_AIO_02_Software
PS_AIO_02_Software_Min
PSSWCORE
QuickTime
SAMSUNG Mobile Composite Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
Samsung PC Studio
Samsung PC Studio 3
Scan
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Segoe UI
Shockwave
Sickest Adder v2.1
Sky Broadband
Skypeâ„¢ 5.3
Smart Label Printer 6.2
SolutionCenter
SpeedTouch 330
Status
SysProtect 1.3.146.0
Toolbox
Touchdown Madness
TrayApp
Ultimate Paint 2.88
Unload
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
VideoToolkit01
WebFldrs XP
WebReg
Windows Driver Package - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
Windows Driver Package - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
Windows Driver Package - Nokia Modem (06/12/2006 6.81.0.21)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Yahoo! Messenger
.
==== Event Viewer Messages From Past Week ========
.
3/21/2013 4:05:48 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired.
3/21/2013 4:02:10 PM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
3/21/2013 4:01:58 PM, error: Service Control Manager [7000] - The DP1112 service failed to start due to the following error: The system cannot find the file specified.
3/20/2013 6:47:57 PM, error: Schannel [36882] - The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate.
.
==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.17.2
Run by Philip Green at 16:10:14 on 2013-03-21
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.132 [GMT 0:00]
.
.
============== Running Processes ================
.
C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ExpressFiles\EFupdater.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\Program Files\Thomson SpeedTouch\ST330\diagnostics\diagnostics.exe
C:\Program Files\Common Files\AOL\1200932265\ee\AOLSoftware.exe
C:\PROGRA~1\PHILIP~1\VProperty.exe
C:\Program Files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe
C:\Program Files\ExpressFiles\ExpressFiles.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\Seiko\slpcap.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.sky.com/
uWindow Title = Internet Explorer Provided By Sky Broadband
uSearch Bar = hxxp://www.orange.co.uk/iesearch/
uDefault_Page_URL = hxxp://www.sky.com
uInternet Connection Wizard,ShellNext = iexplore
uProxyOverride = <local>;*.local
uURLSearchHooks: AOLSearchHook Class: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - c:\program files\aim search\AOLSearch.dll
mWinlogon: SFCDisable = dword:4
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: AOLSearchHook Class: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - c:\program files\aim search\AOLSearch.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Productivity 3.1 Toolbar: {9427041a-a8dc-4d06-9a68-93873486e957} - c:\program files\productivity_3.1\prxtbPro0.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: <No Name>: {DF941BC7-DD2A-484E-BD2C-8B8FF174D1EB} -
TB: Productivity 3.1 Toolbar: {9427041A-A8DC-4D06-9A68-93873486E957} - c:\program files\productivity_3.1\prxtbPro0.dll
TB: Productivity 3.1 Toolbar: {9427041a-a8dc-4d06-9a68-93873486e957} - c:\program files\productivity_3.1\prxtbPro0.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [PcSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog
uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [NSLauncher] c:\program files\nokia\nokia software launcher\NSLauncher.exe /startup
mRun: [diagnostics] "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" /icon -l:en
mRun: [HostManager] c:\program files\common files\aol\1200932265\ee\AOLSoftware.exe
mRun: [ToUcamVProperty] c:\progra~1\philip~1\VProperty.exe
mRun: [DataCardMonitor] c:\program files\t-mobile\web'n'walk manager\DataCardMonitor.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe "
mRun: [ExpressFiles] "c:\program files\expressfiles\ExpressFiles.exe" -tray
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
StartupFolder: c:\docume~1\philip~1\startm~1\programs\startup\smartc~1.lnk - c:\windows\seiko\slpcap.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\WTGU.lnk -
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &Search - <no file>
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/WebfettiInitialSetup1.0.1.0.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{4E0C4855-F98B-4126-8198-CE5A6D3E5FE9} : DHCPNameServer = 192.168.0.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: ddcbbyy - ddcbbyy.dll
Notify: ysscp - c:\windows\apppatch\ysscp.dll
.
============= SERVICES / DRIVERS ===============
.
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-3-19 54752]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-24 24652]
S1 dvcvlqia;dvcvlqia;\??\c:\windows\system32\drivers\dvcvlqia.sys --> c:\windows\system32\drivers\dvcvlqia.sys [?]
S1 tveojhbr;tveojhbr;\??\c:\windows\system32\drivers\tveojhbr.sys --> c:\windows\system32\drivers\tveojhbr.sys [?]
S2 DP1112;DP1112;\??\c:\windows\system32\drivers\dp.sys --> c:\windows\system32\drivers\DP.sys [?]
S2 zgmtotxwd;zgmtotxwd; "c:\docume~1\philip~1\locals~1\temp\dat6f3.tmp.exe" --service --> c:\docume~1\philip~1\locals~1\temp\DAT6F3.tmp.exe [?]
S3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [2008-7-30 223232]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2007-12-21 30464]
S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2007-12-21 12672]
S3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\drivers\stppp.sys [2007-12-21 32000]
.
=============== File Associations ===============
.
ShellExec: FRONTPG.EXE: edit=c:\progra~1\micros~2\office10\FRONTPG.EXE
.
=============== Created Last 30 ================
.
2013-03-21 15:29:29 -------- d-----w- c:\documents and settings\philip green\application data\Malwarebytes
2013-03-21 15:29:07 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2013-03-21 15:29:06 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-21 15:29:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-03-21 12:47:18 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
.
==================== Find3M ====================
.
2013-03-21 12:46:47 143872 ----a-w- c:\windows\system32\javacpl.cpl
2013-03-21 12:46:46 861088 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-03-21 12:46:45 782240 ----a-w- c:\windows\system32\deployJava1.dll
2006-04-05 02:46:57 38925 -csh--w- c:\windows\system32\vtsqo.dll
.
============= FINISH: 16:11:29.87 ===============

If anymore stuff is needed i apologise and just tell me what it is.
Thank you very much and hopefully i have added the logs the correct way as i couldnt find a way to add them any other way.

 

I hope i have done everything correct, i didnt delete the
* Viewpoint Manager
* Viewpoint Media Player
* Viewpoint Toolbar
stuff as when i went onto delete/remove it was taking hours to load the stuff up.
But heres hoping i have the correct reports for you, i think im putting up the before reports and after reports off anti-rootkit as i didnt know which ones you would be needing, sorry again but here goes
rkreport
RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Normal mode
User : Philip Green [Admin rights]
Mode : Remove -- Date : 03/21/2013 20:48:14
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] n : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\n [-] --> REMOVED
[ZeroAccess][FILE] @ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\@ [-] --> REMOVED
[Del.Parent][FILE] 00000001.@ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U\00000001.@ [-] --> REMOVED
[Del.Parent][FILE] 80000000.@ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U\80000000.@ [-] --> REMOVED
[Del.Parent][FILE] 800000cb.@ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U\800000cb.@ [-] --> REMOVED
[ZeroAccess][FOLDER] ROOT : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U --> REMOVED
[ZeroAccess][FOLDER] ROOT : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\L --> REMOVED

