Solved Windows Update Blocked

[Resolved] Windows Update Blocked

My computer was INFESTED with viruses after my wife and roommate downloaded and used Bittorrent and uTorrent, I uninstalled both programs because I didn't even want them using any torrent programs on my computer and disabled System Restore. Malwarebytes' Antimalware found several trojans and a rootkit sometime last week. It comes up clean now, however I cannot update my computer from Windows. Something is blocking automatic updates and the URL to the update site to do it manually. Any other Microsoft URL works fine. I used to use Google Chrome, but even it stopped working, now I'm using Firefox.

Even more curiously, a svchost crashes with an error message "Generic host process for Win32 has crashed ". After that, sound doesn't work properly. Attempting to open the volume control tells me there are no mixing devices. The svchost in question is using over 100,000K of memory, and before crashing spikes to around 350,000K. ProcessExplorer shows that included inside of the process (netsvcs) are the services AudioSvc and wuauserv, among many other programs.

 

Here's another abnormality; It won't let me post the DDS. Firefox tells me "The connection has been reset." The same thing it tells me when I try to connect to Windows Update.

 

I will attempt posting the DDS and Attach from a different computer whenever I get the chance. This computer WILL NOT let me, as if whatever virus I may have is reading what I'm trying to send and is blocking that as well so that way I may not receive help.

 

DDS (Ver_10-03-17.01) - NTFSx86
Run by Chessie at 20:07:31.66 on Tue 09/28/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1526 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Documents and Settings\Chessie\Local Settings\Apps\F.lux\flux.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Chessie\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page =
uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8
uWindow Title = Windows Internet Explorer provided by Yahoo!
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZCxdm860OSUS&fl=0&ptb=mPNV0KBCiz9YZLuYc.H4sQ&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080418
uSearchAssistant =
mSearchAssistant =
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [F.lux] "c:\documents and settings\chessie\local settings\apps\f.lux\flux.exe" /noshow
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [RGSC] c:\program files\rockstar games\rockstar games social club\RGSCLauncher.exe /silent
mRun: [Alcmtr] ALCMTR.EXE
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
IE: &Search
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\chessie\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: microsoft.com\windowsupdate
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chessie\applic~1\mozilla\firefox\profiles\n2hmp2ey.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.search-tab.com/?sid=10101058100&s=
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\chessie\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.search.order.1 - Google
FF - user.js: keyword.URL - hxxp://search.search-tab.com/?sid=10101058100&s=c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-1-1 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-1-1 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-1-1 243024]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2008-6-23 3026]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-15 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-4-29 54752]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 52\starwind\StarWindServiceAE.exe [2007-5-28 275968]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\chessie\locals~1\temp\alsysio.sys --> c:\docume~1\chessie\locals~1\temp\ALSysIO.sys [?]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-4-18 30192]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [2010-8-17 30576]

=============== Created Last 30 ================

2010-09-27 21:38:37 2855 ----a-w- c:\windows\system32\mem.PIF
2010-09-26 14:27:50 0 d-----w- c:\docume~1\chessie\applic~1\Genieo
2010-09-26 14:27:29 0 d-----w- c:\docume~1\alluse~1\applic~1\Update
2010-09-25 22:14:48 23552 ----a-w- c:\windows\system32\wdmaud.drv
2010-09-25 22:14:48 23552 ----a-w- c:\windows\system32\dllcache\wdmaud.drv
2010-09-25 21:20:15 0 d-----w- c:\docume~1\chessie\applic~1\Malwarebytes
2010-09-25 21:19:37 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-25 21:19:35 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-25 21:19:35 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-09-25 21:19:33 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-12 18:06:39 0 d-----w- c:\windows\Profiles
2010-09-12 18:01:34 0 d-----w- c:\program files\SystemRequirementsLab
2010-09-10 02:06:56 0 d-----w- c:\windows\system32\wbem\Repository
2010-09-07 02:26:01 0 d-----w- c:\docume~1\chessie\applic~1\uTorrent
2010-09-04 16:18:50 0 d-----w- c:\program files\Prankhouse(2)
2010-09-02 17:34:47 0 d-----w- c:\docume~1\chessie\applic~1\prankhouse

==================== Find3M ====================

2010-09-27 13:48:49 2316 ----a-w- c:\docume~1\chessie\applic~1\wklnhst.dat
2010-09-08 16:00:05 1984 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-10 01:05:54 233812 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-08-10 01:05:53 233804 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll
2010-07-15 13:13:27 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-09 20:24:26 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 20:24:18 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 20:24:18 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 20:24:16 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 20:24:16 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 20:24:16 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-07-07 17:46:46 604776 ----a-w- c:\windows\system32\nvuninst.exe
2009-12-19 20:37:38 16384 --sha-w- c:\windows\temp\history\history.ie5\index.dat
2009-12-19 20:37:38 49152 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 20:08:16.32 ===============

 

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 6/7/2008 9:07:31 PM
System Uptime: 9/28/2010 7:59:19 PM (1 hours ago)

Motherboard: Dell Inc. | | 0RY206
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 6000+ | Socket AM2 | 3013/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 149 GiB total, 49.994 GiB free.
D: is CDROM (UDF)
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: Unimodem Half-Duplex Audio Device
Device ID: MODEMWAVE\0\{13A5EABC-2C51-43AB-8E3B-6A59E0FFBEDA}
Manufacturer: Microsoft
Name: Unimodem Half-Duplex Audio Device
PNP Device ID: MODEMWAVE\0\{13A5EABC-2C51-43AB-8E3B-6A59E0FFBEDA}
Service: MODEMCSA