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts

ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: HDS728080PLAT20 +++++
--- User ---
[MBR] a8f63eec555b93342b8c9b5853a3261f
[BSP] 5d7f299ad92007006df8e04978bb6fe4 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 78520 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: Generic Flash Disk USB Device +++++
--- User ---
[MBR] bd393823c76990d7190332bf19e7a8fe
[BSP] e0f164678153a8fd209acbc2f99ce3c8 : MBR Code unknown
Partition table:
0 - [XXXXXX] UNKNOWN (0x20) [VISIBLE] Offset (sectors): 1919950958 | Size: 265838 Mo
1 - [XXXXXX] UNKNOWN (0x6b) [VISIBLE] Offset (sectors): 1330184202 | Size: 263172 Mo
2 - [XXXXXX] DISKMNG (0x53) [VISIBLE] Offset (sectors): 538989391 | Size: 682794 Mo
3 - [ACTIVE] UNKNOWN (0x49) [VISIBLE] Offset (sectors): 1394627663 | Size: 10 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[2]_D_03212013_02d2048.txt >>
RKreport[1]_S_03212013_02d2043.txt ; RKreport[2]_D_03212013_02d2048.txt

Malwarebytes Anti-Rootkit BETA 1.01.0.1021
www.malwarebytes.org

Database version: v2013.03.21.14

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Philip Green :: PHILIP [administrator]

3/21/2013 9:43:32 PM
mbar-log-2013-03-21 (21-43-32).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 27787
Time elapsed: 51 minute(s), 1 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKLM\SOFTWARE\CLASSES\INTERFACE\{F5AC8B35-5B15-4E8F-8046-43858973B495} (Rogue.Errorsafe) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TypeLib\{F585CB1F-F17D-4007-A573-B663197EF500} (Rogue.Errorsafe) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1021

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 2 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 1.827000 GHz
Memory total: 502775808, free: 212594688

------------ Kernel report ------------
03/21/2013 20:51:14
------------ Loaded modules -----------
\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
viaide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
uagp35.sys
Mup.sys
\SystemRoot\system32\DRIVERS\amdk7.sys
\SystemRoot\system32\DRIVERS\HSFHWBS2.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\HSF_DP.sys
\SystemRoot\system32\DRIVERS\HSF_CNXT.sys
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\nic1394.sys
\SystemRoot\system32\drivers\Afc.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\fetnd5.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\wanatw4.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\MODEMCSA.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\tcpipBM.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\System32\Drivers\StarOpen.SYS
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\arp1394.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\framebuf.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\secdrv.sys
\SystemRoot\system32\SetupNT.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\??\C:\WINDOWS\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\System32\Drivers\aswVmm.SYS
\SystemRoot\System32\Drivers\AswRdr.SYS
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR2
Upper Device Object: 0xffffffff8561b588
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000067\
Lower Device Object: 0xffffffff859cf648
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85b7c370
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\
Lower Device Object: 0xffffffff85b7dd98
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Load Function returned 0x0
Downloaded database version: v2013.03.21.14
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85b7c148, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85b7ef18, DeviceName: \Device\0000005c\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff85b7dd98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe2836510, 0xffffffff85b7c370, 0xffffffff85236400
Lower DeviceData: 0xffffffffe13a1920, 0xffffffff85b7dd98, 0xffffffff85262370
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\WINDOWS\system32\drivers...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Read File: File "C:\WINDOWS\system32\drivers\1394bus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\acpiec.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\amdk6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\asyncmac.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmarpc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmepvc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmlane.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmuni.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt264.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bridge.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bthport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\camdrv21.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cbidf2k.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\CCDECODE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nikedrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcj.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ntfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkflt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkfwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkipx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnknb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkspx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\oprghdlr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\p3.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\partmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pciidex.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pcmcia.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\processr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpdr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rio8drv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\riodrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rmcast.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rndismp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rootmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\scsiport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffdisk.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffp_sd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sfloppy.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\SLIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fltmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fsvga.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gm.dls" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gmreadme.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidclass.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidparse.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZid412.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZipr12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZius12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HSFProf.cty" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\intelppm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\Intels51.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ip6fw.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipfltdrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipinip.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tcpip6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdpipe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdtcp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tosdvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tsbvcap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tunmp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\UAGP35.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\udfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usb8023.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\irenum.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ksecdd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mf.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mod7700.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mountmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSKSSRV.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSTEE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mup.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NABTSFEC.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ndis.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NdisIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rawwan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\smclib.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tape.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cinemst2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\classpnp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cpqdap01.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\crusoe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\diskdump.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\dmio.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\enum1394.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewdcsc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbfake.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbnet.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fastfat.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbintel.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbprint.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbscan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\vdmindvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\volsnap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\wpdusb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ws2ifsl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\WSTCODEC.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sonydcam.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdfl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwh.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwhnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\stream.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\StreamIP.sys" is compressed (flags = 1)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 185C185B

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 160810587
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 82348277760 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-160816480-160836480)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85637e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff859cf648, DeviceName: \Device\00000067\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe13e62c8, 0xffffffff8561b588, 0xffffffff855fe720
Lower DeviceData: 0xffffffffe1563258, 0xffffffff859cf648, 0xffffffff852703c0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 73696420

Partition information:

Partition 0 type is Other (0x20)
Partition is INVALID!!!
Partition starts at LBA: 1919950958 Numsec = 544437093

Partition 1 type is Other (0x6b)
Partition is INVALID!!!
Partition starts at LBA: 1330184202 Numsec = 538976288

Partition 2 type is Other (0x53)
Partition is INVALID!!!
Partition starts at LBA: 538989391 Numsec = 1398362912

Partition 3 type is Other (0x49)
Partition is ACTIVE.
Partition starts at LBA: 1394627663 Numsec = 21337
Partition is not bootable