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

3D Rad v6.38
Acrobat.com
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Adobe Shockwave Player 11.5
Apple Mobile Device Support
Apple Software Update
AVG Free 9.0
Baldur's Gate(TM) II - Throne of Bhaal (TM)
BioShock
Browser Address Error Redirector
click_random_01 Wallpaper
Command & Conquer Generals
Compatibility Pack for the 2007 Office system
Conexant D850 56K V.9x DFVc Modem
Dell Support Center (Support Software)
DivX Web Player
Documentation & Support Launcher
DoughnutScreensaver
Dungeon Keeper
EA Download Manager
EA Download Manager UI
EarthLink Setup Files
F.lux
Facebook Plug-In
Fallout 3 - Game of the Year Edition
Games, Music, & Photos Launcher
getPlus(R)
Google Desktop
Google SketchUp 7
Google Toolbar for Internet Explorer
Grand Theft Auto
Grand Theft Auto IV
GTA2
High Definition Audio Driver Package - KB835221
Homey
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
InstallMgr
InterActual Player
Internet Service Offers Launcher
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 13
Junk Mail filter update
Left 4 Dead 2
Left 4 Dead 2 Add-on Support
Left 4 Dead 2 Authoring Tools
Left 4 Dead 2 Dedicated Server
Lite-C
Malwarebytes' Anti-Malware
marshyscreensaver
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Corporation
Microsoft Default Manager
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft LifeCam
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Microsoft WSE 3.0 Runtime
MobileMe Control Panel
Modem Diagnostic Tool
Morrowind
Mozilla Firefox (3.5.6)
MS Access 97 SP2
MSN Toolbar
MSVCRT
MSXML 6.0 Parser (KB933579)
NetWaiting
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA PhysX
PhoTags Express
PowerDVD
QuickTime
RealPlayer Basic
Realtek High Definition Audio Driver
Rockstar Games Social Club
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
SearchAssist
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Segoe UI
SimCity 3000 Unlimited
SpaghettiAndMeatballs Screen Saver
Star Trek Online - Free Trial
Starcraft
Steam
System Requirements Lab
TaxCut Standard + Efile 2008
TBS WMP Plug-in
TES Construction Set
The Sims™ 3
The Sims™ 3 Ambitions
The Sims™ 3 World Adventures
Unity Web Player
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VF Basic 1.0
Viewpoint Media Player
WebFldrs XP
Wild Metal Country
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Presentation Foundation
Windows XP Service Pack 3
XIII
XML Paper Specification Shared Components Pack 1.0
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

9/28/2010 8:01:53 PM, error: Service Control Manager [7022] - The Automatic Updates service hung on starting.
9/27/2010 8:28:12 AM, error: Dhcp [1002] - The IP address lease 192.168.3.2 for the Network Card with network address

001EC97522E0 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).
9/26/2010 6:34:33 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error:

The specified module could not be found.
9/26/2010 6:29:37 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot

partition and that is large enough to contain all physical memory.
9/26/2010 6:29:37 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
9/25/2010 5:13:46 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart

the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the

following error: An instance of the service is already running.
9/25/2010 3:49:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " "

in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/25/2010 3:46:58 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD

AvgLdx86 AvgMfx86 AvgTdiX Fips hwinterface IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss sptd Tcpip
9/25/2010 3:46:58 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which

failed to start because of the following error: A device attached to the system is not functioning.
9/25/2010 3:46:58 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which

failed to start because of the following error: A device attached to the system is not functioning.
9/25/2010 3:46:58 PM, error: Service Control Manager [7001] - The fssfltr service depends on the TCP/IP Protocol Driver service which

failed to start because of the following error: A device attached to the system is not functioning.
9/25/2010 3:46:58 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service

which failed to start because of the following error: A device attached to the system is not functioning.
9/25/2010 3:46:58 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service

which failed to start because of the following error: A device attached to the system is not functioning.
9/25/2010 3:46:58 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver

service which failed to start because of the following error: A device attached to the system is not functioning.
9/25/2010 3:45:54 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in

order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
9/25/2010 3:45:46 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in

order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
9/25/2010 3:45:30 PM, error: sptd [4] - Driver detected an internal error in its data structures for .

 

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4713

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/28/2010 10:33:11 PM
mbam-log-2010-09-28 (22-33-11).txt

Scan type: Quick scan
Objects scanned: 149987
Time elapsed: 8 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-09-28 22:42:57
Windows 5.1.2600 Service Pack 3
Running: rr1vzutc.exe; Driver: C:\DOCUME~1\Chessie\LOCALS~1\Temp\uxrirpow.sys


---- System - GMER 1.0.15 ----

SSDT spcw.sys ZwEnumerateKey [0xB7ECDDA4]
SSDT spcw.sys ZwEnumerateValueKey [0xB7ECE132]

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A7CF1F8

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

Device -> \Driver\atapi \Device\Harddisk0\DR0 8A5E9EC5

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

 

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000002c

Kernel Drivers (total 123):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D0000 \WINDOWS\system32\hal.dll
0xB85A8000 \WINDOWS\system32\KDCOM.DLL
0xB84B8000 \WINDOWS\system32\BOOTVID.dll
0xB7EB4000 spcw.sys
0xB85AA000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xB7E9C000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xB7E6E000 ACPI.sys
0xB7E5D000 pci.sys
0xB80A8000 isapnp.sys
0xB8670000 pciide.sys
0xB8328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xB80B8000 MountMgr.sys
0xB7E3E000 ftdisk.sys
0xB8330000 PartMgr.sys
0xB80C8000 VolSnap.sys
0xB7E26000 atapi.sys
0xB80D8000 disk.sys
0xB80E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB7E06000 fltmgr.sys
0xB80F8000 PxHelp20.sys
0xB7DEF000 KSecDD.sys
0xB7DDC000 WudfPf.sys
0xB7D4F000 Ntfs.sys
0xB7D22000 NDIS.sys
0xB7D08000 Mup.sys
0xB8288000 \SystemRoot\system32\DRIVERS\processr.sys
0xB8470000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xB3DB5000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xB8478000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB3D81000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys
0xB3D5E000 \SystemRoot\system32\DRIVERS\ks.sys
0xB3C5F000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
0xB3BB8000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xB8480000 \SystemRoot\System32\Drivers\Modem.SYS
0xB3B90000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB8128000 \SystemRoot\system32\drivers\nvnetbus.sys
0xB3AB7000 \SystemRoot\system32\drivers\NVNRM.SYS
0xB8138000 \SystemRoot\system32\DRIVERS\imapi.sys
0xB5BA6000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB5B96000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB2FFA000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB2FE6000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB2FAF000 \SystemRoot\System32\Drivers\a7zon291.SYS
0xB86A0000 \SystemRoot\system32\DRIVERS\audstub.sys
0xB5B86000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB8594000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB2F98000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xB5B76000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xB5B66000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xB5591000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB2F87000 \SystemRoot\system32\DRIVERS\psched.sys
0xB5B56000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xAC425000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xAC41D000 \SystemRoot\system32\DRIVERS\raspti.sys
0xAC4E9000 \SystemRoot\system32\DRIVERS\termdd.sys
0xAC415000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xAC40D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xB862C000 \SystemRoot\system32\DRIVERS\swenum.sys
0xAAFAD000 \SystemRoot\system32\DRIVERS\update.sys
0xAC3D5000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xAC4D9000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xAC009000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xB8650000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xABFE9000 \SystemRoot\system32\drivers\NVENETFD.sys
0xA899D000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xA8979000 \SystemRoot\system32\drivers\portcls.sys
0xABFB9000 \SystemRoot\system32\drivers\drmk.sys
0xAB7F3000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xB8630000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xABA3C000 \SystemRoot\System32\Drivers\Null.SYS
0xB8632000 \SystemRoot\System32\Drivers\Beep.SYS
0xAC3F5000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xAC3ED000 \SystemRoot\System32\drivers\vga.sys
0xB862A000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xB85FA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xAC3E5000 \SystemRoot\System32\Drivers\Msfs.SYS
0xAC3DD000 \SystemRoot\System32\Drivers\Npfs.SYS
0xAB7EB000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA8946000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA88ED000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA88B3000 \SystemRoot\System32\Drivers\avgtdix.sys
0xA888D000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xABF99000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA8865000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA8843000 \SystemRoot\System32\drivers\afd.sys
0xABF89000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA8818000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA87A8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAB790000 \SystemRoot\System32\Drivers\hwinterface.sys
0xAB938000 \SystemRoot\System32\Drivers\Fips.SYS
0xAB815000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xA8774000 \SystemRoot\System32\Drivers\avgldx86.sys
0xAB033000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xAB0BC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xAB8F8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xAB0B4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xAB0B0000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xA8763000 \SystemRoot\System32\Drivers\Udfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB1B30000 \SystemRoot\System32\drivers\Dxapi.sys
0xB0BEC000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xB87D9000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB4C42000 \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
0xB1B20000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA8356000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB1515000 \SystemRoot\System32\Drivers\ASCTRM.SYS
0xB1513000 \SystemRoot\System32\drivers\enodpl.sys
0xA832E000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA8287000 \SystemRoot\system32\DRIVERS\srv.sys
0xA824A000 \SystemRoot\system32\drivers\wdmaud.sys
0xB0869000 \SystemRoot\system32\drivers\sysaudio.sys
0xB85E8000 \SystemRoot\System32\drivers\tandpl.sys
0xA7F6C000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA6462000 \SystemRoot\System32\Drivers\HTTP.sys
0xA82DE000 \??\C:\WINDOWS\system32\Drivers\PROCEXP141.SYS
0xA60F0000 \SystemRoot\system32\drivers\kmixer.sys
0xA58EE000 \??\C:\DOCUME~1\Chessie\LOCALS~1\Temp\uxrirpow.sys
0x7C900000 \WINDOWS\system32\ntdll.dll
0x10000000 \Program Files\Alcohol Soft\Alcohol 52\Alcoholx.dll

Processes (total 43):
0 System Idle Process
4 System
568 C:\WINDOWS\system32\smss.exe
632 csrss.exe
656 C:\WINDOWS\system32\winlogon.exe
708 C:\WINDOWS\system32\services.exe
720 C:\WINDOWS\system32\lsass.exe
880 C:\WINDOWS\system32\nvsvc32.exe
948 C:\WINDOWS\system32\svchost.exe
1016 svchost.exe
1064 C:\WINDOWS\system32\svchost.exe
1116 C:\WINDOWS\system32\svchost.exe
1136 C:\Program Files\AVG\AVG9\avgchsvx.exe
1144 C:\Program Files\AVG\AVG9\avgrsx.exe
1264 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1312 svchost.exe
1580 svchost.exe
1708 C:\WINDOWS\system32\spoolsv.exe
1796 svchost.exe
1832 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
1856 C:\Program Files\AVG\AVG9\avgwdsvc.exe
1948 C:\Program Files\Java\jre6\bin\jqs.exe
1992 C:\Program Files\Microsoft LifeCam\MSCamS32.exe
2040 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
208 C:\Program Files\Dell Support Center\bin\sprtsvc.exe
252 C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
288 C:\WINDOWS\system32\svchost.exe
468 C:\Program Files\AVG\AVG9\avgnsx.exe
524 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
784 C:\Program Files\AVG\AVG9\avgemc.exe
1308 C:\WINDOWS\system32\wuauclt.exe
2092 C:\Program Files\AVG\AVG9\avgcsrvx.exe
2792 C:\WINDOWS\explorer.exe
3008 C:\PROGRA~1\AVG\AVG9\avgtray.exe
3048 C:\WINDOWS\system32\rundll32.exe
3056 C:\Program Files\Dell Support Center\bin\sprtcmd.exe
3088 C:\Documents and Settings\Chessie\Local Settings\Apps\F.lux\flux.exe
3108 C:\WINDOWS\system32\ctfmon.exe
3932 alg.exe
4016 PresentationFontCache.exe
3868 C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe
240 C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
2884 C:\Documents and Settings\Chessie\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02f10c00 (NTFS)

PhysicalDrive0 Model Number: ST3160815AS, Rev: 4.ADA

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

 

My screensaver interrupted Combofix at what I believe was near the end. I had to reboot. It said it got rid of a rootkit but never produced a report because of the interruption. Should I run it again with my screensaver off?

 

ComboFix 10-09-27.05 - Chessie 09/29/2010 0:17.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1511 [GMT -4:00]
Running from: c:\documents and settings\Chessie\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_HWINTERFACE
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_hwinterface


((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-29 )))))))))))))))))))))))))))))))
.