Disk Size: 1992294400 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Infected: HKLM\SOFTWARE\CLASSES\INTERFACE\{F5AC8B35-5B15-4E8F-8046-43858973B495} --> [Rogue.Errorsafe]
Infected: HKLM\SOFTWARE\CLASSES\TypeLib\{F585CB1F-F17D-4007-A573-B663197EF500} --> [Rogue.Errorsafe]
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\settings.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\aol.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\aoldiag.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\aoltpspd.ph" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\appdata.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\axph.ph" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\compver.bin" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\goto.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\gotoko.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\ph.ph" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\shellrestart.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\trayicon.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\version.inf" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\waol.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\OptScan\AOLszr.drv" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\Proofreader\userdicbr.tlx" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\PC Suite\ConfServer\Settings.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Skype\Plugins\_nsStore.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{0DAE8BEF-F156-91D6-F5FB-0A6A77F5A59C}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{1BCF207B-F1CA-F0FA-A369-0A720FE2D562}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{275E5C42-6C5E-D5E9-627E-649DCD68DB50}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{3C5CBC25-2EDD-EB23-571C-CAC08BF1CCE7}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{5C55F68F-F4F8-FA12-F31E-00ACBF845362}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{9790133C-700C-4F08-4DBA-835A7561D735}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{CE7D3F9C-6B7A-49AD-5FB5-79FD86CE8B07}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{D4F3015D-D9AA-98BB-1B73-CE6D32445A58}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\history.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\locate.mtz" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\WEBREG\WebRegData.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Apple Computer\Preferences\iTunes.exe.plist" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Creative\Media Database\ACDL_1.ldb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Creative\Media Database\MTDT_1.ldb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Creative\Media Database\PCML_1.ldb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Datalayer\356962011917086\session.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\HP\WowLogs\WOWDebug.log" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\ICAClient\UISTATE.INI" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\ICAClient\wfcwin32.log" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Image Zone Express\layouts.db" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Media Player\020B3393.wpl" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Office\VB10.pip" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Protect\CREDHIST" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Templates\~$Normal.dot" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Nokia\ContentCopier\Settings_CC3.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Nokia\ImageStore\Settings.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Nokia Multimedia Player\Recent.npl" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\Calendar.pim" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\Contacts.pim" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\fbxPlaylist.fmp" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\funrecent.fmp" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\mstore.fdb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\SMS.msg" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "c:\Program Files\Outlook Express\msoe.txt" is compressed (flags = 1)
Read File: File "c:\Program Files\Windows Media Player\npdrmv2.zip" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc104.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc105.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc64.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc65.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc72.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc80.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc81.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc88.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc89.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc96.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc97.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\desktop.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc136.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc137.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc144.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc112.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc113.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc12.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc120.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc121.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc128.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc129.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc152.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc153.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc16.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc145.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc160.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc57.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc73.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc161.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc168.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc169.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc4.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc5.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc56.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc166.doc" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc167.doc" is compressed (flags = 1)
Read File: File "c:\TEMP\rcjs.log" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\dsound.vxd" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\l_except.nls" is compressed (flags = 1)
Read File: File "c:\windows\system32\interf.tlb" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\perfci.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\perffilt.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\perfwci.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\pscript.sep" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\cmos.ram" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\pcl.sep" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\prodspec.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\View Channels.scf" is compressed (flags = 1)
Read File: File "c:\windows\system32\vtsqo.dll" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\drivers\etc\networks" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\migip.dun" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\migrate.isp" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\msobe.isp" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\obeip.dun" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\oobeinfo.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\reg.isp" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\ntuser.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\ntuser.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Tiny_Run.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\ujf635.bin" is compressed (flags = 1)
Read File: File "c:\WINDOWS\vb.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\vbaddin.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\VI_setup.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\DtcInstall.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\explorer.scf" is compressed (flags = 1)
Read File: File "c:\WINDOWS\cmsetacl.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\wmsetup10.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\ODBC.INI" is compressed (flags = 1)
Read File: File "c:\WINDOWS\PB_setup.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\AppPatch\mcrh.tmp" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Debug\blastcln.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Downloaded Program Files\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.1.0.inf" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Downloaded Program Files\swdir.inf" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Fonts\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\accessib.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\ciadmin.htm" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\conf.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\connect.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\windows.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\mshearts.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\msnauth.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\nocontnt.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\ratings.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\update.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\winhlp32.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_dataperfcounters_shared12_neutral.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\caspol.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet.mof.uninstall" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataOracleClientPerfCounters_shared12_neutral.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\XPThemes.manifest" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\webAdminNoNavBar.master" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\AddInProcess.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\AddInProcess32.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\AddInUtil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\csc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\default.win32manifest" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\EdmGen.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\vbc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Tasks\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Web\bullet.gif" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Local Settings\Application Data\Google\GoogleEarth\dbCache.dat.index" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc104.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc105.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc64.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc65.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc72.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc80.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc81.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc88.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc89.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc96.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc97.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\desktop.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc136.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc137.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc144.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc112.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc113.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc12.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc120.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc121.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc128.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc129.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc152.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc153.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc16.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc145.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc160.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc57.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc73.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc161.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc168.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc169.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc4.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc5.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc56.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc166.doc" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc167.doc" is compressed (flags = 1)
Read File: File "c:\WINDOWS\$NtUninstallKB971633$\update.ver" is compressed (flags = 1)
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal successful. No system shutdown is required.
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1021

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 2 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 1.827000 GHz
Memory total: 502775808, free: 203436032

------------ Kernel report ------------
03/21/2013 21:45:38
------------ Loaded modules -----------
\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
viaide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
uagp35.sys
Mup.sys
\SystemRoot\system32\DRIVERS\amdk7.sys
\SystemRoot\system32\DRIVERS\HSFHWBS2.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\HSF_DP.sys
\SystemRoot\system32\DRIVERS\HSF_CNXT.sys
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\nic1394.sys
\SystemRoot\system32\drivers\Afc.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\fetnd5.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\wanatw4.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\MODEMCSA.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\tcpipBM.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\System32\Drivers\StarOpen.SYS
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\arp1394.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\framebuf.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\secdrv.sys
\SystemRoot\system32\SetupNT.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\??\C:\WINDOWS\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\System32\Drivers\aswVmm.SYS
\SystemRoot\System32\Drivers\AswRdr.SYS
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------

 

<<<1>>>
Upper Device Name: \Device\Harddisk1\DR2
Upper Device Object: 0xffffffff8561b588
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000067\
Lower Device Object: 0xffffffff859cf648
Lower Device Driver Name: \Driver\USBSTOR\
Device already Exists: 0xffffffff852703c0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85b7c370
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\
Lower Device Object: 0xffffffff85b7dd98
Lower Device Driver Name: \Driver\atapi\
Device already Exists: 0xffffffff85262370
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85b7c148, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85b7ef18, DeviceName: \Device\0000005c\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff85b7dd98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe1c4f470, 0xffffffff85b7c370, 0xffffffff85236400
Lower DeviceData: 0xffffffffe22c0670, 0xffffffff85b7dd98, 0xffffffff85262370
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\WINDOWS\system32\drivers...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Read File: File "C:\WINDOWS\system32\drivers\1394bus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\acpiec.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\amdk6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\asyncmac.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmarpc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmepvc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmlane.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmuni.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt264.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bridge.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bthport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\camdrv21.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cbidf2k.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\CCDECODE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nikedrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcj.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ntfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkflt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkfwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkipx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnknb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkspx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\oprghdlr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\p3.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\partmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pciidex.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pcmcia.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\processr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpdr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rio8drv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\riodrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rmcast.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rndismp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rootmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\scsiport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffdisk.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffp_sd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sfloppy.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\SLIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fltmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fsvga.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gm.dls" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gmreadme.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidclass.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidparse.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZid412.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZipr12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZius12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HSFProf.cty" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\intelppm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\Intels51.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ip6fw.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipfltdrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipinip.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tcpip6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdpipe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdtcp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tosdvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tsbvcap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tunmp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\UAGP35.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\udfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usb8023.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\irenum.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ksecdd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mf.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mod7700.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mountmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSKSSRV.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSTEE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mup.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NABTSFEC.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ndis.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NdisIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rawwan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\smclib.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tape.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cinemst2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\classpnp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cpqdap01.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\crusoe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\diskdump.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\dmio.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\enum1394.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewdcsc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbfake.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbnet.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fastfat.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbintel.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbprint.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbscan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\vdmindvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\volsnap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\wpdusb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ws2ifsl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\WSTCODEC.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sonydcam.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdfl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwh.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwhnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\stream.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\StreamIP.sys" is compressed (flags = 1)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 185C185B

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 160810587
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 82348277760 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-160816480-160836480)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85637e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff859cf648, DeviceName: \Device\00000067\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe1bd8c98, 0xffffffff8561b588, 0xffffffff855fe720
Lower DeviceData: 0xffffffffe13fd5e0, 0xffffffff859cf648, 0xffffffff852703c0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 73696420

Partition information:

Partition 0 type is Other (0x20)
Partition is INVALID!!!
Partition starts at LBA: 1919950958 Numsec = 544437093

Partition 1 type is Other (0x6b)
Partition is INVALID!!!
Partition starts at LBA: 1330184202 Numsec = 538976288

Partition 2 type is Other (0x53)
Partition is INVALID!!!
Partition starts at LBA: 538989391 Numsec = 1398362912

Partition 3 type is Other (0x49)
Partition is ACTIVE.
Partition starts at LBA: 1394627663 Numsec = 21337
Partition is not bootable

Disk Size: 1992294400 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...

actually i lied i could only find the 2 reports when i transfered them over on my memory stick hope this helps, and thank you once again, sorry had to sent it in two posts as i went over the limit

 

really sorry i have posted the 2nd part but now the first :s so i will try and do it all again sorry for doing that i will just post the 3 reports
RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Malwarebytes Anti-Rootkit BETA 1.01.0.1021
www.malwarebytes.org

Database version: v2013.03.21.14

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Philip Green :: PHILIP [administrator]

3/21/2013 9:43:32 PM
mbar-log-2013-03-21 (21-43-32).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 27787
Time elapsed: 51 minute(s), 1 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKLM\SOFTWARE\CLASSES\INTERFACE\{F5AC8B35-5B15-4E8F-8046-43858973B495} (Rogue.Errorsafe) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TypeLib\{F585CB1F-F17D-4007-A573-B663197EF500} (Rogue.Errorsafe) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Normal mode
User : Philip Green [Admin rights]
Mode : Remove -- Date : 03/21/2013 20:48:14
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] n : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\n [-] --> REMOVED
[ZeroAccess][FILE] @ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\@ [-] --> REMOVED
[Del.Parent][FILE] 00000001.@ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U\00000001.@ [-] --> REMOVED
[Del.Parent][FILE] 80000000.@ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U\80000000.@ [-] --> REMOVED
[Del.Parent][FILE] 800000cb.@ : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U\800000cb.@ [-] --> REMOVED
[ZeroAccess][FOLDER] ROOT : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\U --> REMOVED
[ZeroAccess][FOLDER] ROOT : C:\Documents and Settings\Philip Green\Local Settings\Application Data\{b936be3d-72bf-79e2-41b3-d1eb67539cbf}\L --> REMOVED

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts

ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: HDS728080PLAT20 +++++
--- User ---
[MBR] a8f63eec555b93342b8c9b5853a3261f
[BSP] 5d7f299ad92007006df8e04978bb6fe4 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 78520 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: Generic Flash Disk USB Device +++++
--- User ---
[MBR] bd393823c76990d7190332bf19e7a8fe
[BSP] e0f164678153a8fd209acbc2f99ce3c8 : MBR Code unknown
Partition table:
0 - [XXXXXX] UNKNOWN (0x20) [VISIBLE] Offset (sectors): 1919950958 | Size: 265838 Mo
1 - [XXXXXX] UNKNOWN (0x6b) [VISIBLE] Offset (sectors): 1330184202 | Size: 263172 Mo
2 - [XXXXXX] DISKMNG (0x53) [VISIBLE] Offset (sectors): 538989391 | Size: 682794 Mo
3 - [ACTIVE] UNKNOWN (0x49) [VISIBLE] Offset (sectors): 1394627663 | Size: 10 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[2]_D_03212013_02d2048.txt >>
RKreport[1]_S_03212013_02d2043.txt ; RKreport[2]_D_03212013_02d2048.txt

 

and this is hopefully the 2nd report from rootkit
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1021

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 2 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 1.827000 GHz
Memory total: 502775808, free: 212594688

------------ Kernel report ------------
03/21/2013 20:51:14
------------ Loaded modules -----------
\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
viaide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
uagp35.sys
Mup.sys
\SystemRoot\system32\DRIVERS\amdk7.sys
\SystemRoot\system32\DRIVERS\HSFHWBS2.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\HSF_DP.sys
\SystemRoot\system32\DRIVERS\HSF_CNXT.sys
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\nic1394.sys
\SystemRoot\system32\drivers\Afc.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\fetnd5.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\wanatw4.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\MODEMCSA.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\tcpipBM.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\System32\Drivers\StarOpen.SYS
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\arp1394.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\framebuf.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\secdrv.sys
\SystemRoot\system32\SetupNT.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\??\C:\WINDOWS\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\System32\Drivers\aswVmm.SYS
\SystemRoot\System32\Drivers\AswRdr.SYS
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR2
Upper Device Object: 0xffffffff8561b588
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000067\
Lower Device Object: 0xffffffff859cf648
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85b7c370
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\
Lower Device Object: 0xffffffff85b7dd98
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Load Function returned 0x0
Downloaded database version: v2013.03.21.14
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85b7c148, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85b7ef18, DeviceName: \Device\0000005c\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff85b7dd98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe2836510, 0xffffffff85b7c370, 0xffffffff85236400
Lower DeviceData: 0xffffffffe13a1920, 0xffffffff85b7dd98, 0xffffffff85262370
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\WINDOWS\system32\drivers...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Read File: File "C:\WINDOWS\system32\drivers\1394bus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\acpiec.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\amdk6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\asyncmac.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmarpc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmepvc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmlane.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmuni.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt264.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bridge.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bthport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\camdrv21.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cbidf2k.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\CCDECODE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nikedrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcj.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ntfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkflt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkfwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkipx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnknb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkspx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\oprghdlr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\p3.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\partmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pciidex.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pcmcia.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\processr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpdr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rio8drv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\riodrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rmcast.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rndismp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rootmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\scsiport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffdisk.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffp_sd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sfloppy.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\SLIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fltmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fsvga.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gm.dls" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gmreadme.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidclass.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidparse.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZid412.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZipr12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZius12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HSFProf.cty" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\intelppm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\Intels51.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ip6fw.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipfltdrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipinip.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tcpip6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdpipe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdtcp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tosdvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tsbvcap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tunmp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\UAGP35.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\udfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usb8023.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\irenum.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ksecdd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mf.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mod7700.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mountmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSKSSRV.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSTEE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mup.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NABTSFEC.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ndis.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NdisIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rawwan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\smclib.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tape.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cinemst2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\classpnp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cpqdap01.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\crusoe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\diskdump.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\dmio.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\enum1394.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewdcsc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbfake.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbnet.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fastfat.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbintel.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbprint.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbscan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\vdmindvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\volsnap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\wpdusb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ws2ifsl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\WSTCODEC.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sonydcam.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdfl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwh.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwhnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\stream.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\StreamIP.sys" is compressed (flags = 1)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 185C185B