2010-09-27 21:38 . 2010-09-27 21:38 2855 ----a-w- c:\windows\system32\mem.PIF
2010-09-26 14:27 . 2010-09-26 14:41 -------- d-----w- c:\documents and settings\Chessie\Application Data\Genieo
2010-09-26 14:27 . 2010-09-26 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Update
2010-09-25 22:14 . 2008-04-14 00:12 23552 ----a-w- c:\windows\system32\wdmaud.drv
2010-09-25 22:14 . 2008-04-14 00:12 23552 ----a-w- c:\windows\system32\dllcache\wdmaud.drv
2010-09-25 21:47 . 2010-09-28 22:32 0 ----a-w- c:\documents and settings\Chessie\Local Settings\Application Data\prvlcl.dat
2010-09-25 21:20 . 2010-09-25 21:20 -------- d-----w- c:\documents and settings\Chessie\Application Data\Malwarebytes
2010-09-25 21:19 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-25 21:19 . 2010-09-25 21:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-25 21:19 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-25 21:19 . 2010-09-25 21:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-12 18:06 . 2010-09-12 18:06 -------- d-----w- c:\windows\Profiles
2010-09-12 18:06 . 2010-09-12 18:06 -------- d-----w- c:\documents and settings\Chessie\Application Data\InterTrust
2010-09-12 18:01 . 2010-09-12 18:01 -------- d-----w- c:\program files\SystemRequirementsLab
2010-09-10 02:06 . 2010-09-10 02:06 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-08 16:23 . 2010-09-08 16:23 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-09-07 02:26 . 2010-09-12 18:28 -------- d-----w- c:\documents and settings\Chessie\Application Data\uTorrent
2010-09-06 21:12 . 2010-09-12 18:27 -------- d-----w- c:\program files\7-Zip
2010-09-04 16:18 . 2010-09-12 18:29 -------- d-----w- c:\program files\Prankhouse(2)
2010-09-02 17:34 . 2010-09-02 17:34 -------- d-----w- c:\documents and settings\Chessie\Application Data\prankhouse

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-29 04:30 . 2010-08-08 14:58 406344 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-09-27 13:48 . 2008-06-14 00:55 2316 ----a-w- c:\documents and settings\Chessie\Application Data\wklnhst.dat
2010-09-26 22:41 . 2008-08-09 20:00 -------- d-----w- c:\program files\Common Files\Apple
2010-09-26 22:40 . 2010-01-07 14:15 -------- d-----w- c:\program files\Steam
2010-09-26 22:33 . 2008-06-19 11:50 -------- d-----w- c:\program files\Postal2STPDemo
2010-09-26 16:11 . 2010-03-26 15:30 -------- d-----w- c:\documents and settings\Chessie\Application Data\Facebook
2010-09-25 20:06 . 2010-09-25 20:06 620896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgnsx.exe
2010-09-25 20:06 . 2010-09-25 20:06 4093792 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2010-09-25 20:06 . 2010-09-25 20:06 3586912 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-09-25 20:06 . 2010-09-25 20:06 1619296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-09-25 20:06 . 2010-09-25 20:06 1377632 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
2010-09-25 20:06 . 2010-09-25 20:06 942432 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcfgx.dll
2010-09-25 20:06 . 2010-09-25 20:06 598368 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgsrmx.dll
2010-09-25 20:06 . 2010-09-25 20:06 4371296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-09-25 20:06 . 2010-09-25 20:06 300896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchclx.dll
2010-09-25 20:04 . 2010-09-25 20:04 1690952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-09-12 18:29 . 2009-04-29 16:13 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-12 18:00 . 2010-08-02 05:40 -------- d-----w- c:\program files\ooVoo
2010-09-12 17:58 . 2010-08-01 23:29 -------- d-----w- c:\program files\Microsoft LifeCam
2010-09-12 17:55 . 2010-08-10 00:57 -------- d-----w- c:\program files\NVIDIA Corporation
2010-09-12 17:52 . 2008-04-18 18:44 -------- d-----w- c:\program files\Microsoft Works
2010-09-12 17:50 . 2008-06-28 20:13 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-12 17:48 . 2008-04-18 18:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Dell
2010-09-08 16:00 . 2008-07-16 13:20 1984 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-18 00:16 . 2010-08-18 00:16 -------- d-----w- c:\program files\Ubisoft
2010-08-18 00:16 . 2008-04-18 18:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-17 22:42 . 2010-08-08 16:11 27591840 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\msgup1000_1270_us_u2.exe
2010-08-10 01:05 . 2010-08-10 00:57 233812 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-08-10 01:05 . 2010-08-10 00:57 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-08-10 01:05 . 2010-08-10 00:57 233804 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-08-10 00:58 . 2010-08-10 00:58 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-08-08 21:38 . 2010-05-10 02:50 -------- d-----w- c:\program files\Electronic Arts
2010-08-08 15:18 . 2008-06-10 03:32 -------- d-----w- c:\documents and settings\Chessie\Application Data\IMVU
2010-08-02 05:41 . 2010-08-02 05:40 -------- d-----w- c:\documents and settings\Chessie\Application Data\ooVoo Details
2010-07-15 13:13 . 2010-01-02 01:59 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 13:13 . 2010-07-15 13:13 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-15 13:12 . 2010-01-02 01:59 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-09 20:24 . 2010-07-09 20:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 20:24 . 2010-07-09 20:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 20:24 . 2010-07-09 20:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 20:24 . 2010-07-09 20:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 20:24 . 2010-07-09 20:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 20:24 . 2010-07-09 20:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-07-07 17:46 . 2008-12-13 22:08 604776 ----a-w- c:\windows\system32\nvuninst.exe
2010-06-15 07:50 . 2010-02-11 04:24 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F.lux "= "c:\documents and settings\Chessie\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656]
"RGSC "= "c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2009-04-29 306088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter "= "c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Microsoft Default Manager "= "c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"AVG9_TRAY "= "c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
"nwiz "= "c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"dellsupportcenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 13:13 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Photags AutoDetect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Photags AutoDetect.lnk
backup=c:\windows\pss\Photags AutoDetect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:05 203416 ----a-w- c:\program files\Alcohol Soft\Alcohol 52\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-05-14 00:58 177472 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2009-05-21 15:13 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-15 07:50 30192 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2010-05-20 19:27 119152 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-03-18 22:50 4363504 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2007-09-17 15:56 124200 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2009-04-29 07:12 306088 ----a-w- c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-04-07 01:25 16859648 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-08-27 17:38 1242448 ----a-w- c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-05-29 22:52 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-04-18 18:42 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe "=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe "=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe "=
"c:\\Program Files\\Steam\\Steam.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe "=
"c:\\Program Files\\Steam\\SteamApps\\common\\star trek online\\Star Trek Online.exe "=
"c:\\Program Files\\Steam\\SteamApps\\common\\bioshock\\Builds\\Release\\Bioshock.exe "=
"c:\\Program Files\\Steam\\SteamApps\\common\\fallout 3 goty\\FalloutLauncher.exe "=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe "=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe "=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe "=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe "=
"c:\\Program Files\\Ubisoft\\XIII\\system\\XIII.exe "=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe "=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2\\srcds.exe "=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2\\bin\\SDKLauncher.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\FrostWire\\FrostWire.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1886:TCP "= 1886:TCP:*isabled:Genieo