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 160810587
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 82348277760 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-160816480-160836480)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85637e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff859cf648, DeviceName: \Device\00000067\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe13e62c8, 0xffffffff8561b588, 0xffffffff855fe720
Lower DeviceData: 0xffffffffe1563258, 0xffffffff859cf648, 0xffffffff852703c0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 73696420

Partition information:

Partition 0 type is Other (0x20)
Partition is INVALID!!!
Partition starts at LBA: 1919950958 Numsec = 544437093

Partition 1 type is Other (0x6b)
Partition is INVALID!!!
Partition starts at LBA: 1330184202 Numsec = 538976288

Partition 2 type is Other (0x53)
Partition is INVALID!!!
Partition starts at LBA: 538989391 Numsec = 1398362912

Partition 3 type is Other (0x49)
Partition is ACTIVE.
Partition starts at LBA: 1394627663 Numsec = 21337
Partition is not bootable

Disk Size: 1992294400 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Infected: HKLM\SOFTWARE\CLASSES\INTERFACE\{F5AC8B35-5B15-4E8F-8046-43858973B495} --> [Rogue.Errorsafe]
Infected: HKLM\SOFTWARE\CLASSES\TypeLib\{F585CB1F-F17D-4007-A573-B663197EF500} --> [Rogue.Errorsafe]
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\settings.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\aol.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\aoldiag.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\aoltpspd.ph" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\appdata.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\axph.ph" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\compver.bin" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\goto.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\gotoko.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\ph.ph" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\shellrestart.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\trayicon.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\version.inf" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0 VR\waol.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\OptScan\AOLszr.drv" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\AOL\Proofreader\userdicbr.tlx" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\PC Suite\ConfServer\Settings.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Skype\Plugins\_nsStore.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{0DAE8BEF-F156-91D6-F5FB-0A6A77F5A59C}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{1BCF207B-F1CA-F0FA-A369-0A720FE2D562}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{275E5C42-6C5E-D5E9-627E-649DCD68DB50}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{3C5CBC25-2EDD-EB23-571C-CAC08BF1CCE7}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{5C55F68F-F4F8-FA12-F31E-00ACBF845362}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{9790133C-700C-4F08-4DBA-835A7561D735}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{CE7D3F9C-6B7A-49AD-5FB5-79FD86CE8B07}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Trymedia\data\{D4F3015D-D9AA-98BB-1B73-CE6D32445A58}" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\history.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\locate.mtz" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\All Users\Application Data\WEBREG\WebRegData.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Apple Computer\Preferences\iTunes.exe.plist" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Creative\Media Database\ACDL_1.ldb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Creative\Media Database\MTDT_1.ldb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Creative\Media Database\PCML_1.ldb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Datalayer\356962011917086\session.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\HP\WowLogs\WOWDebug.log" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\ICAClient\UISTATE.INI" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\ICAClient\wfcwin32.log" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Image Zone Express\layouts.db" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Media Player\020B3393.wpl" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Office\VB10.pip" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Protect\CREDHIST" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Microsoft\Templates\~$Normal.dot" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Nokia\ContentCopier\Settings_CC3.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Nokia\ImageStore\Settings.xml" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Nokia Multimedia Player\Recent.npl" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\Calendar.pim" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\Contacts.pim" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\fbxPlaylist.fmp" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\funrecent.fmp" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\mstore.fdb" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Application Data\Samsung\Samsung PC Studio 3\SMS.msg" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "c:\Program Files\Outlook Express\msoe.txt" is compressed (flags = 1)
Read File: File "c:\Program Files\Windows Media Player\npdrmv2.zip" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc104.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc105.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc64.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc65.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc72.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc80.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc81.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc88.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc89.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc96.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc97.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\desktop.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc136.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc137.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc144.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc112.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc113.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc12.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc120.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc121.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc128.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc129.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc152.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc153.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc16.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc145.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc160.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc57.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc73.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc161.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc168.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc169.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc4.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc5.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc56.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc166.doc" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc167.doc" is compressed (flags = 1)
Read File: File "c:\TEMP\rcjs.log" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\dsound.vxd" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\l_except.nls" is compressed (flags = 1)
Read File: File "c:\windows\system32\interf.tlb" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\perfci.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\perffilt.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\perfwci.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\pscript.sep" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\cmos.ram" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\pcl.sep" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\prodspec.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\View Channels.scf" is compressed (flags = 1)
Read File: File "c:\windows\system32\vtsqo.dll" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\drivers\etc\networks" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\migip.dun" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\migrate.isp" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\msobe.isp" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\obeip.dun" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\oobeinfo.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\oobe\reg.isp" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\ntuser.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\ntuser.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Tiny_Run.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\ujf635.bin" is compressed (flags = 1)
Read File: File "c:\WINDOWS\vb.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\vbaddin.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\VI_setup.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\DtcInstall.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\explorer.scf" is compressed (flags = 1)
Read File: File "c:\WINDOWS\cmsetacl.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\wmsetup10.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\ODBC.INI" is compressed (flags = 1)
Read File: File "c:\WINDOWS\PB_setup.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\AppPatch\mcrh.tmp" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Debug\blastcln.log" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Downloaded Program Files\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.1.0.inf" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Downloaded Program Files\swdir.inf" is compressed (flags = 1)

 

Read File: File "c:\WINDOWS\Fonts\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\accessib.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\ciadmin.htm" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\conf.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\connect.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\windows.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\mshearts.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\msnauth.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\nocontnt.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\ratings.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\update.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Help\winhlp32.cnt" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_dataperfcounters_shared12_neutral.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\caspol.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet.mof.uninstall" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataOracleClientPerfCounters_shared12_neutral.h" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\XPThemes.manifest" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\webAdminNoNavBar.master" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\AddInProcess.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\AddInProcess32.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\AddInUtil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\csc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\default.win32manifest" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\EdmGen.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v3.5\vbc.exe.config" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Tasks\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\Web\bullet.gif" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Default User\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Local Settings\Application Data\Google\GoogleEarth\dbCache.dat.index" is compressed (flags = 1)
Read File: File "c:\Documents and Settings\Philip Green\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc104.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc105.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc64.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc65.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc72.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc80.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc81.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc88.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc89.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc96.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc97.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\desktop.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc136.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc137.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc144.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc112.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc113.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc12.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc120.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc121.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc128.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc129.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc152.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc153.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc16.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc13.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc145.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc160.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc57.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc73.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc161.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc168.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc169.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc4.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc5.gif" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-18\Dc56.ini" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc166.doc" is compressed (flags = 1)
Read File: File "c:\RECYCLER\S-1-5-21-746137067-287218729-725345543-1004\Dc167.doc" is compressed (flags = 1)
Read File: File "c:\WINDOWS\$NtUninstallKB971633$\update.ver" is compressed (flags = 1)
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal successful. No system shutdown is required.
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1021

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 2 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 1.827000 GHz
Memory total: 502775808, free: 203436032

------------ Kernel report ------------
03/21/2013 21:45:38
------------ Loaded modules -----------
\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
viaide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
uagp35.sys
Mup.sys
\SystemRoot\system32\DRIVERS\amdk7.sys
\SystemRoot\system32\DRIVERS\HSFHWBS2.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\HSF_DP.sys
\SystemRoot\system32\DRIVERS\HSF_CNXT.sys
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\nic1394.sys
\SystemRoot\system32\drivers\Afc.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\fetnd5.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\wanatw4.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\MODEMCSA.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\tcpipBM.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\System32\Drivers\StarOpen.SYS
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\arp1394.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\framebuf.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\secdrv.sys
\SystemRoot\system32\SetupNT.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\??\C:\WINDOWS\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\System32\Drivers\aswVmm.SYS
\SystemRoot\System32\Drivers\AswRdr.SYS
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR2
Upper Device Object: 0xffffffff8561b588
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000067\
Lower Device Object: 0xffffffff859cf648
Lower Device Driver Name: \Driver\USBSTOR\
Device already Exists: 0xffffffff852703c0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85b7c370
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\
Lower Device Object: 0xffffffff85b7dd98
Lower Device Driver Name: \Driver\atapi\
Device already Exists: 0xffffffff85262370
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85b7c148, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff85b7c370, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85b7ef18, DeviceName: \Device\0000005c\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff85b7dd98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe1c4f470, 0xffffffff85b7c370, 0xffffffff85236400
Lower DeviceData: 0xffffffffe22c0670, 0xffffffff85b7dd98, 0xffffffff85262370
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\WINDOWS\system32\drivers...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Read File: File "C:\WINDOWS\system32\drivers\1394bus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\acpiec.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\amdk6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\asyncmac.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmarpc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmepvc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmlane.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atmuni.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\atwpkt264.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bridge.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\bthport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\camdrv21.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cbidf2k.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\CCDECODE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nikedrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcj.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nmwcdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ntfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkflt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkfwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkipx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnknb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\nwlnkspx.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\oprghdlr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\p3.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\partmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pciidex.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\pcmcia.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\processr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpdr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rdpwd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rio8drv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\riodrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rmcast.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rndismp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rootmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\scsiport.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffdisk.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sffp_sd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sfloppy.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\SLIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fltmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fsvga.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gm.dls" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\gmreadme.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidclass.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\hidparse.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZid412.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZipr12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HPZius12.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\HSFProf.cty" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\intelppm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\Intels51.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ip6fw.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipfltdrv.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ipinip.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tcpip6.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdpipe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tdtcp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tosdvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tsbvcap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tunmp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\UAGP35.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\udfs.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usb8023.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbcamd2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\irenum.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ksecdd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mcd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mf.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mod7700.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mountmgr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSKSSRV.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\MSTEE.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\mup.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NABTSFEC.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ndis.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\NdisIP.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\rawwan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\smclib.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\tape.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cinemst2.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\classpnp.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\cpqdap01.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\crusoe.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\diskdump.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\dmio.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\enum1394.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewdcsc.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbfake.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ewusbnet.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\fastfat.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbintel.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbprint.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\usbscan.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\vdmindvd.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\volsnap.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\wpdusb.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\ws2ifsl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\WSTCODEC.SYS" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sonydcam.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sr.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdbus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdcmnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdfl.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdmdm.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwh.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\sscdwhnt.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\stream.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\StreamIP.sys" is compressed (flags = 1)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 185C185B

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 160810587
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 82348277760 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-160816480-160836480)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85637e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8561b588, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff859cf648, DeviceName: \Device\00000067\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe1bd8c98, 0xffffffff8561b588, 0xffffffff855fe720
Lower DeviceData: 0xffffffffe13fd5e0, 0xffffffff859cf648, 0xffffffff852703c0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 73696420

Partition information:

Partition 0 type is Other (0x20)
Partition is INVALID!!!
Partition starts at LBA: 1919950958 Numsec = 544437093

Partition 1 type is Other (0x6b)
Partition is INVALID!!!
Partition starts at LBA: 1330184202 Numsec = 538976288

Partition 2 type is Other (0x53)
Partition is INVALID!!!
Partition starts at LBA: 538989391 Numsec = 1398362912

Partition 3 type is Other (0x49)
Partition is ACTIVE.
Partition starts at LBA: 1394627663 Numsec = 21337
Partition is not bootable

Disk Size: 1992294400 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...

so sorry that took so many posts

 

I did do one before anything but can't find a report, then just completed one now and around 800 infected files but again I can't find a report, do you know where it would be? Again sorry for being so bad but thank you. (I moved the infected files to chest if this makes any difference, also used avast)

 

avast is currently scanning my whole system and its been doing it for around 30 minutes and only 2% up so im guessing it will take all night so i shall do the next step when i wake up, what do you mean by dupe...? in your last post? thanks again for the help so far

 