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/1/2010 9:59 PM 216400]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/1/2010 9:59 PM 243024]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/15/2010 9:12 AM 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 9:13 AM 308136]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Chessie\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Chessie\LOCALS~1\Temp\ALSysIO.sys [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [4/18/2008 2:42 PM 30192]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [8/17/2010 3:49 PM 30576]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/5/2009 2:27 PM 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-09-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-09-05 c:\windows\Tasks\dfrg.job
- c:\windows\system32\dfrg.msc [2004-08-10 09:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZCxdm860OSUS&fl=0&ptb=mPNV0KBCiz9YZLuYc.H4sQ&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080418
uSearchAssistant =
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Chessie\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: microsoft.com\windowsupdate
FF - ProfilePath - c:\documents and settings\Chessie\Application Data\Mozilla\Firefox\Profiles\n2hmp2ey.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.search-tab.com/?sid=10101058100&s=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\Chessie\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.search.order.1 - Google
FF - user.js: keyword.URL - hxxp://search.search-tab.com/?sid=10101058100&s=.
- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
MSConfigStartUp-Google Update - c:\documents and settings\Chessie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-mainfull70707 - c:\documents and settings\Chessie\Application Data\78BF5496320CA7CA419476E7E9E94E86\mainfull70707.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
AddRemove-Grand Theft Auto - c:\program files\Rockstar Games\Grand Theft Auto\Uninst.isu
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe
AddRemove-Wild Metal Country - c:\program files\Rockstar Games\Wild Metal Country\Uninst.isu
AddRemove-myHomey - c:\documents and settings\Chessie\Application Data\Genieo\Application\Partner\uninstall\myHomey\partner_uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-29 00:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2135683235-459692503-2220341-1006\Software\SecuROM\License information*]
"datasecu "=hex:2a,3b,49,af,c8,48,c6,57,93,4e,de,d0,b2,a0,ff,15,e0,de,2d,8a,35,
2b,65,a1,54,40,88,13,e2,25,d6,d4,ad,ad,de,3d,b1,ab,c0,25,08,36,61,36,6a,5c,\
"rkeysecu "=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3968)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Completion time: 2010-09-29 00:40:30 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-29 04:40

Pre-Run: 53,541,441,536 bytes free
Post-Run: 53,655,412,736 bytes free

- - End Of File - - 508D2D789EFCFA0E5B1D146E40BD3171

 

Antivirus Version Last update Result

AhnLab-V3 2010.09.29.01 2010.09.29 -

AntiVir 7.10.12.79 2010.09.29 -

Antiy-AVL 2.0.3.7 2010.09.29 -

Authentium 5.2.0.5 2010.09.29 -

Avast 4.8.1351.0 2010.09.29 -

Avast5 5.0.594.0 2010.09.29 -

AVG 9.0.0.851 2010.09.29 -

BitDefender 7.2 2010.09.29 -

CAT-QuickHeal 11.00 2010.09.29 -

ClamAV 0.96.2.0-git 2010.09.29 -

Comodo 6235 2010.09.29 -

DrWeb 5.0.2.03300 2010.09.29 -

Emsisoft 5.0.0.50 2010.09.29 -

eSafe 7.0.17.0 2010.09.28 -

eTrust-Vet 36.1.7883 2010.09.29 -

F-Prot 4.6.2.117 2010.09.28 -

F-Secure 9.0.15370.0 2010.09.29 -

Fortinet 4.1.143.0 2010.09.29 -

GData 21 2010.09.29 -

Ikarus T3.1.1.90.0 2010.09.29 -

Jiangmin 13.0.900 2010.09.29 -

K7AntiVirus 9.63.2628 2010.09.28 -

Kaspersky 7.0.0.125 2010.09.29 -

McAfee 5.400.0.1158 2010.09.29 -

McAfee-GW-Edition 2010.1C 2010.09.29 -

Microsoft 1.6201 2010.09.29 -

NOD32 5488 2010.09.29 -

Norman 6.06.06 2010.09.28 -

nProtect 2010-09-29.01 2010.09.29 -

Panda 10.0.2.7 2010.09.28 -

PCTools 7.0.3.5 2010.09.28 -

Prevx 3.0 2010.09.29 -

Rising 22.67.01.01 2010.09.29 -

Sophos 4.58.0 2010.09.29 -

Sunbelt 6944 2010.09.29 -

SUPERAntiSpyware 4.40.0.1006 2010.09.29 -

Symantec 20101.2.0.161 2010.09.29 -

TheHacker 6.7.0.1.039 2010.09.29 -

TrendMicro 9.120.0.1004 2010.09.29 -

TrendMicro-HouseCall 9.120.0.1004 2010.09.29 -

VBA32 3.12.14.1 2010.09.27 -

ViRobot 2010.8.31.4017 2010.09.29 -

VirusBuster 12.66.5.0 2010.09.29 -

MD5: 390762963e6b4c861e5e0ca5a3e56e40

SHA1: e15dcc14576efac976e94fc0b65496007d541c75

SHA256: a80dbaa332171e734b4c505c4d81f4d2fc9bed538991c20f69ccf308489a893a

File size: 39274 bytes

Scan date: 2010-09-29 12:32:12 (UTC)

 