If the combifix worked is it just that log you need me to post or do I need to carry on with the second part too? So sorry for being such a novice here.
Below is the report from combifix if thats all you need
ComboFix 13-03-21.02 - Philip Green 03/22/2013 12:42:14.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.199 [GMT 0:00]
Running from: c:\documents and settings\Philip Green\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Philip Green\Application Data\PriceGong
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\1.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\a.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\b.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\c.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\d.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\e.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\f.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\g.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\h.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\i.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\j.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\k.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\l.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\m.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\n.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\o.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\p.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\q.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\r.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\s.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\t.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\u.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\v.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\w.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\x.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\y.txt
c:\documents and settings\Philip Green\Application Data\PriceGong\Data\z.txt
c:\documents and settings\Philip Green\Recent\Thumbs.db
c:\documents and settings\Philip Green\WINDOWS
c:\windows\AppPatch\pcssy.bak1
c:\windows\AppPatch\pcssy.bak2
c:\windows\AppPatch\pcssy.ini
c:\windows\AppPatch\pcssy.tmp
c:\windows\AppPatch\pcssy.tmp2
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.0.inf
c:\windows\Downloaded Program Files\USYP_0001_N76M2004NetInstaller.exe
c:\windows\system32\CddbCdda.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DOMAINSERVICE
.
.
((((((((((((((((((((((((( Files Created from 2013-02-22 to 2013-03-22 )))))))))))))))))))))))))))))))
.
.
2013-03-21 20:33 . 2013-03-06 23:33 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-03-21 20:33 . 2013-03-06 23:33 368176 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-03-21 20:33 . 2013-03-06 23:33 62376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-03-21 20:33 . 2013-03-06 23:33 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-03-21 20:33 . 2013-03-06 23:33 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-03-21 20:33 . 2013-03-06 23:33 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-03-21 20:33 . 2013-03-06 23:33 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-03-21 20:33 . 2013-03-06 23:33 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-03-21 20:33 . 2013-03-06 23:32 228600 ----a-w- c:\windows\system32\aswBoot.exe
2013-03-21 20:30 . 2013-03-06 23:32 41664 ----a-w- c:\windows\avastSS.scr
2013-03-21 20:27 . 2013-03-21 20:27 -------- d-----w- c:\program files\AVAST Software
2013-03-21 20:25 . 2013-03-21 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2013-03-21 15:29 . 2013-03-21 15:29 -------- d-----w- c:\documents and settings\Philip Green\Application Data\Malwarebytes
2013-03-21 15:29 . 2013-03-21 15:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2013-03-21 15:29 . 2012-12-14 16:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-21 15:29 . 2013-03-21 15:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-03-21 12:47 . 2013-03-21 12:46 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-21 12:46 . 2007-12-17 12:32 143872 ----a-w- c:\windows\system32\javacpl.cpl
2013-03-21 12:46 . 2012-09-08 11:24 861088 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-03-21 12:46 . 2010-05-20 19:14 782240 ----a-w- c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{9427041a-a8dc-4d06-9a68-93873486e957}]
2013-03-05 13:37 231168 ----a-w- c:\program files\Productivity_3.1\prxtbPro0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9427041a-a8dc-4d06-9a68-93873486e957} "= "c:\program files\Productivity_3.1\prxtbPro0.dll" [2013-03-05 231168]
.
[HKEY_CLASSES_ROOT\clsid\{9427041a-a8dc-4d06-9a68-93873486e957}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9427041A-A8DC-4D06-9A68-93873486E957} "= "c:\program files\Productivity_3.1\prxtbPro0.dll" [2013-03-05 231168]
.
[HKEY_CLASSES_ROOT\clsid\{9427041a-a8dc-4d06-9a68-93873486e957}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-03-06 23:32 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync "= "c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"Aim6 "= "c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"NSLauncher "= "c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 2658304]
"diagnostics "= "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" [2007-12-21 557149]
"HostManager "= "c:\program files\Common Files\AOL\1200932265\ee\AOLSoftware.exe" [2006-09-26 50736]
"ToUcamVProperty "= "c:\progra~1\PHILIP~1\VProperty.exe" [2003-04-02 131072]
"DataCardMonitor "= "c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe" [2009-07-24 253952]
"hpqSRMon "= "c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2010-02-17 177472]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"APSDaemon "= "c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"ExpressFiles "= "c:\program files\ExpressFiles\ExpressFiles.exe" [2012-03-22 453240]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
WTGU.lnk - [N/A]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [3/21/2013 8:33 PM 49248]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/21/2013 8:33 PM 765736]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3/21/2013 8:33 PM 368176]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/21/2013 8:33 PM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [3/21/2013 8:33 PM 66336]
S1 dvcvlqia;dvcvlqia;\??\c:\windows\system32\drivers\dvcvlqia.sys --> c:\windows\system32\drivers\dvcvlqia.sys [?]
S1 tveojhbr;tveojhbr;\??\c:\windows\system32\drivers\tveojhbr.sys --> c:\windows\system32\drivers\tveojhbr.sys [?]
S2 DP1112;DP1112;\??\c:\windows\system32\Drivers\DP.sys --> c:\windows\system32\Drivers\DP.sys [?]
S3 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [3/21/2013 8:33 PM 164736]
S3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [7/30/2008 12:07 PM 223232]
S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [12/21/2007 12:18 AM 30464]
S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [12/21/2007 12:18 AM 12672]
S3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\drivers\stppp.sys [12/21/2007 12:18 AM 32000]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - BITS
*NewlyCreated* - WS2IFSL
*NewlyCreated* - WUAUSERV
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2013-03-22 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-03-21 23:32]
.
2013-03-22 c:\windows\Tasks\Express Files Updater.job
- c:\program files\ExpressFiles\EFupdater.exe [2012-03-22 19:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sky.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
BHO-{DF941BC7-DD2A-484E-BD2C-8B8FF174D1EB} - c:\windows\AppPatch\ysscp.dll
Toolbar-10 - (no file)
Notify-ddcbbyy - ddcbbyy.dll
Notify-ysscp - c:\windows\AppPatch\ysscp.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-03-22 13:17
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ToUcamVProperty = c:\progra~1\PHILIP~1\VProperty.exe??~?1?\?V?P?r?o?p?e?r?t?y?.?e?x?e???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
DataCardMonitor = c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe?rs\CancelAutoplay\CLSID?System3?? ?{?????????<?????u???SOFTWARE\Microsoft\Windows\CurrentVersion\Run?;.!?????????????<?BE;.JS;.JSE;.WSF;.WSH?PROCESSOR_ARCHITECTURE=x86?PROCESSOR_IDENTIFIER=x8
.
scanning hidden files ...
.
.
c:\windows\TEMP\_avast_\unp252659590.tmp 424478 bytes
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\st330service]
"ImagePath "= "C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe -service "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\l3codeca.acm
c:\windows\system32\sirenacm.dll
.
- - - - - - - > 'explorer.exe'(3040)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Thomson SpeedTouch\ST330\service\st330service.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\program files\Thomson SpeedTouch\ST330\diagnostics\diagnostics.exe
c:\windows\Seiko\slpcap.exe
c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\Common Files\PCSuite\Services\ServiceLayer.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\AIM6\anotify.exe
.
**************************************************************************
.
Completion time: 2013-03-22 13:34:08 - machine was rebooted
ComboFix-quarantined-files.txt 2013-03-22 13:33
.
Pre-Run: 39,406,862,336 bytes free
Post-Run: 40,276,582,400 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 2E923D63917BD772D0DF067EDC55F75A

 