OTL logfile created on: 9/29/2010 8:32:35 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Chessie\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.96 Gb Total Space | 50.30 Gb Free Space | 33.77% Space Free | Partition Type: NTFS
Drive D: | 7.03 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ALDAKOOPA
Current User Name: Chessie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/09/29 08:31:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chessie\Desktop\OTL.exe
PRC - [2010/09/25 16:06:16 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/07/21 08:23:54 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/15 09:13:30 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/07/15 09:13:27 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/15 09:13:23 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/15 09:12:52 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/07/15 09:12:51 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/08/29 02:00:12 | 000,966,656 | ---- | M] () -- C:\Documents and Settings\Chessie\Local Settings\Apps\F.lux\flux.exe
PRC - [2009/05/21 11:13:58 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/08/14 00:04:44 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/28 12:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe


========== Modules (SafeList) ==========

MOD - [2010/09/29 08:31:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chessie\Desktop\OTL.exe
MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/07/21 08:23:54 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/15 09:13:23 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/06/15 03:50:36 | 000,030,192 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-051210-111108)
SRV - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009/08/05 23:48:42 | 000,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/14 00:04:44 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/06/26 10:24:08 | 000,031,592 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R)
SRV - [2007/05/28 12:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\SymIM.sys -- (SymIM)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Chessie\LOCALS~1\Temp\ALSysIO.sys -- (ALSysIO)
DRV - [2010/07/15 09:13:29 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/15 09:12:53 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/07/09 18:38:00 | 010,604,128 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2010/06/10 09:54:37 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/05/20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/12/05 14:27:25 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2009/08/05 23:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2008/04/18 14:48:35 | 000,008,552 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2008/04/13 14:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 14:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 13:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/04/06 21:29:14 | 000,022,016 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/04/06 21:29:08 | 000,054,400 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/04/06 21:25:40 | 004,652,544 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2003/11/17 14:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 14:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 14:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/04/19 00:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tandpl.sys -- (tandpl)
DRV - [2003/03/02 17:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\enodpl.sys -- (enodpl)
DRV - [2003/01/10 16:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2002/04/11 23:21:38 | 000,013,335 | R--- | M] (Microsystems Corp) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbcm.sys -- (usbcm)
DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 13:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)
DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080418
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080418

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = My Web Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultUrl = http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZCxdm860OSUS&fl=0&ptb=mPNV0KBCiz9YZLuYc.H4sQ&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com "
FF - prefs.js..browser.search.defaultenginename: "Ask.com "
FF - prefs.js..browser.search.order.1: "Google "
FF - prefs.js..browser.search.selectedEngine: "Google "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ "
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.855
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "http://search.search-tab.com/?sid=10101058100&s= "

FF - user.js..browser.search.selectedEngine: "Google "
FF - user.js..browser.search.order.1: "Google "
FF - user.js..keyword.URL: "http://search.search-tab.com/?sid=10101058100&s= "

FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/09/25 16:07:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/27 13:14:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/17 20:33:05 | 000,000,000 | ---D | M]

[2010/02/08 13:04:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Mozilla\Extensions
[2010/02/08 13:04:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Mozilla\Extensions\IMVUClientXUL@imvu.com
[2010/09/28 17:34:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Mozilla\Firefox\Profiles\n2hmp2ey.default\extensions
[2009/08/08 23:00:00 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Chessie\Application Data\Mozilla\Firefox\Profiles\n2hmp2ey.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/09/25 17:45:19 | 000,002,256 | ---- | M] () -- C:\Documents and Settings\Chessie\Application Data\Mozilla\Firefox\Profiles\n2hmp2ey.default\searchplugins\askcom.xml
[2009/07/16 08:06:58 | 000,009,949 | ---- | M] () -- C:\Documents and Settings\Chessie\Application Data\Mozilla\Firefox\Profiles\n2hmp2ey.default\searchplugins\mywebsearch.xml
[2009/07/16 00:13:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/08/16 22:13:06 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2010/09/29 00:31:46 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\dell\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKCU..\Run: [F.lux] C:\Documents and Settings\Chessie\Local Settings\Apps\F.lux\flux.exe ()
O4 - HKCU..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe (Take-Two Interactive Software, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Chessie\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: microsoft.com ([windowsupdate] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.3.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 () - http://www.belfordhighschool.com/images/coursespagebg.gif
O24 - Desktop WallPaper: C:\Documents and Settings\Chessie\My Documents\My Pictures\systemerror3.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Chessie\My Documents\My Pictures\systemerror3.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 13:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/11/15 05:52:50 | 000,161,088 | R--- | M] (Take-Two Interactive Software, Inc.) - D:\Autorun.exe -- [ UDF ]
O32 - AutoRun File - [2008/10/11 13:03:48 | 000,000,054 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/29 08:31:02 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Chessie\Desktop\OTL.exe
[2010/09/29 08:18:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/09/28 23:19:11 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/09/28 23:13:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/09/28 23:13:20 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/09/28 23:13:20 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/09/28 23:13:20 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/09/28 23:13:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/09/28 23:09:21 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/09/28 21:29:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Desktop\DDS
[2010/09/28 20:37:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Identities
[2010/09/26 10:27:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Application Data\Genieo
[2010/09/26 10:27:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Update
[2010/09/25 17:20:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Application Data\Malwarebytes
[2010/09/25 17:19:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/09/25 17:19:35 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/09/25 17:19:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/09/25 17:19:33 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/12 14:06:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\Profiles
[2010/09/12 14:06:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Application Data\InterTrust
[2010/09/12 14:01:34 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2010/09/09 19:55:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2010/09/08 13:06:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/09/08 13:06:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/09/08 12:00:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/09/08 10:46:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/09/08 10:46:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/09/08 10:14:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Desktop\korys stufff
[2010/09/06 22:26:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Application Data\uTorrent
[2010/09/06 18:05:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Desktop\slrr230
[2010/09/06 17:12:50 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2010/09/04 12:18:50 | 000,000,000 | ---D | C] -- C:\Program Files\Prankhouse(2)
[2010/09/02 13:34:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Application Data\prankhouse
[2010/08/17 20:33:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\My Documents\My eBooks
[2010/08/17 20:16:37 | 000,000,000 | ---D | C] -- C:\Program Files\Ubisoft
[2010/08/09 20:58:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[2010/08/09 20:57:33 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2010/08/09 20:57:02 | 000,061,440 | ---- | C] (Khronos Group) -- C:\WINDOWS\System32\OpenCL.dll
[2010/08/09 20:56:55 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2010/08/09 18:15:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2010/08/07 08:45:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Local Settings\Application Data\Activision
[2010/08/02 01:40:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Application Data\ooVoo Details
[2010/08/02 01:40:31 | 000,000,000 | ---D | C] -- C:\Program Files\ooVoo
[2010/08/01 19:29:52 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft LifeCam
[2010/07/15 09:13:27 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/13 19:18:03 | 000,000,000 | ---D | C] -- C:\Program Files\Red Storm Entertainment
[2010/07/13 09:24:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Local Settings\Application Data\Fallout3
[2010/07/13 09:22:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\My Documents\My Games
[2010/07/12 20:10:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Enkord
[2010/07/11 19:16:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\My Documents\Bioshock
[2010/07/11 19:16:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chessie\Application Data\Bioshock
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/29 08:31:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chessie\Desktop\OTL.exe
[2010/09/29 08:24:22 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/09/29 08:15:23 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/29 08:15:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/09/29 08:15:16 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2010/09/29 00:59:25 | 007,864,320 | ---- | M] () -- C:\Documents and Settings\Chessie\ntuser.dat
[2010/09/29 00:31:46 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/09/29 00:06:12 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/09/28 23:19:18 | 000,000,328 | RHS- | M] () -- C:\boot.ini
[2010/09/28 23:05:25 | 003,855,377 | R--- | M] () -- C:\Documents and Settings\Chessie\Desktop\ComboFix.exe
[2010/09/28 22:19:03 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Chessie\Desktop\MBRCheck.exe
[2010/09/28 22:18:54 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Chessie\Desktop\rr1vzutc.exe
[2010/09/28 18:53:19 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Chessie\Desktop\dds.scr
[2010/09/28 18:32:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Chessie\Local Settings\Application Data\prvlcl.dat
[2010/09/28 17:30:08 | 065,414,391 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/09/28 17:23:21 | 000,000,589 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/09/27 17:38:37 | 000,002,855 | ---- | M] () -- C:\WINDOWS\System32\mem.PIF
[2010/09/27 09:48:49 | 000,002,316 | ---- | M] () -- C:\Documents and Settings\Chessie\Application Data\wklnhst.dat
[2010/09/27 09:46:57 | 000,373,693 | ---- | M] () -- C:\Documents and Settings\Chessie\My Documents\128.zip
[2010/09/26 18:27:50 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Chessie\ntuser.ini
[2010/09/26 17:41:21 | 000,029,184 | ---- | M] () -- C:\Documents and Settings\Chessie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/26 12:11:55 | 000,000,212 | ---- | M] () -- C:\Boot.bak
[2010/09/25 20:22:45 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/09/25 17:19:39 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/12 14:16:05 | 002,114,192 | -H-- | M] () -- C:\Documents and Settings\Chessie\Local Settings\Application Data\IconCache.db
[2010/09/08 12:00:05 | 000,001,984 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/05 05:00:00 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\dfrg.job
[2010/09/04 15:29:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/18 18:46:39 | 000,000,668 | ---- | M] () -- C:\Documents and Settings\Chessie\Application Data\Microsoft\Internet Explorer\Quick Launch\BitTorrent.lnk
[2010/08/17 20:33:08 | 000,000,882 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Acrobat Reader 5.0.lnk
[2010/08/17 20:18:08 | 000,001,515 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play XIII.lnk
[2010/08/17 15:50:03 | 000,001,788 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft LifeCam.lnk
[2010/08/11 03:23:25 | 000,172,280 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/11 03:06:57 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/08/11 03:05:25 | 000,504,020 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/11 03:05:25 | 000,442,798 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/08/11 03:05:25 | 000,072,080 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/08/09 21:05:54 | 000,233,812 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2010/08/09 21:05:54 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32\nvdrssel.bin
[2010/08/09 21:05:53 | 000,233,804 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2010/08/09 20:57:52 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\nvdrswr.lk
[2010/08/09 20:41:00 | 000,187,281 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/08/08 17:47:26 | 000,001,839 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\The Sims™ 3 Ambitions.lnk
[2010/08/01 19:29:11 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/07/15 09:13:29 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/07/15 09:13:27 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/15 09:12:53 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/07/12 20:08:01 | 000,000,215 | ---- | M] () -- C:\Documents and Settings\Chessie\Desktop\Fallout 3 Game of the Year Edition.url