ComboFix 13-03-21.02 - Philip Green 03/22/2013 22:33:15.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.129 [GMT 0:00]
Running from: c:\documents and settings\Philip Green\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Philip Green\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\system32\Drivers\DP.sys "
"c:\windows\system32\drivers\dvcvlqia.sys "
"c:\windows\system32\drivers\tveojhbr.sys "
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Philip Green\Application Data\cscet.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DP1112
-------\Service_DP1112
-------\Service_dvcvlqia
-------\Service_tveojhbr
.
.
((((((((((((((((((((((((( Files Created from 2013-02-22 to 2013-03-22 )))))))))))))))))))))))))))))))
.
.
2013-03-21 20:33 . 2013-03-06 23:33 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-03-21 20:33 . 2013-03-06 23:33 368176 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-03-21 20:33 . 2013-03-06 23:33 62376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-03-21 20:33 . 2013-03-06 23:33 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-03-21 20:33 . 2013-03-06 23:33 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-03-21 20:33 . 2013-03-06 23:33 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-03-21 20:33 . 2013-03-06 23:33 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-03-21 20:33 . 2013-03-06 23:33 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-03-21 20:33 . 2013-03-06 23:32 228600 ----a-w- c:\windows\system32\aswBoot.exe
2013-03-21 20:30 . 2013-03-06 23:32 41664 ----a-w- c:\windows\avastSS.scr
2013-03-21 20:27 . 2013-03-21 20:27 -------- d-----w- c:\program files\AVAST Software
2013-03-21 20:25 . 2013-03-21 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2013-03-21 15:29 . 2013-03-21 15:29 -------- d-----w- c:\documents and settings\Philip Green\Application Data\Malwarebytes
2013-03-21 15:29 . 2013-03-21 15:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2013-03-21 15:29 . 2012-12-14 16:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-21 15:29 . 2013-03-21 15:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-03-21 12:47 . 2013-03-21 12:46 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-21 12:46 . 2007-12-17 12:32 143872 ----a-w- c:\windows\system32\javacpl.cpl
2013-03-21 12:46 . 2012-09-08 11:24 861088 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-03-21 12:46 . 2010-05-20 19:14 782240 ----a-w- c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{9427041a-a8dc-4d06-9a68-93873486e957}]
2013-03-05 13:37 231168 ----a-w- c:\program files\Productivity_3.1\prxtbPro0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9427041a-a8dc-4d06-9a68-93873486e957} "= "c:\program files\Productivity_3.1\prxtbPro0.dll" [2013-03-05 231168]
.
[HKEY_CLASSES_ROOT\clsid\{9427041a-a8dc-4d06-9a68-93873486e957}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9427041A-A8DC-4D06-9A68-93873486E957} "= "c:\program files\Productivity_3.1\prxtbPro0.dll" [2013-03-05 231168]
.
[HKEY_CLASSES_ROOT\clsid\{9427041a-a8dc-4d06-9a68-93873486e957}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-03-06 23:32 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync "= "c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"Yahoo! Pager "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-01 4670968]
"Aim6 "= "c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"NSLauncher "= "c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 2658304]
"diagnostics "= "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" [2007-12-21 557149]
"HostManager "= "c:\program files\Common Files\AOL\1200932265\ee\AOLSoftware.exe" [2006-09-26 50736]
"ToUcamVProperty "= "c:\progra~1\PHILIP~1\VProperty.exe" [2003-04-02 131072]
"DataCardMonitor "= "c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe" [2009-07-24 253952]
"hpqSRMon "= "c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2010-02-17 177472]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"APSDaemon "= "c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"ExpressFiles "= "c:\program files\ExpressFiles\ExpressFiles.exe" [2012-03-22 453240]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304]
.
c:\documents and settings\Philip Green\Start Menu\Programs\Startup\
SmartCapture.lnk - c:\windows\Seiko\slpcap.exe [2007-2-14 49152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
WTGU.lnk - [N/A]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\AIM6\\aim6.exe "=
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [3/21/2013 8:33 PM 49248]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/21/2013 8:33 PM 765736]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3/21/2013 8:33 PM 368176]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/21/2013 8:33 PM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [3/21/2013 8:33 PM 66336]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/24/2009 10:51 PM 24652]
S2 zgmtotxwd;zgmtotxwd; "c:\docume~1\PHILIP~1\LOCALS~1\Temp\DAT6F3.tmp.exe" --SERVICE --> c:\docume~1\PHILIP~1\LOCALS~1\Temp\DAT6F3.tmp.exe [?]
S3 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [3/21/2013 8:33 PM 164736]
S3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [7/30/2008 12:07 PM 223232]
S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [12/21/2007 12:18 AM 30464]
S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [12/21/2007 12:18 AM 12672]
S3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\drivers\stppp.sys [12/21/2007 12:18 AM 32000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2013-03-22 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-03-21 23:32]
.
2013-03-22 c:\windows\Tasks\Express Files Updater.job
- c:\program files\ExpressFiles\EFupdater.exe [2012-03-22 19:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sky.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-03-22 22:57
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ToUcamVProperty = c:\progra~1\PHILIP~1\VProperty.exe??~?1?\?V?P?r?o?p?e?r?t?y?.?e?x?e???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
DataCardMonitor = c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe?rs\CancelAutoplay\CLSID?System3?? ?{?????????<?????u???SOFTWARE\Microsoft\Windows\CurrentVersion\Run?;.!?????????????<?BE;.JS;.JSE;.WSF;.WSH?PROCESSOR_ARCHITECTURE=x86?PROCESSOR_IDENTIFIER=x8
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\st330service]
"ImagePath "= "C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe -service "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\l3codeca.acm
c:\windows\system32\sirenacm.dll
.
- - - - - - - > 'explorer.exe'(3272)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\l3codeca.acm
c:\windows\system32\sirenacm.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Thomson SpeedTouch\ST330\service\st330service.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Thomson SpeedTouch\ST330\diagnostics\diagnostics.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\Common Files\PCSuite\Services\ServiceLayer.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2013-03-22 23:03:29 - machine was rebooted
ComboFix-quarantined-files.txt 2013-03-22 23:03
ComboFix2.txt 2013-03-22 13:34
.
Pre-Run: 40,082,694,144 bytes free
Post-Run: 40,245,862,400 bytes free
.
- - End Of File - - 259C0836FE03CD639BFFDA336852796A

 

dupe...

 

# AdwCleaner v2.115 - Logfile created 03/23/2013 at 00:02:54
# Updated 17/03/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 2 (32 bits)
# User : Philip Green - PHILIP
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Philip Green\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Viewpoint Manager Service

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\Viewpoint
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Trymedia
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Viewpoint
Folder Deleted : C:\Documents and Settings\Philip Green\Application Data\searchquband
Folder Deleted : C:\Documents and Settings\Philip Green\Application Data\Viewpoint
Folder Deleted : C:\Documents and Settings\Philip Green\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\Philip Green\Local Settings\Application Data\Productivity_3.1
Folder Deleted : C:\Program Files\Common Files\Software Update Utility
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Productivity_3.1

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9427041A-A8DC-4D06-9A68-93873486E957}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9427041A-A8DC-4D06-9A68-93873486E957}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Productivity_3.1
Key Deleted : HKCU\Software\Viewpoint
Key Deleted : HKCU\Software\vShare
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2273BD45-9747-41D0-B552-6CE3A3ED94DA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9427041A-A8DC-4D06-9A68-93873486E957}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3008668
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\MetaStream
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8062CDA9-49ED-4B30-8F16-2894FCF66BC8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8951B2CA-7E6B-4490-87C1-AA2967E40752}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Productivity_3.1 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9427041A-A8DC-4D06-9A68-93873486E957}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2273BD45-9747-41D0-B552-6CE3A3ED94DA}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Productivity_3.1 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Key Deleted : HKLM\Software\Productivity_3.1
Key Deleted : HKLM\Software\Viewpoint
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{9427041A-A8DC-4D06-9A68-93873486E957}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{9427041A-A8DC-4D06-9A68-93873486E957}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[S1].txt - [7377 octets] - [23/03/2013 00:02:54]

########## EOF - C:\AdwCleaner[S1].txt - [7437 octets] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.7.2 (03.15.2013:1)
OS: Microsoft Windows XP x86
Ran by Philip Green on Sat 03/23/2013 at 0:07:30.92
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\urlsearchhooks\\{54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22}
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Philip Green\appdata\locallow\datamngr "





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 03/23/2013 at 0:22:11.03
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~