[2010/07/11 12:25:23 | 000,000,214 | ---- | M] () -- C:\Documents and Settings\Chessie\Desktop\BioShock.url
[2010/07/09 18:38:00 | 002,195,030 | ---- | M] () -- C:\WINDOWS\System32\nvdata.bin
[2010/07/09 18:38:00 | 000,061,440 | ---- | M] (Khronos Group) -- C:\WINDOWS\System32\OpenCL.dll
[2010/07/09 18:38:00 | 000,025,836 | ---- | M] () -- C:\WINDOWS\System32\nvdisp.nvu
[2010/07/09 18:38:00 | 000,007,959 | ---- | M] () -- C:\WINDOWS\System32\nvinfo.pb
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/28 23:19:17 | 000,000,212 | ---- | C] () -- C:\Boot.bak
[2010/09/28 23:19:13 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/09/28 23:13:20 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/09/28 23:13:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/09/28 23:13:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/09/28 23:13:20 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/09/28 23:13:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/09/28 23:05:06 | 003,855,377 | R--- | C] () -- C:\Documents and Settings\Chessie\Desktop\ComboFix.exe
[2010/09/28 22:19:03 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Chessie\Desktop\MBRCheck.exe
[2010/09/28 22:18:53 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Chessie\Desktop\rr1vzutc.exe
[2010/09/28 18:53:18 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Chessie\Desktop\dds.scr
[2010/09/27 17:38:37 | 000,002,855 | ---- | C] () -- C:\WINDOWS\System32\mem.PIF
[2010/09/25 20:22:45 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/09/25 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Chessie\Local Settings\Application Data\prvlcl.dat
[2010/09/25 17:19:39 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/25 15:50:55 | 2145,898,496 | -HS- | C] () -- C:\hiberfil.sys
[2010/09/07 01:02:59 | 007,864,320 | ---- | C] () -- C:\Documents and Settings\Chessie\ntuser.dat
[2010/08/18 18:46:39 | 000,000,668 | ---- | C] () -- C:\Documents and Settings\Chessie\Application Data\Microsoft\Internet Explorer\Quick Launch\BitTorrent.lnk
[2010/08/17 20:33:08 | 000,000,882 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Acrobat Reader 5.0.lnk
[2010/08/17 20:18:08 | 000,001,515 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play XIII.lnk
[2010/08/17 15:50:03 | 000,001,788 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft LifeCam.lnk
[2010/08/09 20:57:55 | 000,233,812 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2010/08/09 20:57:52 | 000,233,804 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2010/08/09 20:57:52 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2010/08/09 20:57:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nvdrswr.lk
[2010/08/09 20:57:03 | 000,007,959 | ---- | C] () -- C:\WINDOWS\System32\nvinfo.pb
[2010/08/09 20:57:01 | 002,195,030 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010/08/08 17:47:25 | 000,001,839 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\The Sims™ 3 Ambitions.lnk
[2010/08/08 10:58:49 | 000,406,344 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/08/01 19:29:11 | 000,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[2010/07/12 20:08:01 | 000,000,215 | ---- | C] () -- C:\Documents and Settings\Chessie\Desktop\Fallout 3 Game of the Year Edition.url
[2010/07/11 12:25:23 | 000,000,214 | ---- | C] () -- C:\Documents and Settings\Chessie\Desktop\BioShock.url
[2010/05/25 08:33:22 | 002,968,760 | ---- | C] () -- C:\Documents and Settings\Chessie\Application Data\Kesha - Your Love is my Drug.zip
[2010/04/26 02:58:07 | 000,014,534 | -HS- | C] () -- C:\Documents and Settings\Chessie\Local Settings\Application Data\53YQ5yXeP
[2010/04/26 02:58:07 | 000,014,534 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\53YQ5yXeP
[2010/04/02 17:17:34 | 000,179,091 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2010/01/01 22:11:35 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2009/11/01 13:48:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2009/09/17 17:12:32 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\trltmpct.dll
[2008/06/13 20:55:50 | 000,002,316 | ---- | C] () -- C:\Documents and Settings\Chessie\Application Data\wklnhst.dat
[2008/06/10 09:35:13 | 000,029,184 | ---- | C] () -- C:\Documents and Settings\Chessie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/06/07 21:31:46 | 000,007,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\enodpl.sys
[2008/06/07 21:31:46 | 000,004,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\tandpl.sys
[2008/04/18 14:52:59 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/04/18 14:18:52 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/04/18 14:17:24 | 000,001,119 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 13:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 13:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2000/01/28 01:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2010/02/06 19:26:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/01/25 08:53:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2010/07/12 20:10:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Enkord
[2008/04/18 14:43:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/02/22 22:38:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2008/04/18 14:44:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
[2010/09/26 12:01:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Update
[2009/07/24 19:17:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/01/02 14:05:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\AVG9
[2010/07/28 12:04:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Bioshock
[2008/06/13 12:39:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\CVS
[2010/09/26 12:11:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Facebook
[2008/06/14 12:28:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\FrostWire
[2010/09/26 10:41:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Genieo
[2009/06/08 20:39:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\GetRightToGo
[2010/08/08 11:18:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\IMVU
[2010/09/12 14:06:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\InterTrust
[2010/08/02 01:41:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\ooVoo Details
[2010/09/02 13:34:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\prankhouse
[2009/02/22 22:42:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\TaxCut
[2008/06/13 20:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Template
[2009/12/07 16:46:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Unity
[2010/09/12 14:28:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\uTorrent
[2008/09/12 19:24:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Viewpoint
[2010/02/08 13:22:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chessie\Application Data\Vivox
[2010/09/05 05:00:00 | 000,000,256 | ---- | M] () -- C:\WINDOWS\Tasks\dfrg.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/08/10 13:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/09/26 12:11:55 | 000,000,212 | ---- | M] () -- C:\Boot.bak
[2010/09/28 23:19:18 | 000,000,328 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/09/29 00:40:31 | 000,021,837 | ---- | M] () -- C:\ComboFix.txt
[2004/08/10 13:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/04/18 14:20:52 | 000,006,925 | RH-- | M] () -- C:\dell.sdr
[2010/07/04 21:00:28 | 000,000,382 | ---- | M] () -- C:\fserrors.txt
[2010/09/29 08:15:16 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2008/06/08 23:07:55 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2009/12/05 15:25:30 | 000,000,188 | ---- | M] () -- C:\INSTALL.LOG
[2004/08/10 13:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2008/04/18 14:49:25 | 000,001,211 | -H-- | M] () -- C:\IPH.PH
[2004/08/10 13:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/12/07 11:26:39 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/09/29 08:15:15 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2008/06/23 20:33:22 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\psapi.dll
[2008/04/18 14:49:31 | 000,000,071 | ---- | M] () -- C:\SystemInfo.ini
[2009/05/04 22:20:38 | 000,216,405 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 13:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 13:15:46 | 000,306,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 12:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 12:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 12:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/12/07 11:32:23 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2008/12/07 11:39:09 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Chessie\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/10 13:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Chessie\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/09/28 23:05:25 | 003,855,377 | R--- | M] () -- C:\Documents and Settings\Chessie\Desktop\ComboFix.exe
[2010/09/28 22:19:03 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Chessie\Desktop\MBRCheck.exe
[2010/09/29 08:31:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chessie\Desktop\OTL.exe
[2010/09/28 22:18:54 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Chessie\Desktop\rr1vzutc.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2008/07/05 13:15:11 | 000,435,586 | ---- | M] () -- C:\Documents and Settings\Chessie\My Documents\Bloodmoon_v1.6.1820.exe
[2008/07/06 22:37:57 | 024,529,429 | ---- | M] () -- C:\Documents and Settings\Chessie\My Documents\warzone2100-0.2.2-setup.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/12/07 11:39:10 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Chessie\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/29 08:16:13 | 000,655,360 | ---- | M] () -- C:\Documents and Settings\Chessie\Cookies\index.dat

 

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2008/04/13 20:12:38 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 01:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 01:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 20:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 01:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 01:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 01:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 01:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 01:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >