Solved Scans requested by BRONI- RE: "Hardware Interruptions" - Part 1

ravn87 · 2010/09/10

[Resolved] Scans requested by BRONI- RE: "Hardware Interruptions" - Part 1

Hi BRONI!

OKAY, I figured I'd do a before and after shot so at least you have a heads up on what we're working with. THANK YOU again for taking the time to explore this with me. THese ANTI-virus scans are killing me, they just CREEP for hours on this machine, but I'll try and see all these scans through. I haven't scanned with any of these yet, but I also have the following scanners downloaded and handy if they in any way give you more detail or a differnt perspective, if needed: OTS, OTL, OTM, Hijack THIS, ComboFix, SDFix, and RSIT.

Here's the DDS logs as requested: (See 1st response below)

ravn87 · 2010/09/10

DDS Scan Log - Part 1:
<br></br>

DDS (Ver_10-03-17.01) - FAT32x86
Run by HP Authorized Custom at 1:33:06.06 on Fri 09/10/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.383.66 [GMT -7:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

============== Pseudo HJT Report ===============
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = localhost
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [SystemTray] SysTray.Exe
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [HPHA2MON] c:\windows\system32\hpha2mon.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [wcmdmgr] c:\windows\wt\wcmdmgrl.exe -launch
mRunServices: [RegisterDropHandler] c:\progra~1\textbr~1.0\bin\REGIST~1.EXE
Trusted Zone: motive.com\patttbc.att
DPF: DirectAnimation Java Classes - file://c:\windows\system\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso4.cab
DPF: Win32 Classes
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - hxxp://www.keepandshare.com/imageuploader5.7.24/ImageUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
IFEO: taskmgr.exe - "c:\program files\sysinternalssuite\PROCEXP.EXE "

================= FIREFOX ===================
FF - ProfilePath -

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

============= SERVICES / DRIVERS ===============

R? cpuz132;cpuz132
R? SbieDrv;SbieDrv
S? aswFsBlk;aswFsBlk
S? aswSP;aswSP
S? avast! Antivirus;avast! Antivirus
S? avast! Mail Scanner;avast! Mail Scanner
S? avast! Web Scanner;avast! Web Scanner
S? pavboot;pavboot
S? SASDIFSV;SASDIFSV
S? SASKUTIL;SASKUTIL

=============== Created Last 30 ================

2010-09-07 08:31:51 25 ----a-w- C:\Documents
2010-09-04 12:00:32 0 d-----w- c:\windows\wt
2010-09-04 08:04:46 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-09-04 08:04:39 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-09-04 08:04:37 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-09-04 08:04:30 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-09-04 08:04:22 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-09-04 08:04:08 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe
2010-09-04 08:03:40 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-09-04 08:03:37 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-09-04 08:03:31 19200 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2010-09-04 08:03:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-09-04 08:03:25 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll
2010-09-04 08:02:28 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-09-04 08:02:07 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-09-04 08:02:00 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-09-04 08:01:43 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys
2010-09-04 08:01:31 53760 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll
2010-09-04 08:01:23 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-09-04 08:01:11 701386 ----a-w- c:\windows\system32\dllcache\wdhaalba.sys
2010-09-04 08:01:09 23615 ----a-w- c:\windows\system32\dllcache\wch7xxnt.sys
2010-09-04 08:01:07 31744 ----a-w- c:\windows\system32\dllcache\wceusbsh.sys
2010-09-04 08:01:00 35871 ----a-w- c:\windows\system32\dllcache\wbfirdma.sys
2010-09-04 08:00:54 33599 ----a-w- c:\windows\system32\dllcache\watv04nt.sys
2010-09-04 08:00:52 19551 ----a-w- c:\windows\system32\dllcache\watv02nt.sys
2010-09-04 08:00:50 29311 ----a-w- c:\windows\system32\dllcache\watv01nt.sys
2010-09-04 08:00:48 11775 ----a-w- c:\windows\system32\dllcache\wadv05nt.sys
2010-09-04 08:00:46 12127 ----a-w- c:\windows\system32\dllcache\wadv02nt.sys
2010-09-04 08:00:44 12415 ----a-w- c:\windows\system32\dllcache\wadv01nt.sys
2010-09-04 08:00:36 16925 ----a-w- c:\windows\system32\dllcache\w940nd.sys
2010-09-04 08:00:29 19016 ----a-w- c:\windows\system32\dllcache\w926nd.sys
2010-09-04 08:00:22 19528 ----a-w- c:\windows\system32\dllcache\w840nd.sys
2010-09-04 08:00:13 64605 ----a-w- c:\windows\system32\dllcache\vvoice.sys
2010-09-04 08:00:05 397502 ----a-w- c:\windows\system32\dllcache\vpctcom.sys
2010-09-04 07:59:57 604253 ----a-w- c:\windows\system32\dllcache\vmodem.sys
2010-09-04 07:59:50 249402 ----a-w- c:\windows\system32\dllcache\vinwm.sys
2010-09-04 07:59:43 24576 ----a-w- c:\windows\system32\dllcache\viairda.sys
2010-09-04 07:59:41 5376 ----a-w- c:\windows\system32\dllcache\viaide.sys
2010-09-04 07:59:36 53760 ----a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-09-04 07:59:27 687999 ----a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2010-09-04 07:59:19 765884 ----a-w- c:\windows\system32\dllcache\usrti.sys
2010-09-04 07:59:12 113762 ----a-w- c:\windows\system32\dllcache\usrpda.sys
2010-09-04 07:59:05 7556 ----a-w- c:\windows\system32\dllcache\usroslba.sys
2010-09-04 07:58:57 224802 ----a-w- c:\windows\system32\dllcache\usr1807a.sys
2010-09-04 07:58:50 794399 ----a-w- c:\windows\system32\dllcache\usr1806v.sys
2010-09-04 07:58:43 793598 ----a-w- c:\windows\system32\dllcache\usr1806.sys
2010-09-04 07:58:36 794654 ----a-w- c:\windows\system32\dllcache\usr1801.sys
2010-09-04 07:58:31 26112 ----a-w- c:\windows\system32\dllcache\usbser.sys
2010-09-04 07:58:28 17152 ----a-w- c:\windows\system32\dllcache\usbohci.sys
2010-09-04 07:58:25 60032 ----a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-09-04 07:58:22 32384 ----a-w- c:\windows\system32\dllcache\usb101et.sys
2010-09-04 07:58:11 94720 ----a-w- c:\windows\system32\dllcache\umaxud32.dll
2010-09-04 07:58:05 28160 ----a-w- c:\windows\system32\dllcache\umaxu40.dll
2010-09-04 07:57:59 26624 ----a-w- c:\windows\system32\dllcache\umaxu22.dll
2010-09-04 07:57:52 69632 ----a-w- c:\windows\system32\dllcache\umaxu12.dll
2010-09-04 07:57:46 50688 ----a-w- c:\windows\system32\dllcache\umaxscan.dll
2010-09-04 07:57:39 22912 ----a-w- c:\windows\system32\dllcache\umaxpcls.sys
2010-09-04 07:57:33 50176 ----a-w- c:\windows\system32\dllcache\umaxp60.dll
2010-09-04 07:57:26 47616 ----a-w- c:\windows\system32\dllcache\umaxcam.dll
2010-09-04 07:57:19 211968 ----a-w- c:\windows\system32\dllcache\um54scan.dll
2010-09-04 07:57:12 216064 ----a-w- c:\windows\system32\dllcache\um34scan.dll
2010-09-04 07:57:05 36736 ----a-w- c:\windows\system32\dllcache\ultra.sys
2010-09-04 07:56:57 11520 ----a-w- c:\windows\system32\dllcache\twotrack.sys
2010-09-04 07:56:44 166784 ----a-w- c:\windows\system32\dllcache\tridxpm.sys
2010-09-04 07:56:37 525568 ----a-w- c:\windows\system32\dllcache\tridxp.dll
2010-09-04 07:56:30 159232 ----a-w- c:\windows\system32\dllcache\tridkbm.sys
2010-09-04 07:56:23 440576 ----a-w- c:\windows\system32\dllcache\tridkb.dll
2010-09-04 07:56:17 222336 ----a-w- c:\windows\system32\dllcache\trid3dm.sys
2010-09-04 07:56:10 315520 ----a-w- c:\windows\system32\dllcache\trid3d.dll
2010-09-04 07:56:02 34375 ----a-w- c:\windows\system32\dllcache\tpro4.sys
2010-09-04 07:55:56 42496 ----a-w- c:\windows\system32\dllcache\tp4res.dll
2010-09-04 07:55:54 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe
2010-09-04 07:55:48 31744 ----a-w- c:\windows\system32\dllcache\tp4.dll
2010-09-04 07:55:37 4992 ----a-w- c:\windows\system32\dllcache\toside.sys
2010-09-04 07:55:30 230912 ----a-w- c:\windows\system32\dllcache\tosdvd03.sys
2010-09-04 07:55:24 241664 ----a-w- c:\windows\system32\dllcache\tosdvd02.sys
2010-09-04 07:55:16 28232 ----a-w- c:\windows\system32\dllcache\tos4mo.sys
2010-09-04 07:55:09 123995 ----a-w- c:\windows\system32\dllcache\tjisdn.sys
2010-09-04 07:54:59 138528 ----a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2010-09-04 07:54:51 81408 ----a-w- c:\windows\system32\dllcache\tgiul50.dll
2010-09-04 07:54:48 149376 ----a-w- c:\windows\system32\dllcache\tffsport.sys
2010-09-04 07:54:40 17129 ----a-w- c:\windows\system32\dllcache\tdkcd31.sys
2010-09-04 07:54:33 37961 ----a-w- c:\windows\system32\dllcache\tdk100b.sys
2010-09-04 07:54:21 30464 ----a-w- c:\windows\system32\dllcache\tbatm155.sys
2010-09-04 07:54:12 7040 ----a-w- c:\windows\system32\dllcache\tandqic.sys
2010-09-04 07:54:05 36640 ----a-w- c:\windows\system32\dllcache\t2r4mini.sys
2010-09-04 07:53:58 172768 ----a-w- c:\windows\system32\dllcache\t2r4disp.dll
2010-09-04 07:53:46 32640 ----a-w- c:\windows\system32\dllcache\symc8xx.sys
2010-09-04 07:53:41 16256 ----a-w- c:\windows\system32\dllcache\symc810.sys
2010-09-04 07:53:35 30688 ----a-w- c:\windows\system32\dllcache\sym_u3.sys
2010-09-04 07:53:29 28384 ----a-w- c:\windows\system32\dllcache\sym_hi.sys
2010-09-04 07:53:22 94293 ----a-w- c:\windows\system32\dllcache\sxports.dll
2010-09-04 07:53:16 103936 ----a-w- c:\windows\system32\dllcache\sx.sys
2010-09-04 07:53:10 3968 ----a-w- c:\windows\system32\dllcache\swusbflt.sys
2010-09-04 07:53:04 10240 ----a-w- c:\windows\system32\dllcache\swpidflt.dll
2010-09-04 07:52:58 10240 ----a-w- c:\windows\system32\dllcache\swpdflt2.dll
2010-09-04 07:52:51 53760 ----a-w- c:\windows\system32\dllcache\sw_wheel.dll
2010-09-04 07:52:45 41472 ----a-w- c:\windows\system32\dllcache\sw_effct.dll
2010-09-04 07:52:42 15232 ----a-w- c:\windows\system32\dllcache\streamip.sys
2010-09-04 07:52:35 155648 ----a-w- c:\windows\system32\dllcache\stlnprop.dll
2010-09-04 07:52:28 53248 ----a-w- c:\windows\system32\dllcache\stlncoin.dll
2010-09-04 07:52:22 285760 ----a-w- c:\windows\system32\dllcache\stlnata.sys
2010-09-04 07:52:15 16896 ----a-w- c:\windows\system32\dllcache\stcusb.sys
2010-09-04 07:52:04 48736 ----a-w- c:\windows\system32\dllcache\srwlnd5.sys
2010-09-04 07:51:56 99328 ----a-w- c:\windows\system32\dllcache\srusd.dll
2010-09-04 07:51:44 24660 ----a-w- c:\windows\system32\dllcache\spxupchk.dll
2010-09-04 07:51:34 61824 ----a-w- c:\windows\system32\dllcache\speed.sys
2010-09-04 07:51:28 106584 ----a-w- c:\windows\system32\dllcache\spdports.dll
2010-09-04 07:51:21 19072 ----a-w- c:\windows\system32\dllcache\sparrow.sys
2010-09-04 07:51:14 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys
2010-09-04 07:51:09 37040 ----a-w- c:\windows\system32\dllcache\sonypi.sys
2010-09-04 07:51:03 114688 ----a-w- c:\windows\system32\dllcache\sonypi.dll
2010-09-04 07:50:57 20752 ----a-w- c:\windows\system32\dllcache\sonync.sys
2010-09-04 07:50:51 9600 ----a-w- c:\windows\system32\dllcache\sonymc.sys
2010-09-04 07:50:48 7552 ----a-w- c:\windows\system32\dllcache\sonyait.sys
2010-09-04 07:50:47 143422 ----a-w- c:\windows\system32\dllcache\softkey.dll
2010-09-04 07:50:40 7040 ----a-w- c:\windows\system32\dllcache\snyaitmc.sys
2010-09-04 07:50:24 58368 ----a-w- c:\windows\system32\dllcache\smiminib.sys
2010-09-04 07:50:18 147200 ----a-w- c:\windows\system32\dllcache\smidispb.dll
2010-09-04 07:50:11 25034 ----a-w- c:\windows\system32\dllcache\smcpwr2n.sys
2010-09-04 07:50:04 35913 ----a-w- c:\windows\system32\dllcache\smcirda.sys
2010-09-04 07:49:58 24576 ----a-w- c:\windows\system32\dllcache\smc8000n.sys
2010-09-04 07:49:52 6784 ----a-w- c:\windows\system32\dllcache\smbhc.sys
2010-09-04 07:49:50 6912 ----a-w- c:\windows\system32\dllcache\smbclass.sys
2010-09-04 07:49:48 16000 ----a-w- c:\windows\system32\dllcache\smbbatt.sys
2010-09-04 07:49:41 45568 ----a-w- c:\windows\system32\dllcache\smb3w.dll
2010-09-04 07:49:34 33792 ----a-w- c:\windows\system32\dllcache\smb0w.dll
2010-09-04 07:49:27 28672 ----a-w- c:\windows\system32\dllcache\sma0w.dll
2010-09-04 07:49:18 28160 ----a-w- c:\windows\system32\dllcache\sm91w.dll
2010-09-04 07:49:08 11136 ----a-w- c:\windows\system32\dllcache\slip.sys
2010-09-04 07:49:03 63547 ----a-w- c:\windows\system32\dllcache\sla30nd5.sys
2010-09-04 07:48:57 91294 ----a-w- c:\windows\system32\dllcache\skfpwin.sys
2010-09-04 07:48:51 94698 ----a-w- c:\windows\system32\dllcache\sk98xwin.sys
2010-09-04 07:48:44 157696 ----a-w- c:\windows\system32\dllcache\sisv256.dll
2010-09-04 07:48:38 50432 ----a-w- c:\windows\system32\dllcache\sisv.sys
2010-09-04 07:48:36 32768 ----a-w- c:\windows\system32\dllcache\sisnic.sys
2010-09-04 07:48:30 238592 ----a-w- c:\windows\system32\dllcache\sisgrv.dll
2010-09-04 07:48:24 104064 ----a-w- c:\windows\system32\dllcache\sisgrp.sys
2010-09-04 07:48:17 150144 ----a-w- c:\windows\system32\dllcache\sis6306v.dll
2010-09-04 07:48:11 68608 ----a-w- c:\windows\system32\dllcache\sis6306p.sys
2010-09-04 07:48:04 252032 ----a-w- c:\windows\system32\dllcache\sis300iv.dll
2010-09-04 07:47:58 101760 ----a-w- c:\windows\system32\dllcache\sis300ip.sys
2010-09-04 07:47:27 161568 ----a-w- c:\windows\system32\dllcache\sgsmusb.sys
2010-09-04 07:47:21 18400 ----a-w- c:\windows\system32\dllcache\sgsmld.sys
2010-09-04 07:47:16 98080 ----a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2010-09-04 07:47:10 386560 ----a-w- c:\windows\system32\dllcache\sgiul50.dll
2010-09-04 07:47:04 36480 ----a-w- c:\windows\system32\dllcache\sfmanm.sys
2010-09-04 07:46:52 6784 ----a-w- c:\windows\system32\dllcache\serscan.sys
2010-09-04 07:46:46 17664 ----a-w- c:\windows\system32\dllcache\sermouse.sys
2010-09-04 07:46:38 6912 ----a-w- c:\windows\system32\dllcache\seaddsmc.sys
2010-09-04 07:46:35 11520 ----a-w- c:\windows\system32\dllcache\scsiscan.sys
2010-09-04 07:46:29 11648 ----a-w- c:\windows\system32\dllcache\scsiprnt.sys
2010-09-04 07:46:20 17280 ----a-w- c:\windows\system32\dllcache\scr111.sys
2010-09-04 07:46:13 16640 ----a-w- c:\windows\system32\dllcache\scmstcs.sys
2010-09-04 07:46:03 23936 ----a-w- c:\windows\system32\dllcache\sccmusbm.sys
2010-09-04 07:45:57 23936 ----a-w- c:\windows\system32\dllcache\sccmn50m.sys
2010-09-04 07:45:52 43904 ----a-w- c:\windows\system32\dllcache\sbp2port.sys
2010-09-04 07:45:46 495616 ----a-w- c:\windows\system32\dllcache\sblfx.dll
2010-09-04 07:45:36 75392 ----a-w- c:\windows\system32\dllcache\s3savmxm.sys
2010-09-04 07:45:30 245632 ----a-w- c:\windows\system32\dllcache\s3savmx.dll
2010-09-04 07:45:24 77824 ----a-w- c:\windows\system32\dllcache\s3sav4m.sys
2010-09-04 07:45:18 198400 ----a-w- c:\windows\system32\dllcache\s3sav4.dll
2010-09-04 07:45:12 61504 ----a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2010-09-04 07:45:07 179264 ----a-w- c:\windows\system32\dllcache\s3sav3d.dll
2010-09-04 07:45:01 210496 ----a-w- c:\windows\system32\dllcache\s3mvirge.dll
2010-09-04 07:44:55 62496 ----a-w- c:\windows\system32\dllcache\s3mtrio.dll
2010-09-04 07:44:49 41216 ----a-w- c:\windows\system32\dllcache\s3mt3d.sys
2010-09-04 07:44:43 182272 ----a-w- c:\windows\system32\dllcache\s3mt3d.dll
2010-09-04 07:44:38 166720 ----a-w- c:\windows\system32\dllcache\s3m.sys
2010-09-04 07:44:31 65664 ----a-w- c:\windows\system32\dllcache\s3legacy.sys
2010-09-04 07:44:23 82432 ----a-w- c:\windows\system32\dllcache\rwia450.dll
2010-09-04 07:44:17 79872 ----a-w- c:\windows\system32\dllcache\rwia430.dll
2010-09-04 07:44:13 29696 ----a-w- c:\windows\system32\dllcache\rw450ext.dll
2010-09-04 07:44:11 27648 ----a-w- c:\windows\system32\dllcache\rw430ext.dll
2010-09-04 07:43:59 19017 ----a-w- c:\windows\system32\dllcache\rtl8029.sys
2010-09-04 07:43:54 30720 ----a-w- c:\windows\system32\dllcache\rthwcls.sys
2010-09-04 07:43:45 9216 ----a-w- c:\windows\system32\dllcache\rsmgrstr.dll
2010-09-04 07:43:38 3840 ----a-w- c:\windows\system32\dllcache\rpfun.sys
2010-09-04 07:43:33 79104 ----a-w- c:\windows\system32\dllcache\rocket.sys
2010-09-04 07:43:26 37563 ----a-w- c:\windows\system32\dllcache\rlnet5.sys
2010-09-04 07:43:19 86097 ----a-w- c:\windows\system32\dllcache\reslog32.dll
2010-09-04 07:43:01 19584 ----a-w- c:\windows\system32\dllcache\rasirda.sys
2010-09-04 07:42:53 714762 ----a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2010-09-04 07:42:46 899146 ----a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2010-09-04 07:42:40 41472 ----a-w- c:\windows\system32\dllcache\qvusd.dll
2010-09-04 07:42:34 3328 ----a-w- c:\windows\system32\dllcache\qv2kux.sys
2010-09-04 07:42:20 49024 ----a-w- c:\windows\system32\dllcache\ql1280.sys
2010-09-04 07:42:14 40448 ----a-w- c:\windows\system32\dllcache\ql1240.sys
2010-09-04 07:42:09 45312 ----a-w- c:\windows\system32\dllcache\ql12160.sys
2010-09-04 07:42:03 33152 ----a-w- c:\windows\system32\dllcache\ql10wnt.sys
2010-09-04 07:41:57 40320 ----a-w- c:\windows\system32\dllcache\ql1080.sys
2010-09-04 07:41:55 6016 ----a-w- c:\windows\system32\dllcache\qic157.sys
2010-09-04 07:41:46 130942 ----a-w- c:\windows\system32\dllcache\ptserlv.sys
2010-09-04 07:41:40 112574 ----a-w- c:\windows\system32\dllcache\ptserlp.sys
2010-09-04 07:41:35 128286 ----a-w- c:\windows\system32\dllcache\ptserli.sys
2010-09-04 07:41:33 159232 ----a-w- c:\windows\system32\dllcache\ptpusd.dll
2010-09-04 07:41:27 5632 ----a-w- c:\windows\system32\dllcache\ptpusb.dll
2010-09-04 07:41:24 33280 ----a-w- c:\windows\system32\dllcache\psisrndr.ax
2010-09-04 07:41:18 35328 ----a-w- c:\windows\system32\dllcache\psisload.dll
2010-09-04 07:41:15 363520 ----a-w- c:\windows\system32\dllcache\psisdecd.dll
2010-09-04 07:41:09 16128 ----a-w- c:\windows\system32\dllcache\pscr.sys
2010-09-04 07:41:02 17664 ----a-w- c:\windows\system32\dllcache\ppa3.sys
2010-09-04 07:40:57 17792 ----a-w- c:\windows\system32\dllcache\ppa.sys
2010-09-04 07:40:49 8832 ----a-w- c:\windows\system32\dllcache\powerfil.sys
2010-09-04 07:40:42 7168 ----a-w- c:\windows\system32\dllcache\pnrmc.sys
2010-09-04 07:40:30 121344 ----a-w- c:\windows\system32\dllcache\phvfwext.dll
2010-09-04 07:40:24 19840 ----a-w- c:\windows\system32\dllcache\philtune.sys
2010-09-04 07:40:18 92416 ----a-w- c:\windows\system32\dllcache\phildec.sys
2010-09-04 07:40:12 173696 ----a-w- c:\windows\system32\dllcache\philcam2.sys
2010-09-04 07:40:07 75776 ----a-w- c:\windows\system32\dllcache\philcam1.sys
2010-09-04 07:40:01 16384 ----a-w- c:\windows\system32\dllcache\philcam1.dll
2010-09-04 07:38:58 3328 ----a-w- c:\windows\system32\dllcache\pciide.sys
2010-09-04 07:38:51 29502 ----a-w- c:\windows\system32\dllcache\pca200e.sys
2010-09-04 07:38:45 30495 ----a-w- c:\windows\system32\dllcache\pc100nds.sys
2010-09-04 07:38:43 14336 ----a-w- c:\windows\system32\dllcache\padrs412.dll
2010-09-04 07:38:42 36927 ----a-w- c:\windows\system32\dllcache\padrs411.dll
2010-09-04 07:38:34 41984 ----a-w- c:\windows\system32\dllcache\ovui2rc.dll
2010-09-04 07:38:28 44544 ----a-w- c:\windows\system32\dllcache\ovui2.dll
2010-09-04 07:38:23 25216 ----a-w- c:\windows\system32\dllcache\ovsound2.sys
2010-09-04 07:38:17 39424 ----a-w- c:\windows\system32\dllcache\ovcoms.exe
2010-09-04 07:38:11 20480 ----a-w- c:\windows\system32\dllcache\ovcomc.dll
2010-09-04 07:38:06 351616 ----a-w- c:\windows\system32\dllcache\ovcodek2.sys
2010-09-04 07:38:00 116736 ----a-w- c:\windows\system32\dllcache\ovcodec2.dll
2010-09-04 07:37:54 31872 ----a-w- c:\windows\system32\dllcache\ovce.sys
2010-09-04 07:37:48 28032 ----a-w- c:\windows\system32\dllcache\ovcd.sys
2010-09-04 07:37:43 48000 ----a-w- c:\windows\system32\dllcache\ovcam2.sys
2010-09-04 07:37:37 25088 ----a-w- c:\windows\system32\dllcache\ovca.sys
2010-09-04 07:37:31 54186 ----a-w- c:\windows\system32\dllcache\otcsercb.sys
2010-09-04 07:37:26 43689 ----a-w- c:\windows\system32\dllcache\otceth5.sys
2010-09-04 07:37:20 27209 ----a-w- c:\windows\system32\dllcache\otc06x5.sys
2010-09-04 07:37:13 54528 ----a-w- c:\windows\system32\dllcache\opl3sax.sys
2010-09-04 07:36:52 198144 ----a-w- c:\windows\system32\dllcache\nv3.sys
2010-09-04 07:36:46 123776 ----a-w- c:\windows\system32\dllcache\nv3.dll
2010-09-04 07:36:26 51552 ----a-w- c:\windows\system32\dllcache\ntgrip.sys
2010-09-04 07:36:17 9344 ----a-w- c:\windows\system32\dllcache\ntapm.sys
2010-09-04 07:36:12 7552 ----a-w- c:\windows\system32\dllcache\nsmmc.sys
2010-09-04 07:36:06 28672 ----a-w- c:\windows\system32\dllcache\nscirda.sys
2010-09-04 07:35:57 87040 ----a-w- c:\windows\system32\dllcache\nm6wdm.sys
2010-09-04 07:35:51 126080 ----a-w- c:\windows\system32\dllcache\nm5a2wdm.sys
2010-09-04 07:35:39 32840 ----a-w- c:\windows\system32\dllcache\ngrpci.sys
2010-09-04 07:35:36 132695 ----a-w- c:\windows\system32\dllcache\netwlan5.sys
2010-09-04 07:35:24 65278 ----a-w- c:\windows\system32\dllcache\netflx3.sys
2010-09-04 07:35:17 39264 ----a-w- c:\windows\system32\dllcache\neo20xx.sys
2010-09-04 07:35:11 60480 ----a-w- c:\windows\system32\dllcache\neo20xx.dll
2010-09-04 07:35:05 15872 ----a-w- c:\windows\system32\dllcache\ne2000.sys
2010-09-04 07:35:03 10880 ----a-w- c:\windows\system32\dllcache\ndisip.sys
2010-09-04 07:34:55 85248 ----a-w- c:\windows\system32\dllcache\nabtsfec.sys
2010-09-04 07:34:50 91488 ----a-w- c:\windows\system32\dllcache\n9i3disp.dll
2010-09-04 07:34:45 27936 ----a-w- c:\windows\system32\dllcache\n9i3d.sys
2010-09-04 07:34:39 33088 ----a-w- c:\windows\system32\dllcache\n9i128v2.sys
2010-09-04 07:34:34 59104 ----a-w- c:\windows\system32\dllcache\n9i128v2.dll
2010-09-04 07:34:29 13664 ----a-w- c:\windows\system32\dllcache\n9i128.sys
2010-09-04 07:34:23 35392 ----a-w- c:\windows\system32\dllcache\n9i128.dll
2010-09-04 07:34:18 128000 ----a-w- c:\windows\system32\dllcache\n100325.sys
2010-09-04 07:34:13 52255 ----a-w- c:\windows\system32\dllcache\n1000nt5.sys
2010-09-04 07:34:07 75520 ----a-w- c:\windows\system32\dllcache\mxport.sys
2010-09-04 07:34:01 7168 ----a-w- c:\windows\system32\dllcache\mxport.dll
2010-09-04 07:33:56 19968 ----a-w- c:\windows\system32\dllcache\mxnic.sys
2010-09-04 07:33:51 19968 ----a-w- c:\windows\system32\dllcache\mxicfg.dll
2010-09-04 07:33:45 21888 ----a-w- c:\windows\system32\dllcache\mxcard.sys
2010-09-04 07:33:44 229439 ----a-w- c:\windows\system32\dllcache\multibox.dll
2010-09-04 07:33:22 103296 ----a-w- c:\windows\system32\dllcache\mtxvideo.sys
2010-09-04 07:32:51 5504 ----a-w- c:\windows\system32\dllcache\mstee.sys
2010-09-04 07:32:49 49024 ----a-w- c:\windows\system32\dllcache\mstape.sys
2010-09-04 07:32:36 12416 ----a-w- c:\windows\system32\dllcache\msriffwv.sys
2010-09-04 07:32:02 2944 ----a-w- c:\windows\system32\dllcache\msmpu401.sys
2010-09-04 07:31:55 22016 ----a-w- c:\windows\system32\dllcache\msircomm.sys
2010-09-04 07:31:54 1875968 ----a-w- c:\windows\system32\dllcache\msir3jp.lex
2010-09-04 07:31:53 98304 ----a-w- c:\windows\system32\dllcache\msir3jp.dll
2010-09-04 07:31:19 35200 ----a-w- c:\windows\system32\dllcache\msgame.sys
2010-09-04 07:31:12 6016 ----a-w- c:\windows\system32\dllcache\msfsio.sys
2010-09-04 07:31:11 56832 ----a-w- c:\windows\system32\dllcache\msdvbnp.ax
2010-09-04 07:31:10 51200 ----a-w- c:\windows\system32\dllcache\msdv.sys
2010-09-04 07:30:45 17280 ----a-w- c:\windows\system32\dllcache\mraid35x.sys
2010-09-04 07:30:40 15232 ----a-w- c:\windows\system32\dllcache\mpe.sys
2010-09-04 07:30:28 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
2010-09-04 07:30:21 16128 ----a-w- c:\windows\system32\dllcache\modemcsa.sys
2010-09-04 07:30:07 6528 ----a-w- c:\windows\system32\dllcache\miniqic.sys
2010-09-04 07:29:58 320384 ----a-w- c:\windows\system32\dllcache\mgaum.sys
2010-09-04 07:29:52 235648 ----a-w- c:\windows\system32\dllcache\mgaud.dll
2010-09-04 07:29:49 26112 ----a-w- c:\windows\system32\dllcache\memstpci.sys
2010-09-04 07:29:43 47616 ----a-w- c:\windows\system32\dllcache\memgrp.dll
2010-09-04 07:29:38 8320 ----a-w- c:\windows\system32\dllcache\memcard.sys
2010-09-04 07:29:32 164586 ----a-w- c:\windows\system32\dllcache\mdgndis5.sys
2010-09-04 07:29:23 7424 ----a-w- c:\windows\system32\dllcache\mammoth.sys
2010-09-04 07:29:16 48768 ----a-w- c:\windows\system32\dllcache\maestro.sys
2010-09-04 07:29:10 58880 ----a-w- c:\windows\system32\dllcache\m3092dc.dll
2010-09-04 07:29:04 58368 ----a-w- c:\windows\system32\dllcache\m3091dc.dll
2010-09-04 07:28:58 22848 ----a-w- c:\windows\system32\dllcache\lwusbhid.sys
2010-09-04 07:28:56 20864 ----a-w- c:\windows\system32\dllcache\lwadihid.sys
2010-09-04 07:28:48 797500 ----a-w- c:\windows\system32\dllcache\ltsmt.sys
2010-09-04 07:28:43 802683 ----a-w- c:\windows\system32\dllcache\ltsm.sys
2010-09-04 07:28:42 7040 ----a-w- c:\windows\system32\dllcache\ltotape.sys
2010-09-04 07:28:40 420992 ----a-w- c:\windows\system32\dllcache\ltmdmntt.sys
2010-09-04 07:28:35 576746 ----a-w- c:\windows\system32\dllcache\ltmdmntl.sys
2010-09-04 07:28:28 727786 ----a-w- c:\windows\system32\dllcache\ltck000c.sys
2010-09-04 07:28:22 4992 ----a-w- c:\windows\system32\dllcache\loop.sys
2010-09-04 07:28:13 70730 ----a-w- c:\windows\system32\dllcache\lne100tx.sys
2010-09-04 07:28:09 20573 ----a-w- c:\windows\system32\dllcache\lne100.sys
2010-09-04 07:28:03 25065 ----a-w- c:\windows\system32\dllcache\lmndis3.sys
2010-09-04 07:27:58 15744 ----a-w- c:\windows\system32\dllcache\lit220p.sys
2010-09-04 07:27:56 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-09-04 07:27:51 26442 ----a-w- c:\windows\system32\dllcache\lanepic5.sys
2010-09-04 07:27:45 19016 ----a-w- c:\windows\system32\dllcache\ktc111.sys
2010-09-04 07:27:44 43008 ----a-w- c:\windows\system32\dllcache\ksxbar.ax
2010-09-04 07:27:43 91136 ----a-w- c:\windows\system32\dllcache\kswdmcap.ax
2010-09-04 07:27:41 61952 ----a-w- c:\windows\system32\dllcache\kstvtune.ax
2010-09-04 07:27:34 37376 ----a-w- c:\windows\system32\dllcache\kousd.dll
2010-09-04 07:27:32 70656 ----a-w- c:\windows\system32\dllcache\korwbrkr.dll
2010-09-04 07:27:32 1158818 ----a-w- c:\windows\system32\dllcache\korwbrkr.lex
2010-09-04 07:27:25 253952 ----a-w- c:\windows\system32\dllcache\kdsusd.dll
2010-09-04 07:27:24 48640 ----a-w- c:\windows\system32\dllcache\kdsui.dll
2010-09-04 07:26:31 26624 ----a-w- c:\windows\system32\dllcache\irstusb.sys
2010-09-04 07:26:26 18688 ----a-w- c:\windows\system32\dllcache\irsir.sys
2010-09-04 07:26:25 28160 ----a-w- c:\windows\system32\dllcache\irmon.dll
2010-09-04 07:26:20 23552 ----a-w- c:\windows\system32\dllcache\irmk7.sys
2010-09-04 07:26:19 151552 ----a-w- c:\windows\system32\dllcache\irftp.exe
2010-09-04 07:26:18 88192 ----a-w- c:\windows\system32\dllcache\irda.sys
2010-09-04 07:26:12 16384 ----a-w- c:\windows\system32\dllcache\ipsink.ax
2010-09-04 07:26:03 45632 ----a-w- c:\windows\system32\dllcache\ip5515.sys
2010-09-04 07:25:58 90200 ----a-w- c:\windows\system32\dllcache\io8ports.dll
2010-09-04 07:25:54 38784 ----a-w- c:\windows\system32\dllcache\io8.sys
2010-09-04 07:25:48 13056 ----a-w- c:\windows\system32\dllcache\inport.sys
2010-09-04 07:25:42 16000 ----a-w- c:\windows\system32\dllcache\ini910u.sys
2010-09-04 07:25:34 471102 ----a-w- c:\windows\system32\dllcache\imskdic.dll
2010-09-04 07:25:32 59904 ----a-w- c:\windows\system32\dllcache\imkrinst.exe
2010-09-04 07:25:30 45109 ----a-w- c:\windows\system32\dllcache\imjpuex.exe
2010-09-04 07:25:26 57398 ----a-w- c:\windows\system32\dllcache\imjpdadm.exe
2010-09-04 07:25:21 311359 ----a-w- c:\windows\system32\dllcache\imepadsv.exe
2010-09-04 07:25:21 102463 ----a-w- c:\windows\system32\dllcache\imepadsm.dll
2010-09-04 07:25:20 44032 ----a-w- c:\windows\system32\dllcache\imekrmig.exe
2010-09-04 07:25:18 134339 ----a-w- c:\windows\system32\dllcache\imekr.lex
2010-09-04 07:24:45 372824 ----a-w- c:\windows\system32\dllcache\iconf32.dll
2010-09-04 07:24:39 100992 ----a-w- c:\windows\system32\dllcache\icam5usb.sys
2010-09-04 07:24:35 20480 ----a-w- c:\windows\system32\dllcache\icam5ext.dll
2010-09-04 07:24:30 45056 ----a-w- c:\windows\system32\dllcache\icam5com.dll
2010-09-04 07:24:25 154496 ----a-w- c:\windows\system32\dllcache\icam4usb.sys
2010-09-04 07:24:21 61952 ----a-w- c:\windows\system32\dllcache\icam4ext.dll
2010-09-04 07:24:16 91136 ----a-w- c:\windows\system32\dllcache\icam4com.dll
2010-09-04 07:24:12 26624 ----a-w- c:\windows\system32\dllcache\icam3ext.dll
2010-09-04 07:24:07 141056 ----a-w- c:\windows\system32\dllcache\icam3.sys
2010-09-04 07:24:02 38528 ----a-w- c:\windows\system32\dllcache\ibmvcap.sys
2010-09-04 07:23:58 109085 ----a-w- c:\windows\system32\dllcache\ibmtrp.sys
2010-09-04 07:23:53 100936 ----a-w- c:\windows\system32\dllcache\ibmtok.sys
2010-09-04 07:23:48 9216 ----a-w- c:\windows\system32\dllcache\ibmsgnet.dll
2010-09-04 07:23:43 28700 ----a-w- c:\windows\system32\dllcache\ibmexmp.sys
2010-09-04 07:23:39 161020 ----a-w- c:\windows\system32\dllcache\i81xnt5.sys
2010-09-04 07:23:37 702845 ----a-w- c:\windows\system32\dllcache\i81xdnt5.dll
2010-09-04 07:23:32 58592 ----a-w- c:\windows\system32\dllcache\i740nt5.sys
2010-09-04 07:23:12 353184 ----a-w- c:\windows\system32\dllcache\i740dnt5.dll
2010-09-04 07:23:10 18560 ----a-w- c:\windows\system32\dllcache\i2omp.sys
2010-09-04 07:23:06 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-09-04 07:23:00 10129408 ----a-w- c:\windows\system32\dllcache\hwxkor.dll
2010-09-04 07:22:33 10096640 ----a-w- c:\windows\system32\dllcache\hwxcht.dll
2010-09-04 07:22:25 488383 ----a-w- c:\windows\system32\dllcache\hsf_v124.sys
2010-09-04 07:22:20 50751 ----a-w- c:\windows\system32\dllcache\hsf_tone.sys
2010-09-04 07:22:15 73279 ----a-w- c:\windows\system32\dllcache\hsf_spkp.sys
2010-09-04 07:22:11 44863 ----a-w- c:\windows\system32\dllcache\hsf_soar.sys
2010-09-04 07:22:06 57471 ----a-w- c:\windows\system32\dllcache\hsf_samp.sys
2010-09-04 07:22:01 542879 ----a-w- c:\windows\system32\dllcache\hsf_msft.sys
2010-09-04 07:20:56 68608 ----a-w- c:\windows\system32\dllcache\hpgt53tk.dll
2010-09-04 07:20:52 165888 ----a-w- c:\windows\system32\dllcache\hpgt53.dll
2010-09-04 07:20:48 31232 ----a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2010-09-04 07:20:43 93696 ----a-w- c:\windows\system32\dllcache\hpgt42.dll
2010-09-04 07:20:39 126976 ----a-w- c:\windows\system32\dllcache\hpgt34tk.dll
2010-09-04 07:20:35 101376 ----a-w- c:\windows\system32\dllcache\hpgt34.dll
2010-09-04 07:20:30 48128 ----a-w- c:\windows\system32\dllcache\hpgt33tk.dll
2010-09-04 07:20:26 89088 ----a-w- c:\windows\system32\dllcache\hpgt33.dll
2010-09-04 07:20:21 123392 ----a-w- c:\windows\system32\dllcache\hpgt21tk.dll
2010-09-04 07:20:17 83968 ----a-w- c:\windows\system32\dllcache\hpgt21.dll
2010-09-04 07:20:10 119296 ----a-w- c:\windows\system32\dllcache\hpdigwia.dll
2010-09-04 07:20:04 2688 ----a-w- c:\windows\system32\dllcache\hidswvd.sys
2010-09-04 07:18:56 455296 ----a-w- c:\windows\system32\dllcache\fusbbase.sys
2010-09-04 07:18:51 455680 ----a-w- c:\windows\system32\dllcache\fus2base.sys
2010-09-04 07:18:44 442240 ----a-w- c:\windows\system32\dllcache\fpnpbase.sys
2010-09-04 07:18:39 441728 ----a-w- c:\windows\system32\dllcache\fpcmbase.sys
2010-09-04 07:18:35 444416 ----a-w- c:\windows\system32\dllcache\fpcibase.sys
2010-09-04 07:18:33 34173 ----a-w- c:\windows\system32\dllcache\forehe.sys
2010-09-04 07:18:28 71680 ----a-w- c:\windows\system32\dllcache\fnfilter.dll
2010-09-04 07:18:21 27165 ----a-w- c:\windows\system32\dllcache\fetnd5.sys
2010-09-04 07:18:10 22090 ----a-w- c:\windows\system32\dllcache\fem556n5.sys
2010-09-04 07:18:03 24618 ----a-w- c:\windows\system32\dllcache\fa410nd5.sys
2010-09-04 07:18:00 16074 ----a-w- c:\windows\system32\dllcache\fa312nd5.sys
2010-09-04 07:16:59 174464 ----a-w- c:\windows\system32\dllcache\es198x.sys
2010-09-04 07:15:59 455199 ----a-w- c:\windows\system32\dllcache\el985n51.sys
2010-09-04 07:14:57 20192 ----a-w- c:\windows\system32\dllcache\dpti2o.sys
2010-09-04 07:13:59 110621 ----a-w- c:\windows\system32\dllcache\digirlpt.dll
2010-09-04 07:12:58 25600 ----a-w- c:\windows\system32\dllcache\dc210_32.dll
2010-09-04 07:11:59 6912 ----a-w- c:\windows\system32\dllcache\ctlfacem.sys
2010-09-04 07:10:57 838144 ----a-w- c:\windows\system32\dllcache\chtbrkr.dll
2010-09-04 07:08:55 13824 ----a-w- c:\windows\system32\dllcache\bulltlp3.sys
2010-09-04 07:07:59 871388 ----a-w- c:\windows\system32\dllcache\bcmdm.sys
2010-09-04 07:06:59 46464 ----a-w- c:\windows\system32\dllcache\atibt829.sys
2010-09-04 07:05:16 101888 ----a-w- c:\windows\system32\dllcache\adpu160m.sys
2010-09-04 07:05:15 46112 ----a-w- c:\windows\system32\dllcache\adptsf50.sys
2010-09-04 07:05:13 10880 ----a-w- c:\windows\system32\dllcache\admjoy.sys
2010-09-04 07:05:12 747392 ----a-w- c:\windows\system32\dllcache\adm8830.sys
2010-09-04 07:05:11 553984 ----a-w- c:\windows\system32\dllcache\adm8820.sys
2010-09-04 07:05:10 584448 ----a-w- c:\windows\system32\dllcache\adm8810.sys
2010-09-04 07:05:08 20160 ----a-w- c:\windows\system32\dllcache\adm8511.sys
2010-09-04 07:05:07 7424 ----a-w- c:\windows\system32\dllcache\adicvls.sys
2010-09-04 07:05:04 61440 ----a-w- c:\windows\system32\dllcache\acerscad.dll
2010-09-04 07:05:02 84480 ----a-w- c:\windows\system32\dllcache\ac97via.sys
2010-09-04 07:05:01 297728 ----a-w- c:\windows\system32\dllcache\ac97sis.sys
2010-09-04 07:05:00 96256 ----a-w- c:\windows\system32\dllcache\ac97intc.sys
2010-09-04 07:04:59 231552 ----a-w- c:\windows\system32\dllcache\ac97ali.sys
2010-09-04 07:04:58 23552 ----a-w- c:\windows\system32\dllcache\abp480n5.sys
2010-09-04 07:04:57 462848 ----a-w- c:\windows\system32\dllcache\a3dapi.dll
2010-09-04 07:04:56 38400 ----a-w- c:\windows\system32\dllcache\8514a.dll
2010-09-04 07:04:55 48128 ----a-w- c:\windows\system32\dllcache\61883.sys
2010-09-04 07:04:54 12288 ----a-w- c:\windows\system32\dllcache\4mmdat.sys
2010-09-04 07:04:53 148352 ----a-w- c:\windows\system32\dllcache\3dfxvsm.sys
2010-09-04 07:04:52 689216 ----a-w- c:\windows\system32\dllcache\3dfxvs.dll
2010-09-04 07:04:50 762780 ----a-w- c:\windows\system32\dllcache\3cwmcru.sys
2010-09-04 07:04:49 11264 ----a-w- c:\windows\system32\dllcache\1394vdbg.sys
2010-09-04 07:03:28 66048 ----a-w- c:\windows\system32\dllcache\s3legacy.dll
2010-08-28 09:03:36 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-08-28 09:03:35 0 d-----w- c:\docume~1\hpauth~1\applic~1\SUPERAntiSpyware.com
2010-08-28 09:02:57 0 d-----w- c:\program files\SUPERAntiSpyware
2010-08-28 08:57:59 0 d-----w- c:\docume~1\hpauth~1\applic~1\Malwarebytes
2010-08-28 08:57:41 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-28 08:57:34 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-08-28 08:57:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-28 08:57:32 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-26 21:20:15 0 d--h--w- C:\catalog.wci
2010-08-26 04:21:42 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2010-08-26 02:02:41 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-08-25 23:17:47 334 ----a-w- c:\windows\reg.prm
2010-08-25 22:47:02 15824 ----a-r- c:\windows\system32\drivers\hphipr08.sys
2010-08-25 22:47:00 50320 ----a-r- c:\windows\system32\drivers\hphid408.sys
2010-08-25 22:46:57 17904 ----a-r- c:\windows\system32\drivers\hphius08.sys
2010-08-25 22:45:49 57344 ----a-r- c:\windows\system32\hphipm08.exe
2010-08-25 22:45:48 57344 ----a-r- c:\windows\system32\hphipr08.dll
2010-08-25 22:45:43 73728 ----a-r- c:\windows\system32\hphidr08.dll
2010-08-25 22:45:30 49152 ----a-r- c:\windows\system32\hphcin07.dll
2010-08-25 22:45:07 73728 ----a-r- c:\windows\system32\hphload.dll
2010-08-25 20:42:28 0 d-----w- c:\program files\Panda Security
2010-08-24 00:57:02 0 d-sh--w- C:\FOUND.002
2010-08-18 08:04:40 0 d-----w- c:\program files\Citrix

==================== Find3M ====================

2010-09-10 08:20:58 1744 ----a-w- c:\windows\system32\d3d9caps.dat
2010-09-07 15:12:18 38848 ----a-w- c:\windows\avastSS.scr
2010-08-26 19:44:28 31176 ----a-w- c:\docume~1\hpauth~1\applic~1\GDIPFONTCACHEV1.DAT
2010-08-26 02:02:16 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-23 05:20:14 1632 ----a-w- c:\windows\system32\d3d8caps.dat
2010-07-27 06:30:36 8462336 ----a-w- c:\windows\system32\dllcache\shell32.dll
2010-06-30 12:31:36 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-30 12:31:36 149504 ----a-w- c:\windows\system32\dllcache\schannel.dll
2010-06-25 00:51:58 11077120 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-06-24 12:22:04 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 12:22:04 916480 ----a-w- c:\windows\system32\dllcache\wininet.dll
2010-06-24 12:22:04 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-06-24 12:22:02 611840 ----a-w- c:\windows\system32\dllcache\mstime.dll
2010-06-24 12:22:02 5951488 ----a-w- c:\windows\system32\dllcache\mshtml.dll
2010-06-24 12:22:02 206848 ----a-w- c:\windows\system32\dllcache\occache.dll
2010-06-24 12:22:02 1210368 ----a-w- c:\windows\system32\dllcache\urlmon.dll
2010-06-24 12:22:00 599040 ------w- c:\windows\system32\dllcache\msfeeds.dll
2010-06-24 12:22:00 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-06-24 12:22:00 25600 ----a-w- c:\windows\system32\dllcache\jsproxy.dll
2010-06-24 12:21:58 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-06-24 12:21:58 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll
2010-06-24 12:21:58 184320 ----a-w- c:\windows\system32\dllcache\iepeers.dll
2010-06-24 12:21:56 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-24 12:21:56 387584 ----a-w- c:\windows\system32\dllcache\iedkcs32.dll
2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\dllcache\win32k.sys
2010-06-23 12:08:10 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe
2010-06-21 15:27:12 354304 ----a-w- c:\windows\system32\dllcache\srv.sys
2010-06-18 13:36:12 3558912 ----a-w- c:\windows\system32\dllcache\moviemk.exe
2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31:20 744448 ----a-w- c:\windows\system32\dllcache\helpsvc.exe
2010-06-14 07:41:46 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-14 07:41:46 1172480 ----a-w- c:\windows\system32\dllcache\msxml3.dll
2000-11-01 22:51:20 271 --sh--w- c:\program files\desktop.ini
2000-11-01 22:51:20 23357 ---h--w- c:\program files\folder.htt
2004-08-04 19:00:00 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12:08 50688 --sh--w- c:\windows\twain_32.dll
2008-04-14 00:12:02 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12:02 343040 --sh--w- c:\windows\system32\msvcrt.dll
2008-04-14 00:12:02 84992 --sh--w- c:\windows\system32\olepro32.dll
2008-04-14 00:12:32 11776 --sh--w- c:\windows\system32\regsvr32.exe
2008-04-14 00:12:02 413696 --sh--w- c:\windows\system32\msvcp60.dll
2008-04-14 00:12:02 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 00:11:56 1028096 --sh--w- c:\windows\system32\mfc42.dll
2010-05-01 11:31:42 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012010050120100502\index.dat

============= FINISH: 1:34:46.20 ===============

(See 2nd response for second scan below)

ravn87 · 2010/09/10

Scans requested by BRONI- RE: "Hardware Interruptions" - Part 3

DDS Scan Log - Part 2:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/30/2010 7:56:57 AM
System Uptime: 9/8/2010 7:07:33 PM (30 hours ago)
Motherboard: Hewlett-Packard | | HP WMTA System Board
Processor: Intel(R) Pentium(R) 4 CPU 1500MHz | Processor 1 | 1495/mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (FAT32) - 20 GiB total, 9.248 GiB free.
D: is FIXED (FAT32) - 2 GiB total, 1.463 GiB free.
E: is FIXED (FAT32) - 2 GiB total, 1.855 GiB free.
F: is FIXED (NTFS) - 52 GiB total, 52.107 GiB free.
H: is FIXED (NTFS) - 699 GiB total, 611.942 GiB free.
M: is CDROM ()
N: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\3000DBFD309526
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\3000DBFD309526
Service: NIC1394
Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: HP PS2 Keyboard (2K - 3)
Device ID: ACPI\PNP0303\5&1A1D7766&0
Manufacturer: Hewlett-Packard
Name: HP PS2 Keyboard (2K - 3)
PNP Device ID: ACPI\PNP0303\5&1A1D7766&0
Service: i8042prt
==== System Restore Points ===================
RP179: 8/28/2010 4:20:26 AM - System Checkpoint
RP180: 8/29/2010 8:09:20 AM - System Checkpoint
RP181: 8/30/2010 2:59:44 PM - System Checkpoint
RP182: 9/1/2010 7:11:26 AM - System Checkpoint
RP183: 9/2/2010 7:40:13 PM - System Checkpoint
RP184: 9/4/2010 2:41:54 AM - System Checkpoint
RP185: 9/5/2010 9:28:09 AM - System Checkpoint
RP186: 9/6/2010 12:48:34 PM - Software Distribution Service 3.0
RP187: 9/7/2010 2:41:11 PM - System Checkpoint
RP188: 9/8/2010 5:22:43 PM - System Checkpoint
RP189: 9/9/2010 6:20:16 PM - System Checkpoint
==== Installed Programs ======================
Adobe Acrobat 4.0
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.4
Adobe Shockwave Player 11.5
AT&T Self Support Tool
ATT-HSI
avast! Free Antivirus
CCleaner
Citrix XenApp Web Plugin
Creative PCI Audio Drivers
Defraggler
EPSON SMART PANEL for Scanner
ERUNT 1.1j
Google Chrome
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Internet Center
HP Photo Printing Software
hp photosmart 1218 series (Remove only)
HP_WildTangent_Games
InterVideo WinDVD
Java Auto Updater
Java(TM) 6 Update 21
KBD
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.3)
My Photo Center
NTREGOPT 1.1j
Panda ActiveScan 2.0
PC-Doctor for Windows
PeaZip 3.0
PS2
Python 1.5 combined Win32 extensions
Python 1.5.2 (final)
QuickLink III
Remove on Reboot Shell Extension
Revo Uninstaller 1.88
Sandboxie 3.442
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Speccy
SUPERAntiSpyware
Tcl 8.0.5 for Windows
TextBridge Pro 8.0
Trellix Web
Unlocker 1.8.5
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB980182)
WebFldrs XP
Windows Backup Utility
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
Windows XP Uninstall
Works Suite OS Pack
==== Event Viewer Messages From Past Week ========
9/7/2010 5:32:11 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.
9/6/2010 7:22:58 PM, error: Service Control Manager [7034] - The SNMP Service service terminated unexpectedly. It has done this 1 time(s).
9/5/2010 2:08:57 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the avast! Web Scanner service.
9/5/2010 2:08:33 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the avast! Antivirus service.
9/4/2010 9:17:21 PM, error: ACPI [5] - AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0x70), which lies in the 0x70 - 0x71 protected address
range. This could lead to system instability. Please contact your system vendor for technical assistance.
9/4/2010 9:17:21 PM, error: ACPI [4] - AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0x71), which lies in the 0x70 - 0x71 protected address
range. This could lead to system instability. Please contact your system vendor for technical assistance.
9/4/2010 9:17:21 PM, error: ACPI [10] - ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation Region (0x4), Please contact your system vendor for
technical assistance.
9/4/2010 7:15:18 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
9/4/2010 7:15:18 PM, error: Service Control Manager [7034] - The Indexing Service service terminated unexpectedly. It has done this 1 time(s).
9/4/2010 6:17:51 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the dmserver service.
9/4/2010 6:17:51 AM, error: Service Control Manager [7001] - The Logical Disk Manager Administrative Service service depends on the Logical Disk Manager service
which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
9/4/2010 6:17:51 AM, error: Service Control Manager [7000] - The Logical Disk Manager service failed to start due to the following error: The service did not
respond to the start or control request in a timely fashion.
9/4/2010 6:17:51 AM, error: DCOM [10005] - DCOM got error "%1068" attempting to start the service dmadmin with arguments "/com" in order to run the server:
{4FB6BB00-3347-11D0-B40A-00AA005FF586}
9/4/2010 6:13:29 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the BITS service.
9/4/2010 4:34:15 AM, error: Dhcp [1002] - The IP address lease 192.168.1.64 for the Network Card with network address 0010B5C6E383 has been denied by the DHCP
server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
9/4/2010 3:40:36 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the ShellHWDetection service.
9/4/2010 3:40:06 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the SharedAccess service.
9/4/2010 3:39:36 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.
9/4/2010 3:38:35 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
9/4/2010 3:28:05 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the RasMan service.
9/4/2010 3:27:35 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the wuauserv service.
9/4/2010 3:26:35 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the W32Time service.
9/4/2010 3:26:05 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the SENS service.
9/4/2010 3:25:42 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Schedule service.
9/4/2010 2:08:36 AM, information: Windows File Protection [64017] - Windows File Protection file scan completed successfully.
9/4/2010 1:07:00 AM, information: Windows File Protection [64016] - Windows File Protection file scan was started.
==== End Of File ===========================

broni · 2010/09/10

STEP 1. Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
Do NOT use the computer while GMER is running!
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

STEP 3. Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

ravn87 · 2010/09/11

MBR Check, GMER, and MBAM scan results

Hello! I wasn't having very much luck with the hardware scanning, so I took a break- went ahead and did the malware scans. At first I forgot to clean the disk before running MBAM. I already had both MBAM and SAS (Super AntiSpyware) installed so I went ahead and ran both of them in quick-scan mode. Took about 15-20 min. each. But SAS picked up a few things while MBAM ran clean; I have a log saved for both. I rebooted per the instructions for SAS disinfection so I don't think it saved the first scan. I re-cleaned the disk and ran SAS again-this time, also coming up clean. I figured since MBAM came up clean the first time, it would be unnecessary to run it again if SAS came up clean the second go-around. But here's MBAM's pre-clean scan results along with the other scans. Let me know if you wish to see SAS's logfiles as well. =)

ravn87 · 2010/09/11

MBAM and GMER Scan results

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4591

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/10/2010 4:16:53 PM
mbam-log-2010-09-10 (16-16-53).txt

Scan type: Quick scan
Objects scanned: 148480
Time elapsed: 17 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

==========================================
==========================================

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-10 23:32:07
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kxldypog.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

==============================================
==============================================

ravn87 · 2010/09/11

MBR Check scan results

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000030bd

Kernel Drivers (total 70):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF79A9000 \WINDOWS\system32\KDCOM.DLL
0xF78B9000 \WINDOWS\system32\BOOTVID.dll
0xF745A000 ACPI.sys
0xF79AB000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7449000 pci.sys
0xF74A9000 isapnp.sys
0xF74B9000 ohci1394.sys
0xF74C9000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF79AD000 intelide.sys
0xF7729000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF74D9000 MountMgr.sys
0xF742A000 ftdisk.sys
0xF7731000 PartMgr.sys
0xF74E9000 VolSnap.sys
0xF7412000 atapi.sys
0xF74F9000 disk.sys
0xF7509000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73F2000 fltmgr.sys
0xF73E0000 sr.sys
0xF73BC000 Fastfat.sys
0xF73A5000 KSecDD.sys
0xF7378000 NDIS.sys
0xF735E000 Mup.sys
0xF7519000 agp440.sys
0xF7539000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF792D000 \SystemRoot\system32\DRIVERS\PS2.sys
0xF7819000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7829000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7839000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7549000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7559000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7569000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF730A000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7891000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF72BE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7579000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF79B3000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF7260000 \SystemRoot\system32\DRIVERS\update.sys
0xF7949000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7589000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79B7000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF77C9000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF79BB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7BBB000 \SystemRoot\System32\Drivers\Null.SYS
0xF79BF000 \SystemRoot\System32\Drivers\Beep.SYS
0xF77E9000 \SystemRoot\System32\drivers\vga.sys
0xF724C000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0xF7809000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7821000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7769000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF7999000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF75B9000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7781000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF79A1000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF7791000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF7177000 \SystemRoot\System32\Drivers\Ntfs.SYS
0xF7659000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF715F000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79DD000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7969000 \SystemRoot\System32\drivers\Dxapi.sys
0xF77E1000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7B5E000 \SystemRoot\System32\drivers\dxgthk.sys
0xBFF50000 \SystemRoot\System32\framebuf.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF6A28000 \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kxldypog.sys
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 12):
0 System Idle Process
4 System
124 C:\WINDOWS\System32\smss.exe
176 csrss.exe
200 C:\WINDOWS\System32\winlogon.exe
244 C:\WINDOWS\System32\services.exe
256 C:\WINDOWS\System32\lsass.exe
404 C:\WINDOWS\System32\svchost.exe
472 svchost.exe
528 C:\WINDOWS\System32\svchost.exe
752 C:\WINDOWS\Explorer.EXE
1012 C:\Documents and Settings\HP Authorized Custom\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000005`00755e00 (FAT32)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000005`80bc1e00 (FAT32)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000006`0102de00 (NTFS)
\\.\H: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: Maxtor98196H8, Rev: ZAH814Y0
PhysicalDrive1 Model Number: WDMy Book, Rev: 1034

Size Device Name MBR Status
--------------------------------------------
76 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: C7E2E67D9C78E9DFAB92E5F18E04FDCAEF48B11D
698 GB \\.\PhysicalDrive1 RE: Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:

Done!

broni · 2010/09/11

Your MBR seems to be infected.

Run MBRCheck again.

When it's done you'll see the following line:
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Press the Y key and then press Enter

When the program asks you to Enter your choice, enter 2 and press the Enter key.

Next the program will ask you to Enter the physical disk number to fix (0-99, -1 to cancel):
Enter 0 (zero) and press the Enter key.

Next the program will show Available MBR codes:, followed by a list of operating systems.
Please enter 1 for Windows XP, and then press Enter.

Next the program will prompt for confirmation.
Type YES and hit Enter.

When it's done there should be a text file with the results on your desktop.
Please copy and paste it back here.

Then, reboot, run MBRCheck again and post new log.

ravn87 · 2010/09/14

MBR scans redone - Part 1 (the before shot)

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000030bd

Kernel Drivers (total 122):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF79A9000 \WINDOWS\system32\KDCOM.DLL
0xF78B9000 \WINDOWS\system32\BOOTVID.dll
0xF745A000 ACPI.sys
0xF79AB000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7449000 pci.sys
0xF74A9000 isapnp.sys
0xF74B9000 ohci1394.sys
0xF74C9000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF79AD000 intelide.sys
0xF7729000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF74D9000 MountMgr.sys
0xF742A000 ftdisk.sys
0xF7731000 PartMgr.sys
0xF7739000 pavboot.sys
0xF74E9000 VolSnap.sys
0xF7412000 atapi.sys
0xF74F9000 disk.sys
0xF7509000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73F2000 fltmgr.sys
0xF73E0000 sr.sys
0xF73BC000 Fastfat.sys
0xF73A5000 KSecDD.sys
0xF7378000 NDIS.sys
0xF735E000 Mup.sys
0xF7519000 agp440.sys
0xF7539000 \SystemRoot\system32\DRIVERS\processr.sys
0xF7135000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF7121000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7549000 \SystemRoot\system32\drivers\es1371mp.sys
0xF70FD000 \SystemRoot\system32\drivers\portcls.sys
0xF7559000 \SystemRoot\system32\drivers\drmk.sys
0xF70DA000 \SystemRoot\system32\drivers\ks.sys
0xF7779000 \SystemRoot\system32\DRIVERS\RTL8139.SYS
0xF703F000 \SystemRoot\system32\DRIVERS\ltmdmnt.sys
0xF7759000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7569000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7945000 \SystemRoot\system32\DRIVERS\PS2.sys
0xF7781000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7791000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF77A1000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7579000 \SystemRoot\system32\DRIVERS\serial.sys
0xF794D000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF702B000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7589000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7599000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF75A9000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF77F9000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7007000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7BC2000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF75B9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7965000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6FF0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF75C9000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF75D9000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7861000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7871000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7881000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF75E9000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF79B7000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6EF2000 \SystemRoot\system32\DRIVERS\update.sys
0xF797D000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF75F9000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79BB000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7609000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF79A5000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xF77D1000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF79C5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7BF3000 \SystemRoot\System32\Drivers\Null.SYS
0xF79C9000 \SystemRoot\System32\Drivers\Beep.SYS
0xF77F1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7809000 \SystemRoot\System32\drivers\vga.sys
0xF79CD000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79D1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7819000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7829000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF730D000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF3E6F000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF7629000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF3E16000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF7639000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF3DF0000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7649000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF3DC8000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF3DA6000 \SystemRoot\System32\drivers\afd.sys
0xF7659000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF3D84000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF7869000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF7879000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xF3D59000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF3CE9000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7669000 \SystemRoot\System32\Drivers\Fips.SYS
0xF7811000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF3CC2000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF796D000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF7679000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7751000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF7321000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF3B6D000 \SystemRoot\System32\Drivers\Ntfs.SYS
0xF7699000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF3B55000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79E7000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF3E92000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7769000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7BDA000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF7325000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xF3925000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF3608000 \SystemRoot\system32\drivers\wdmaud.sys
0xF384D000 \SystemRoot\system32\drivers\sysaudio.sys
0xF34BD000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7A35000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF347E000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xF317F000 \SystemRoot\system32\DRIVERS\srv.sys
0xF2EBE000 \SystemRoot\System32\Drivers\HTTP.sys
0xF77E1000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xF79F3000 \??\C:\WINDOWS\system32\Drivers\PROCEXP140.SYS
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 33):
0 System Idle Process
4 System
296 C:\WINDOWS\System32\smss.exe
348 csrss.exe
372 C:\WINDOWS\System32\winlogon.exe
416 C:\WINDOWS\System32\services.exe
428 C:\WINDOWS\System32\lsass.exe
572 C:\WINDOWS\System32\svchost.exe
660 svchost.exe
716 C:\WINDOWS\System32\svchost.exe
772 svchost.exe
848 svchost.exe
1036 C:\WINDOWS\Explorer.EXE
1084 C:\WINDOWS\System32\spoolsv.exe
1668 svchost.exe
1728 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1744 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
1752 C:\HP\KBD\KBD.EXE
1768 C:\WINDOWS\System32\hpha2mon.exe
1776 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb01.exe
1848 C:\WINDOWS\System32\OSK.exe
1996 C:\WINDOWS\System32\cisvc.exe
2028 C:\Program Files\Java\jre6\bin\jqs.exe
184 C:\WINDOWS\System32\snmp.exe
188 C:\WINDOWS\System32\svchost.exe
2160 alg.exe
2508 C:\Program Files\SysinternalsSuite\procexp.exe
3456 C:\WINDOWS\System32\cidaemon.exe
3496 C:\WINDOWS\System32\cidaemon.exe
3532 C:\WINDOWS\System32\cidaemon.exe
3932 C:\WINDOWS\System32\cidaemon.exe
1400 C:\WINDOWS\System32\ctfmon.exe
4040 C:\Documents and Settings\HP Authorized Custom\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000005`00755e00 (FAT32)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000005`80bc1e00 (FAT32)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000006`0102de00 (NTFS)
\\.\H: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: Maxtor98196H8, Rev: ZAH814Y0
PhysicalDrive1 Model Number: WDMy Book, Rev: 1034

Size Device Name MBR Status
--------------------------------------------
76 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: C7E2E67D9C78E9DFAB92E5F18E04FDCAEF48B11D
698 GB \\.\PhysicalDrive1 RE: Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel): 0Available MBR codes:
[ 0] Default (Windows XP)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel

Please select the MBR code to write to this drive: 1
Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue: yes
Successfully wrote new MBR code!
Please reboot your computer to complete the fix.

Done!

ravn87 · 2010/09/14

MBR scans redone - Part 2 (the after shot)

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000303d

Kernel Drivers (total 120):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF79A9000 \WINDOWS\system32\KDCOM.DLL
0xF78B9000 \WINDOWS\system32\BOOTVID.dll
0xF745A000 ACPI.sys
0xF79AB000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7449000 pci.sys
0xF74A9000 isapnp.sys
0xF74B9000 ohci1394.sys
0xF74C9000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF79AD000 intelide.sys
0xF7729000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF74D9000 MountMgr.sys
0xF742A000 ftdisk.sys
0xF7731000 PartMgr.sys
0xF7739000 pavboot.sys
0xF74E9000 VolSnap.sys
0xF7412000 atapi.sys
0xF74F9000 disk.sys
0xF7509000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73F2000 fltmgr.sys
0xF73E0000 sr.sys
0xF73BC000 Fastfat.sys
0xF73A5000 KSecDD.sys
0xF7378000 NDIS.sys
0xF735E000 Mup.sys
0xF7519000 agp440.sys
0xF7539000 \SystemRoot\system32\DRIVERS\processr.sys
0xF7135000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF7121000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7549000 \SystemRoot\system32\drivers\es1371mp.sys
0xF70FD000 \SystemRoot\system32\drivers\portcls.sys
0xF7559000 \SystemRoot\system32\drivers\drmk.sys
0xF70DA000 \SystemRoot\system32\drivers\ks.sys
0xF7779000 \SystemRoot\system32\DRIVERS\RTL8139.SYS
0xF703F000 \SystemRoot\system32\DRIVERS\ltmdmnt.sys
0xF7759000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7569000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7945000 \SystemRoot\system32\DRIVERS\PS2.sys
0xF7781000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7791000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF77A1000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7579000 \SystemRoot\system32\DRIVERS\serial.sys
0xF794D000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF702B000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7589000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7599000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF75A9000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF77F9000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7007000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7BBE000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF75B9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7965000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6FF0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF75C9000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF75D9000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7861000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7871000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7881000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF75E9000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF79B7000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6EF2000 \SystemRoot\system32\DRIVERS\update.sys
0xF797D000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF75F9000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79BB000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7609000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF79A5000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xF77D1000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF79C5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7BEF000 \SystemRoot\System32\Drivers\Null.SYS
0xF79C9000 \SystemRoot\System32\Drivers\Beep.SYS
0xF77F1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7809000 \SystemRoot\System32\drivers\vga.sys
0xF79CD000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79D1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7819000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7829000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF730D000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF3E6F000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF7629000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF3E16000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF7639000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF3DF0000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7649000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF3DC8000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF3DA6000 \SystemRoot\System32\drivers\afd.sys
0xF7659000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF3D84000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF7859000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xF3D59000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF3CE9000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7669000 \SystemRoot\System32\Drivers\Fips.SYS
0xF3CC2000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF7891000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF77D9000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF79A1000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF7689000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7321000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF3C0D000 \SystemRoot\System32\Drivers\Ntfs.SYS
0xF3BAD000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF3B55000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7A6F000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF3E96000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7879000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7BB3000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF3E82000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xF390D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF36D0000 \SystemRoot\system32\drivers\wdmaud.sys
0xF39AD000 \SystemRoot\system32\drivers\sysaudio.sys
0xF317D000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79E9000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF3166000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xF2E67000 \SystemRoot\system32\DRIVERS\srv.sys
0xF2B06000 \SystemRoot\System32\Drivers\HTTP.sys
0xF77E9000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 33):
0 System Idle Process
4 System
296 C:\WINDOWS\System32\smss.exe
348 csrss.exe
372 C:\WINDOWS\System32\winlogon.exe
416 C:\WINDOWS\System32\services.exe
428 C:\WINDOWS\System32\lsass.exe
576 C:\WINDOWS\System32\svchost.exe
672 svchost.exe
712 C:\WINDOWS\System32\svchost.exe
768 svchost.exe
836 svchost.exe
1016 C:\WINDOWS\System32\spoolsv.exe
1100 C:\WINDOWS\Explorer.EXE
1516 svchost.exe
1612 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1664 C:\WINDOWS\System32\cisvc.exe
1740 C:\Program Files\Java\jre6\bin\jqs.exe
1752 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
1836 C:\WINDOWS\System32\snmp.exe
1876 C:\HP\KBD\KBD.EXE
1892 C:\WINDOWS\System32\svchost.exe
1936 C:\WINDOWS\System32\hpha2mon.exe
1980 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb01.exe
2004 C:\WINDOWS\System32\ctfmon.exe
2012 C:\WINDOWS\System32\OSK.exe
156 C:\WINDOWS\System32\MSSWCHX.EXE
2168 alg.exe
2780 C:\WINDOWS\System32\cidaemon.exe
2796 C:\WINDOWS\System32\cidaemon.exe
2840 C:\WINDOWS\System32\cidaemon.exe
3044 C:\WINDOWS\System32\cidaemon.exe
3676 C:\Documents and Settings\HP Authorized Custom\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000005`00755e00 (FAT32)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000005`80bc1e00 (FAT32)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000006`0102de00 (NTFS)

PhysicalDrive0 Model Number: Maxtor98196H8, Rev: ZAH814Y0

Size Device Name MBR Status
--------------------------------------------
76 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: C7E2E67D9C78E9DFAB92E5F18E04FDCAEF48B11D

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

broni · 2010/09/14

Unfortunately, our fix didn't work, so we have use another way...

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)

Place a blank CD in your CD drive.

Double click on NTBR_CD.exe file and a folder of the same name will appear.

Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.

Follow the prompts to burn the CD.

Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)

If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.

Insert the newly created CD into your infected PC and reboot your computer.

Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!

Read the warning and then continue as prompted.

You first need to select your keyboard layout - press Enter for English.

Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK

On the following screen enter 5 to select Install Standard MBR code.

Enter 1 to overwrite the infected MBR Code with the Standard MBR code.

When asked to confirm please do so.

Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.

Eject the disc and then press ctrl+alt+del to reboot the PC.

Once rebooted, run MBRCheck again and post its log.

ravn87 · 2010/09/15

NTBR: MBR Scan results: green = good?

Ok, so I followed the directions to a T...aaaand it came up green "Windows XP MBR detected." is that what we want?

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000303d

Kernel Drivers (total 123):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF79A9000 \WINDOWS\system32\KDCOM.DLL
0xF78B9000 \WINDOWS\system32\BOOTVID.dll
0xF745A000 ACPI.sys
0xF79AB000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7449000 pci.sys
0xF74A9000 isapnp.sys
0xF74B9000 ohci1394.sys
0xF74C9000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF79AD000 intelide.sys
0xF7729000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF74D9000 MountMgr.sys
0xF742A000 ftdisk.sys
0xF7731000 PartMgr.sys
0xF7739000 pavboot.sys
0xF74E9000 VolSnap.sys
0xF7412000 atapi.sys
0xF74F9000 disk.sys
0xF7509000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73F2000 fltmgr.sys
0xF73E0000 sr.sys
0xF73BC000 Fastfat.sys
0xF73A5000 KSecDD.sys
0xF7378000 NDIS.sys
0xF735E000 Mup.sys
0xF7519000 agp440.sys
0xF76D9000 \SystemRoot\system32\DRIVERS\processr.sys
0xF7135000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF7121000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF76F9000 \SystemRoot\system32\drivers\es1371mp.sys
0xF70FD000 \SystemRoot\system32\drivers\portcls.sys
0xF7709000 \SystemRoot\system32\drivers\drmk.sys
0xF70DA000 \SystemRoot\system32\drivers\ks.sys
0xF7769000 \SystemRoot\system32\DRIVERS\RTL8139.SYS
0xF702D000 \SystemRoot\system32\DRIVERS\ltmdmnt.sys
0xF7781000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7719000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7979000 \SystemRoot\system32\DRIVERS\PS2.sys
0xF7789000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7791000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7799000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7539000 \SystemRoot\system32\DRIVERS\serial.sys
0xF797D000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF6BDF000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7549000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7559000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7569000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF77A1000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6BBB000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7AD4000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7599000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7991000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6ADC000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF75A9000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF75B9000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77B1000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF77B9000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF77C1000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF75C9000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF79D1000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6A63000 \SystemRoot\system32\DRIVERS\update.sys
0xF799D000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7609000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79D5000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7619000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF69D9000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xF5BD6000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7A37000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A9C000 \SystemRoot\System32\Drivers\Null.SYS
0xF7A39000 \SystemRoot\System32\Drivers\Beep.SYS
0xF4D54000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF4D44000 \SystemRoot\System32\drivers\vga.sys
0xF7A3D000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7A3F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF4D3C000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF4D34000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7975000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEFBD0000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF7639000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xEFB77000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF7649000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xEFB27000 \SystemRoot\system32\DRIVERS\netbt.sys
0xEFB05000 \SystemRoot\System32\drivers\afd.sys
0xF7579000 \SystemRoot\system32\DRIVERS\netbios.sys
0xEFA40000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF7759000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xEFA15000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEF9A5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7659000 \SystemRoot\System32\Drivers\Fips.SYS
0xEF97F000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7679000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xEF2DE000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF77D9000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xEF251000 \SystemRoot\System32\Drivers\Ntfs.SYS
0xF5101000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xEF239000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7A5F000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEFB63000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7831000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF4D85000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xEF866000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xEFB5F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xEE245000 \SystemRoot\system32\drivers\wdmaud.sys
0xF76C9000 \SystemRoot\system32\drivers\sysaudio.sys
0xEDF68000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7A59000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEDF29000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xEDDE2000 \SystemRoot\system32\DRIVERS\srv.sys
0xEE4FC000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF5BF6000 \SystemRoot\system32\DRIVERS\hphius08.sys
0xEDD8E000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xEE08D000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xEDEC1000 \SystemRoot\system32\DRIVERS\hphid408.sys
0xEDD7A000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xEDD6A000 \SystemRoot\system32\DRIVERS\hphipr08.sys
0xEDB21000 \SystemRoot\System32\Drivers\HTTP.sys
0xF7809000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 30):
0 System Idle Process
4 System
300 C:\WINDOWS\System32\SMSS.EXE
348 CSRSS.EXE
380 C:\WINDOWS\System32\WINLOGON.EXE
424 C:\WINDOWS\System32\SERVICES.EXE
436 C:\WINDOWS\System32\LSASS.EXE
580 C:\WINDOWS\System32\SVCHOST.EXE
628 SVCHOST.EXE
668 C:\WINDOWS\System32\SVCHOST.EXE
720 SVCHOST.EXE
784 SVCHOST.EXE
988 C:\WINDOWS\System32\SPOOLSV.EXE
1104 C:\WINDOWS\EXPLORER.EXE
1296 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
1304 C:\HP\KBD\KBD.EXE
1324 C:\WINDOWS\System32\HPHA2MON.EXE
1348 C:\WINDOWS\System32\SPOOL\DRIVERS\W32X86\3\HPZTSB01.EXE
1364 C:\WINDOWS\System32\CTFMON.EXE
1504 SVCHOST.EXE
1588 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1604 C:\WINDOWS\System32\CISVC.EXE
1636 C:\Program Files\Java\JRE6\BIN\JQS.EXE
1720 C:\WINDOWS\System32\SNMP.EXE
1752 C:\WINDOWS\System32\SVCHOST.EXE
2000 C:\WINDOWS\System32\wuauclt.exe
2228 alg.exe
2492 wmiprvse.exe
2552 C:\Documents and Settings\HP Authorized Custom\Desktop\MBRCheck.exe
2588 C:\Program Files\Alwil Software\Avast5\Setup\avast.setup

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000005`00755e00 (FAT32)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000005`80bc1e00 (FAT32)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000006`0102de00 (NTFS)

PhysicalDrive0 Model Number: Maxtor98196H8, Rev: ZAH814Y0

Size Device Name MBR Status
--------------------------------------------
76 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!

broni · 2010/09/15

Yes sir

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

ravn87 · 2010/09/17

FINALLY! Got it right...what a )*$#&%)*$^%&

OKKAAAAAYYYY....Well THAT was an educational experience, *sigh* hahaha. MAN- I totally swore I was gonna get the BSo'*(&( Death after this sucker got through. You disable all protection, which it yells at you for before it starts anything the FIRST go-around...and I diiiid! But it NEEDS internet connection to download the MS Recov.-Con. ....BUT W-I-T-H-OOUUUUT the protection.... You get freakin' attacked. haha. So there's a bit of a "conflict of interest" there. But here it is...iiiit's... done. It's complete. *nod*
.....I think it went well.... *thoughtfully*

One question: would it be pointless to run the disk cleaners at all for whatever mess COMBOFIX removed? I mean, aaare there any left over null pieces remaining, or does it usually do a good job of cleaning up after itself? Would it harm the system at ALL trying to just do regular maintenance after CF?

======================================================

ComboFix 10-09-16.04 - HP Authorized Custom 09/17/2010 0:54.1.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.383.187 [GMT -7:00]
Running from: c:\documents and settings\HP Authorized Custom\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Logo.sys
c:\windows\start.exe
c:\windows\system32\ps2.bat
c:\windows\system32\windows.scr

.
((((((((((((((((((((((((( Files Created from 2010-08-17 to 2010-09-17 )))))))))))))))))))))))))))))))
.

2010-09-17 07:34 . 2010-09-17 07:34 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-17 07:34 . 2010-09-17 07:34 -------- d-----w- c:\documents and settings\HP Authorized Custom\Application Data\SUPERAntiSpyware.com
2010-09-17 07:34 . 2010-09-17 07:34 -------- d-----w- c:\documents and settings\HP Authorized Custom\Application Data\SUPERAntiSpyware.com
2010-09-17 07:34 . 2010-09-17 07:34 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-04 12:00 . 2010-09-04 12:00 -------- d-----w- c:\windows\wt
2010-09-04 08:04 . 2008-04-14 00:12 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-09-04 08:04 . 2001-08-18 05:36 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-09-04 08:04 . 2008-04-14 00:12 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-09-04 08:04 . 2001-08-18 05:37 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-09-04 08:04 . 2001-08-18 05:37 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-09-04 08:04 . 2001-08-18 05:37 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe
2010-09-04 08:03 . 2001-08-17 19:11 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-09-04 08:03 . 2004-08-04 05:29 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-09-04 08:03 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2010-09-04 08:03 . 2004-08-04 05:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-09-04 08:03 . 2008-04-14 00:12 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll
2010-09-04 08:02 . 2008-04-13 18:36 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-09-04 08:02 . 2004-08-04 05:31 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-09-04 08:02 . 2001-08-17 19:12 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-09-04 08:01 . 2001-08-17 20:28 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys
2010-09-04 08:01 . 2001-08-18 05:36 53760 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll
2010-09-04 08:01 . 2001-08-18 05:36 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-09-04 08:01 . 2001-08-17 20:28 701386 ----a-w- c:\windows\system32\dllcache\wdhaalba.sys
2010-09-04 08:01 . 2004-08-04 05:29 23615 ----a-w- c:\windows\system32\dllcache\wch7xxnt.sys
2010-09-04 08:01 . 2008-04-13 18:45 31744 ----a-w- c:\windows\system32\dllcache\wceusbsh.sys
2010-09-04 08:01 . 2001-08-17 19:10 35871 ----a-w- c:\windows\system32\dllcache\wbfirdma.sys
2010-09-04 08:00 . 2004-08-04 05:29 33599 ----a-w- c:\windows\system32\dllcache\watv04nt.sys
2010-09-04 08:00 . 2004-08-04 05:29 19551 ----a-w- c:\windows\system32\dllcache\watv02nt.sys
2010-09-04 08:00 . 2004-08-04 05:29 29311 ----a-w- c:\windows\system32\dllcache\watv01nt.sys
2010-09-04 08:00 . 2004-08-04 05:29 11775 ----a-w- c:\windows\system32\dllcache\wadv05nt.sys
2010-09-04 08:00 . 2004-08-04 05:29 12127 ----a-w- c:\windows\system32\dllcache\wadv02nt.sys
2010-09-04 08:00 . 2004-08-04 05:29 12415 ----a-w- c:\windows\system32\dllcache\wadv01nt.sys
2010-09-04 08:00 . 2001-08-17 19:13 16925 ----a-w- c:\windows\system32\dllcache\w940nd.sys
2010-09-04 08:00 . 2001-08-17 19:13 19016 ----a-w- c:\windows\system32\dllcache\w926nd.sys
2010-09-04 08:00 . 2001-08-17 19:13 19528 ----a-w- c:\windows\system32\dllcache\w840nd.sys
2010-09-04 08:00 . 2001-08-17 20:28 64605 ----a-w- c:\windows\system32\dllcache\vvoice.sys
2010-09-04 08:00 . 2001-08-17 20:28 397502 ----a-w- c:\windows\system32\dllcache\vpctcom.sys
2010-09-04 07:59 . 2001-08-17 20:28 604253 ----a-w- c:\windows\system32\dllcache\vmodem.sys
2010-09-04 07:59 . 2001-08-17 19:14 249402 ----a-w- c:\windows\system32\dllcache\vinwm.sys
2010-09-04 07:59 . 2001-08-17 20:49 24576 ----a-w- c:\windows\system32\dllcache\viairda.sys
2010-09-04 07:59 . 2008-04-13 18:40 5376 ----a-w- c:\windows\system32\dllcache\viaide.sys
2010-09-04 07:59 . 2008-04-14 00:12 53760 ----a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-09-04 07:59 . 2001-08-17 20:28 687999 ----a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2010-09-04 07:59 . 2001-08-17 20:28 765884 ----a-w- c:\windows\system32\dllcache\usrti.sys
2010-09-04 07:59 . 2001-08-17 20:28 113762 ----a-w- c:\windows\system32\dllcache\usrpda.sys
2010-09-04 07:59 . 2001-08-17 20:28 7556 ----a-w- c:\windows\system32\dllcache\usroslba.sys
2010-09-04 07:58 . 2001-08-17 20:28 224802 ----a-w- c:\windows\system32\dllcache\usr1807a.sys
2010-09-04 07:58 . 2001-08-17 20:28 794399 ----a-w- c:\windows\system32\dllcache\usr1806v.sys
2010-09-04 07:58 . 2001-08-17 20:28 793598 ----a-w- c:\windows\system32\dllcache\usr1806.sys
2010-09-04 07:58 . 2001-08-17 20:28 794654 ----a-w- c:\windows\system32\dllcache\usr1801.sys
2010-09-04 07:58 . 2008-04-13 18:45 26112 ----a-w- c:\windows\system32\dllcache\usbser.sys
2010-09-04 07:58 . 2008-04-13 18:45 17152 ----a-w- c:\windows\system32\dllcache\usbohci.sys
2010-09-04 07:58 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-09-04 07:58 . 2004-08-04 05:31 32384 ----a-w- c:\windows\system32\dllcache\usb101et.sys
2010-09-04 07:58 . 2001-08-18 05:36 94720 ----a-w- c:\windows\system32\dllcache\umaxud32.dll
2010-09-04 07:58 . 2001-08-18 05:36 28160 ----a-w- c:\windows\system32\dllcache\umaxu40.dll
2010-09-04 07:57 . 2001-08-18 05:36 26624 ----a-w- c:\windows\system32\dllcache\umaxu22.dll
2010-09-04 07:57 . 2001-08-18 05:36 69632 ----a-w- c:\windows\system32\dllcache\umaxu12.dll
2010-09-04 07:57 . 2001-08-18 05:36 50688 ----a-w- c:\windows\system32\dllcache\umaxscan.dll
2010-09-04 07:57 . 2001-08-17 20:58 22912 ----a-w- c:\windows\system32\dllcache\umaxpcls.sys
2010-09-04 07:57 . 2001-08-18 05:36 50176 ----a-w- c:\windows\system32\dllcache\umaxp60.dll
2010-09-04 07:57 . 2001-08-18 05:36 47616 ----a-w- c:\windows\system32\dllcache\umaxcam.dll
2010-09-04 07:57 . 2001-08-18 05:36 211968 ----a-w- c:\windows\system32\dllcache\um54scan.dll
2010-09-04 07:57 . 2001-08-18 05:36 216064 ----a-w- c:\windows\system32\dllcache\um34scan.dll
2010-09-04 07:57 . 2001-08-17 20:52 36736 ----a-w- c:\windows\system32\dllcache\ultra.sys
2010-09-04 07:56 . 2001-08-17 20:48 11520 ----a-w- c:\windows\system32\dllcache\twotrack.sys
2010-09-04 07:56 . 2001-08-17 19:51 166784 ----a-w- c:\windows\system32\dllcache\tridxpm.sys
2010-09-04 07:56 . 2001-08-18 05:36 525568 ----a-w- c:\windows\system32\dllcache\tridxp.dll
2010-09-04 07:56 . 2001-08-17 19:51 159232 ----a-w- c:\windows\system32\dllcache\tridkbm.sys
2010-09-04 07:56 . 2001-08-17 21:56 440576 ----a-w- c:\windows\system32\dllcache\tridkb.dll
2010-09-04 07:56 . 2001-08-17 19:51 222336 ----a-w- c:\windows\system32\dllcache\trid3dm.sys
2010-09-04 07:56 . 2001-08-17 21:56 315520 ----a-w- c:\windows\system32\dllcache\trid3d.dll
2010-09-04 07:56 . 2001-08-17 19:12 34375 ----a-w- c:\windows\system32\dllcache\tpro4.sys
2010-09-04 07:55 . 2001-08-18 05:35 42496 ----a-w- c:\windows\system32\dllcache\tp4res.dll
2010-09-04 07:55 . 2008-04-14 00:12 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe
2010-09-04 07:55 . 2001-08-18 05:36 31744 ----a-w- c:\windows\system32\dllcache\tp4.dll
2010-09-04 07:55 . 2001-08-17 20:51 4992 ----a-w- c:\windows\system32\dllcache\toside.sys
2010-09-04 07:55 . 2001-08-17 21:02 230912 ----a-w- c:\windows\system32\dllcache\tosdvd03.sys
2010-09-04 07:55 . 2001-08-17 21:01 241664 ----a-w- c:\windows\system32\dllcache\tosdvd02.sys
2010-09-04 07:55 . 2001-08-17 19:10 28232 ----a-w- c:\windows\system32\dllcache\tos4mo.sys
2010-09-04 07:55 . 2001-08-17 19:14 123995 ----a-w- c:\windows\system32\dllcache\tjisdn.sys
2010-09-04 07:54 . 2001-08-17 19:51 138528 ----a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2010-09-04 07:54 . 2001-08-17 21:56 81408 ----a-w- c:\windows\system32\dllcache\tgiul50.dll
2010-09-04 07:54 . 2008-04-13 18:40 149376 ----a-w- c:\windows\system32\dllcache\tffsport.sys
2010-09-04 07:54 . 2001-08-17 19:13 17129 ----a-w- c:\windows\system32\dllcache\tdkcd31.sys
2010-09-04 07:54 . 2001-08-17 19:13 37961 ----a-w- c:\windows\system32\dllcache\tdk100b.sys
2010-09-04 07:54 . 2001-08-17 20:49 30464 ----a-w- c:\windows\system32\dllcache\tbatm155.sys
2010-09-04 07:54 . 2001-08-17 20:52 7040 ----a-w- c:\windows\system32\dllcache\tandqic.sys
2010-09-04 07:54 . 2001-08-17 19:50 36640 ----a-w- c:\windows\system32\dllcache\t2r4mini.sys
2010-09-04 07:53 . 2001-08-17 21:56 172768 ----a-w- c:\windows\system32\dllcache\t2r4disp.dll
2010-09-04 07:53 . 2001-08-17 21:07 32640 ----a-w- c:\windows\system32\dllcache\symc8xx.sys
2010-09-04 07:53 . 2001-08-17 21:07 16256 ----a-w- c:\windows\system32\dllcache\symc810.sys
2010-09-04 07:53 . 2001-08-17 21:07 30688 ----a-w- c:\windows\system32\dllcache\sym_u3.sys
2010-09-04 07:53 . 2001-08-17 21:07 28384 ----a-w- c:\windows\system32\dllcache\sym_hi.sys
2010-09-04 07:53 . 2001-08-18 05:36 94293 ----a-w- c:\windows\system32\dllcache\sxports.dll
2010-09-04 07:53 . 2001-08-17 20:50 103936 ----a-w- c:\windows\system32\dllcache\sx.sys
2010-09-04 07:53 . 2001-08-17 21:02 3968 ----a-w- c:\windows\system32\dllcache\swusbflt.sys
2010-09-04 07:53 . 2001-08-18 05:36 10240 ----a-w- c:\windows\system32\dllcache\swpidflt.dll
2010-09-04 07:52 . 2001-08-18 05:36 10240 ----a-w- c:\windows\system32\dllcache\swpdflt2.dll
2010-09-04 07:52 . 2001-08-18 05:36 53760 ----a-w- c:\windows\system32\dllcache\sw_wheel.dll
2010-09-04 07:52 . 2001-08-18 05:36 41472 ----a-w- c:\windows\system32\dllcache\sw_effct.dll
2010-09-04 07:52 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\dllcache\streamip.sys
2010-09-04 07:52 . 2001-08-18 05:36 155648 ----a-w- c:\windows\system32\dllcache\stlnprop.dll
2010-09-04 07:52 . 2001-08-18 05:36 53248 ----a-w- c:\windows\system32\dllcache\stlncoin.dll
2010-09-04 07:52 . 2001-08-17 19:18 285760 ----a-w- c:\windows\system32\dllcache\stlnata.sys
2010-09-04 07:52 . 2001-08-17 20:51 16896 ----a-w- c:\windows\system32\dllcache\stcusb.sys
2010-09-04 07:52 . 2001-08-17 19:11 48736 ----a-w- c:\windows\system32\dllcache\srwlnd5.sys
2010-09-04 07:51 . 2001-08-18 05:36 99328 ----a-w- c:\windows\system32\dllcache\srusd.dll
2010-09-04 07:51 . 2001-08-18 05:36 24660 ----a-w- c:\windows\system32\dllcache\spxupchk.dll
2010-09-04 07:51 . 2001-08-17 20:51 61824 ----a-w- c:\windows\system32\dllcache\speed.sys
2010-09-04 07:51 . 2001-08-18 05:36 106584 ----a-w- c:\windows\system32\dllcache\spdports.dll
2010-09-04 07:51 . 2001-08-17 21:07 19072 ----a-w- c:\windows\system32\dllcache\sparrow.sys
2010-09-04 07:51 . 2001-08-17 20:56 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys
2010-09-04 07:51 . 2001-08-17 19:51 37040 ----a-w- c:\windows\system32\dllcache\sonypi.sys
2010-09-04 07:51 . 2001-08-18 05:36 114688 ----a-w- c:\windows\system32\dllcache\sonypi.dll
2010-09-04 07:50 . 2001-08-17 19:51 20752 ----a-w- c:\windows\system32\dllcache\sonync.sys
2010-09-04 07:50 . 2001-08-17 20:53 9600 ----a-w- c:\windows\system32\dllcache\sonymc.sys
2010-09-04 07:50 . 2008-04-13 18:40 7552 ----a-w- c:\windows\system32\dllcache\sonyait.sys
2010-09-04 07:50 . 2004-08-04 12:00 143422 ----a-w- c:\windows\system32\dllcache\softkey.dll
2010-09-04 07:50 . 2001-08-17 20:53 7040 ----a-w- c:\windows\system32\dllcache\snyaitmc.sys
2010-09-04 07:50 . 2001-08-17 19:51 58368 ----a-w- c:\windows\system32\dllcache\smiminib.sys
2010-09-04 07:50 . 2001-08-17 21:56 147200 ----a-w- c:\windows\system32\dllcache\smidispb.dll
2010-09-04 07:50 . 2001-08-17 19:12 25034 ----a-w- c:\windows\system32\dllcache\smcpwr2n.sys
2010-09-04 07:50 . 2001-08-17 19:10 35913 ----a-w- c:\windows\system32\dllcache\smcirda.sys
2010-09-04 07:49 . 2001-08-17 19:12 24576 ----a-w- c:\windows\system32\dllcache\smc8000n.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-17 00:25 . 2010-05-02 01:33 1744 ----a-w- c:\windows\system32\d3d9caps.dat
2010-09-07 15:12 . 2010-06-29 07:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-05-01 06:19 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-05-01 06:19 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-05-01 06:19 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-05-01 06:19 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-05-01 06:19 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2010-05-01 06:19 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2010-05-01 06:19 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2010-05-01 06:19 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-08-26 02:02 . 2010-05-02 01:32 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-23 05:20 . 2010-05-01 01:26 1632 ----a-w- c:\windows\system32\d3d8caps.dat
2010-08-18 02:00 . 2010-08-20 09:38 1127992 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\Installer\setup.exe
2010-08-18 01:57 . 2010-08-20 09:38 216120 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\Locales\sr.dll
2010-08-18 01:56 . 2010-08-20 09:38 3184184 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\gears.dll
2010-08-18 01:56 . 2010-08-20 09:38 8760 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\chrome_launcher.exe
2010-08-18 01:56 . 2010-08-20 09:38 17939512 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\chrome.dll
2010-08-18 01:56 . 2010-08-20 09:38 71224 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\avutil-50.dll
2010-08-18 01:56 . 2010-08-20 09:38 151608 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\avformat-52.dll
2010-08-18 01:56 . 2010-08-20 09:38 1186360 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\avcodec-52.dll
2010-08-18 00:26 . 2010-08-20 09:38 5964752 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.127\gcswf32.dll
2010-08-17 13:17 . 2010-04-30 14:18 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-06 19:57 . 2010-08-06 19:57 503808 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4c936e58-n\msvcp71.dll
2010-08-06 19:57 . 2010-08-06 19:57 499712 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4c936e58-n\jmc.dll
2010-08-06 19:57 . 2010-08-06 19:57 348160 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4c936e58-n\msvcr71.dll
2010-08-06 19:57 . 2010-08-06 19:57 61440 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-6f646eac-n\decora-sse.dll
2010-08-06 19:57 . 2010-08-06 19:57 12800 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-6f646eac-n\decora-d3d.dll
2010-07-31 00:19 . 2010-08-11 02:39 1127992 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Installer\setup.exe
2010-07-31 00:18 . 2010-08-11 02:38 111672 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\rlz.dll
2010-07-31 00:18 . 2010-08-11 02:38 1154616 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\npchrome_frame.dll
2010-07-31 00:18 . 2010-08-11 02:38 1133624 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\nacl64.exe
2010-07-31 00:18 . 2010-08-11 02:38 2158136 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\nacl64.dll
2010-07-31 00:18 . 2010-08-11 02:39 100920 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Locales\zh-TW.dll
2010-07-31 00:18 . 2010-08-11 02:39 100920 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Locales\zh-CN.dll
2010-07-31 00:18 . 2010-08-11 02:39 197176 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Locales\vi.dll
2010-07-31 00:18 . 2010-08-11 02:39 218168 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Locales\uk.dll
2010-07-31 00:18 . 2010-08-11 02:39 189496 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Locales\tr.dll
2010-07-31 00:18 . 2010-08-11 02:39 234040 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Locales\th.dll
2010-07-31 00:16 . 2010-08-11 02:39 102456 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\Locales\am.dll
2010-07-31 00:16 . 2010-08-11 02:38 10911800 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\icudt42.dll
2010-07-31 00:16 . 2010-08-11 02:38 3184184 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\gears.dll
2010-07-31 00:16 . 2010-08-11 02:38 8760 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\chrome_launcher.exe
2010-07-31 00:16 . 2010-08-11 02:38 17938488 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\chrome.dll
2010-07-31 00:16 . 2010-08-11 02:38 71224 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\avutil-50.dll
2010-07-31 00:16 . 2010-08-11 02:38 151608 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\avformat-52.dll
2010-07-31 00:16 . 2010-08-11 02:38 1186360 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\avcodec-52.dll
2010-07-30 22:36 . 2010-08-11 02:38 5964752 ----a-w- c:\documents and settings\HP Authorized Custom\Application Data\Google\Chrome\Application\5.0.375.126\gcswf32.dll
2010-07-30 01:44 . 2010-07-30 01:44 -------- d-----w- c:\program files\MSECache
2010-07-22 15:49 . 2010-04-30 14:17 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2010-05-01 09:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:31 . 2010-04-30 14:17 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2010-04-30 14:19 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2010-04-30 14:18 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2010-04-30 14:18 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2000-11-01 22:51 . 1980-01-01 07:00 23357 ---h--w- c:\program files\folder.htt
2004-08-04 19:00 . 2010-04-30 14:18 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12 . 2010-04-30 14:18 50688 --sh--w- c:\windows\twain_32.dll
2010-05-01 23:07 . 2010-05-01 23:07 0 --sha-w- c:\windows\DRM\Cache\Indiv01.tmp
2008-04-14 00:12 . 2010-04-30 14:17 551936 --sh--w- c:\windows\SYSTEM32\oleaut32.dll
2008-04-14 00:12 . 2010-04-30 14:16 343040 --sh--w- c:\windows\SYSTEM32\msvcrt.dll
2008-04-14 00:12 . 2010-04-30 14:17 84992 --sh--w- c:\windows\SYSTEM32\olepro32.dll
2008-04-14 00:12 . 2010-04-30 14:17 11776 --sh--w- c:\windows\SYSTEM32\regsvr32.exe
2008-04-14 00:12 . 2010-04-30 14:16 413696 --sh--w- c:\windows\SYSTEM32\msvcp60.dll
2008-04-14 00:12 . 2010-04-30 14:16 57344 --sh--w- c:\windows\SYSTEM32\msvcirt.dll
2008-04-14 00:11 . 2010-04-30 14:16 1028096 --sh--w- c:\windows\SYSTEM32\mfc42.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"KBD "= "c:\hp\KBD\KBD.EXE" [2001-07-06 61440]
"PS2 "= "c:\windows\system32\ps2.exe" [2001-07-03 81920]
"HPHA2MON "= "c:\windows\system32\hpha2mon.exe" [2000-08-18 69632]
"HPDJ Taskbar Utility "= "c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-08-18 192512]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON SMART PANEL for Scanner.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EPSON SMART PANEL for Scanner.lnk
backup=c:\windows\pss\EPSON SMART PANEL for Scanner.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTMSG]
LTMSG.exe 7 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\documents and settings\HP Authorized Custom\Application Data\Google\Update\GoogleUpdate.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpfsched]
2000-08-18 15:20 36864 ----a-w- c:\windows\hpfsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegisterDropHandler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 18:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WIAWizardMenu]
2008-04-14 00:12 136704 ----a-w- c:\windows\SYSTEM32\sti_ci.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc "=3 (0x3)
"SbieSvc "=2 (0x2)
"McciCMService "=2 (0x2)
"idsvc "=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile "=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"MMTray "=
"hpsysdrv "=c:\windows\SYSTEM32\hpsysdrv.exe
"Delay "=c:\windows\delayrun.exe
"MotiveMonitor "=c:\program files\Motive\motmon.exe
"WorksFUD "=c:\program files\Microsoft Works\wkfud.exe
"USBMMKBD "=usbmmkbd.exe
"Hidserv "=Hidserv.exe run
"HPLogiFinder "=\WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
"HPStart "=c:\hp\hpcoach\hpstart.wsf

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\WINDOWS\\system32\\mmc.exe "=

R0 pavboot;pavboot;c:\windows\SYSTEM32\DRIVERS\pavboot.sys [8/25/2010 9:21 PM 28552]
R1 aswSP;aswSP;c:\windows\SYSTEM32\DRIVERS\aswSP.sys [4/30/2010 11:19 PM 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\SYSTEM32\DRIVERS\aswFsBlk.sys [4/30/2010 11:19 PM 17744]

--- Other Services/Drivers In Memory ---

*Deregistered* - PROCEXP140

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-09-17 c:\windows\Tasks\User_Feed_Synchronization-{A00A74B8-F50F-4E6E-952F-48837BDFDE7E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = localhost
Trusted Zone: motive.com\patttbc.att
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
DPF: Win32 Classes
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
Notify-!SASWinLogon - c:\program files\SUPERAntiSpyware\SASWINLO.DLL

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-17 01:01
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
Completion time: 2010-09-17 01:04:18
ComboFix-quarantined-files.txt 2010-09-17 08:04
ComboFix2.txt 2010-09-17 07:06

Pre-Run: 9,542,090,752 bytes free
Post-Run: 9,502,244,864 bytes free

- - End Of File - - 38FC8DD06D3CFC0FA2BB3AE9DD98F73F

ravn87 · 2010/09/17

OOOh, "SIIIIR "

HAHA! And here I thought I was being so gender non-specific in cyber city. My androgenous smilies must really "repruhzent," exuding authority Machete-style for me. Remind me to give those guys a bonus. HAHA!

broni · 2010/09/17

Sorry for that

Combofix log looks good now.

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

ravn87 · 2010/09/19

OTL complete - scan 1: "otl" (PT 1/2)

OTL logfile created on: 9/19/2010 8:23:48 AM - Run 1
OTL by OldTimer - Version 3.2.14.0 Folder = C:\Documents and Settings\HP Authorized Custom\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

383.00 Mb Total Physical Memory | 229.00 Mb Available Physical Memory | 60.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 20.00 Gb Total Space | 8.56 Gb Free Space | 42.79% Space Free | Partition Type: FAT32
Drive D: | 2.00 Gb Total Space | 1.46 Gb Free Space | 73.13% Space Free | Partition Type: FAT32
Drive E: | 2.00 Gb Total Space | 1.91 Gb Free Space | 95.70% Space Free | Partition Type: FAT32
Drive F: | 52.31 Gb Total Space | 52.08 Gb Free Space | 99.55% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: VAVRA
Current User Name: HP Authorized Custom
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/09/19 08:22:04 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP Authorized Custom\Desktop\OTL.exe
PRC - [2010/09/07 08:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 08:12:00 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2008/04/13 17:12:36 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\snmp.exe
PRC - [2008/04/13 17:12:32 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\osk.exe
PRC - [2008/04/13 17:12:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2000/08/18 08:22:46 | 000,057,344 | R--- | M] (HP) -- C:\WINDOWS\SYSTEM32\hphipm08.exe
PRC - [2000/08/18 08:20:26 | 000,069,632 | ---- | M] (Hewlett-Packard) -- C:\WINDOWS\SYSTEM32\hpha2mon.exe
PRC - [2000/08/18 08:20:02 | 000,192,512 | ---- | M] (HP) -- C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\hpztsb01.exe

========== Modules (SafeList) ==========

MOD - [2010/09/19 08:22:04 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP Authorized Custom\Desktop\OTL.exe
MOD - [2008/04/13 17:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/09/07 08:12:00 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 08:12:00 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 08:12:00 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/04/17 03:56:06 | 000,073,960 | ---- | M] (tzuk) [Disabled | Stopped] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2010/03/29 08:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2008/04/13 17:12:36 | 000,033,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\SYSTEM32\snmp.exe -- (SNMP)
SRV - [2004/08/04 12:00:00 | 000,019,456 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\tcpsvcs.exe -- (LPDSVC)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - [2010/09/07 07:52:26 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 07:52:04 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 07:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 07:47:20 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/07 07:47:08 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/07 07:46:52 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/04/17 03:56:02 | 000,115,944 | ---- | M] (tzuk) [Kernel | On_Demand | Stopped] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2009/10/21 23:23:18 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2009/10/21 23:23:18 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2009/06/30 09:37:16 | 000,028,552 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\pavboot.sys -- (pavboot)
DRV - [2008/04/13 11:45:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum)
DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/08/03 22:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv)
DRV - [2003/12/12 19:03:10 | 000,652,689 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ltmdmnt.sys -- (ltmodem5)
DRV - [2002/06/03 11:18:32 | 000,040,832 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)
DRV - [2001/06/04 07:00:00 | 000,014,112 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PS2.sys -- (Ps2)
DRV - [2000/08/18 08:22:46 | 000,050,320 | R--- | M] (HP) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\hphid408.sys -- (Dot4)
DRV - [2000/08/18 08:22:46 | 000,017,904 | R--- | M] (HP) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\hphius08.sys -- (Dot4Usb)
DRV - [2000/08/18 08:22:46 | 000,015,824 | R--- | M] (HP) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\hphipr08.sys -- (Dot4Print)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 4F 54 27 34 EE CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/19 02:18:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/19 02:18:56 | 000,000,000 | ---D | M]

[2010/08/19 02:20:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP Authorized Custom\Application Data\Mozilla\Extensions
[2010/08/19 02:18:54 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/08/25 19:02:24 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/09/17 01:01:34 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\hpztsb01.exe (HP)
O4 - HKLM..\Run: [HPHA2MON] C:\WINDOWS\SYSTEM32\hpha2mon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\SYSTEM32\ps2.EXE (Hewlett-Packard Company)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: motive.com ([patttbc.att] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.keepandshare.com/imageuploader5.7.24/ImageUploader5.cab (Image Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso4.cab (Reg Error: Key error.)
O16 - DPF: Win32 Classes Reg Error: Key error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\HP Authorized Custom\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP Authorized Custom\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/30 06:40:44 | 000,000,194 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2010/04/30 06:40:46 | 000,000,153 | -HS- | M] () - C:\AUTOEXEC.BAK -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\LHACM.ACM (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.VDOM - vdowave.drv File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/19 08:22:01 | 000,576,000 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP Authorized Custom\Desktop\OTL.exe
[2010/09/18 14:15:14 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\HP Authorized Custom\Recent
[2010/09/17 03:09:13 | 000,000,000 | -HSD | C] -- C:\Recycled
[2010/09/17 01:04:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/09/17 00:53:11 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/09/17 00:49:37 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/09/17 00:48:35 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/09/17 00:48:35 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/09/17 00:48:35 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/09/17 00:34:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP Authorized Custom\Application Data\SUPERAntiSpyware.com
[2010/09/17 00:34:19 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/09/16 23:39:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/09/16 23:39:39 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/09/15 05:11:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP Authorized Custom\Desktop\MBR scans
[2010/09/15 03:00:46 | 000,000,000 | ---D | C] -- F:\bce33bf2a9a4ab61de2d64eb81
[2010/09/10 05:09:42 | 000,315,552 | ---- | C] (Thesycon GmbH) -- C:\Documents and Settings\HP Authorized Custom\Desktop\DPC Latency Checker.exe
[2010/09/04 05:00:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\wt
[2010/09/04 01:04:46 | 000,116,224 | ---- | C] (Xerox) -- C:\WINDOWS\System32\dllcache\xrxwiadr.dll
[2010/09/04 01:04:39 | 000,023,040 | ---- | C] (Xerox Corporation) -- C:\WINDOWS\System32\dllcache\xrxwbtmp.dll
[2010/09/04 01:04:08 | 000,099,865 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\xlog.exe
[2010/09/04 01:03:40 | 000,016,970 | ---- | C] (US Robotics MCD (Megahertz)) -- C:\WINDOWS\System32\dllcache\xem336n5.sys
[2010/09/04 01:02:07 | 000,154,624 | ---- | C] (Lucent Technologies) -- C:\WINDOWS\System32\dllcache\wlluc48.sys
[2010/09/04 01:02:00 | 000,034,890 | ---- | C] (Raytheon Corp.) -- C:\WINDOWS\System32\dllcache\wlandrv2.sys
[2010/09/04 01:01:43 | 000,771,581 | ---- | C] (Rockwell) -- C:\WINDOWS\System32\dllcache\winacisa.sys
[2010/09/04 01:01:00 | 000,035,871 | ---- | C] (Winbond Electronics Corp.) -- C:\WINDOWS\System32\dllcache\wbfirdma.sys
[2010/09/04 01:00:36 | 000,016,925 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w940nd.sys
[2010/09/04 01:00:29 | 000,019,016 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w926nd.sys
[2010/09/04 01:00:22 | 000,019,528 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w840nd.sys
[2010/09/04 01:00:13 | 000,064,605 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vvoice.sys
[2010/09/04 01:00:05 | 000,397,502 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vpctcom.sys
[2010/09/04 00:59:57 | 000,604,253 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\vmodem.sys
[2010/09/04 00:59:50 | 000,249,402 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\vinwm.sys
[2010/09/04 00:59:19 | 000,765,884 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usrti.sys
[2010/09/04 00:58:50 | 000,794,399 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806v.sys
[2010/09/04 00:58:43 | 000,793,598 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806.sys
[2010/09/04 00:58:36 | 000,794,654 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1801.sys
[2010/09/04 00:58:22 | 000,032,384 | ---- | C] (KLSI USA, Inc.) -- C:\WINDOWS\System32\dllcache\usb101et.sys
[2010/09/04 00:57:46 | 000,050,688 | ---- | C] (UMAX DATA SYSTEMS INC.) -- C:\WINDOWS\System32\dllcache\umaxscan.dll
[2010/09/04 00:57:19 | 000,211,968 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um54scan.dll
[2010/09/04 00:57:12 | 000,216,064 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um34scan.dll
[2010/09/04 00:56:44 | 000,166,784 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxpm.sys
[2010/09/04 00:56:37 | 000,525,568 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxp.dll
[2010/09/04 00:56:30 | 000,159,232 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkbm.sys
[2010/09/04 00:56:23 | 000,440,576 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkb.dll
[2010/09/04 00:56:17 | 000,222,336 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3dm.sys
[2010/09/04 00:56:10 | 000,315,520 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3d.dll
[2010/09/04 00:55:09 | 000,123,995 | ---- | C] (Tiger Jet Network) -- C:\WINDOWS\System32\dllcache\tjisdn.sys
[2010/09/04 00:54:59 | 000,138,528 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiulnt5.sys
[2010/09/04 00:54:51 | 000,081,408 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiul50.dll
[2010/09/04 00:54:48 | 000,149,376 | ---- | C] (M-Systems) -- C:\WINDOWS\System32\dllcache\tffsport.sys
[2010/09/04 00:54:40 | 000,017,129 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdkcd31.sys
[2010/09/04 00:54:33 | 000,037,961 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdk100b.sys
[2010/09/04 00:54:05 | 000,036,640 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\t2r4mini.sys
[2010/09/04 00:53:58 | 000,172,768 | ---- | C] (Number Nine Visual Technology) -- C:\WINDOWS\System32\dllcache\t2r4disp.dll
[2010/09/04 00:52:35 | 000,155,648 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnprop.dll
[2010/09/04 00:52:28 | 000,053,248 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlncoin.dll
[2010/09/04 00:52:22 | 000,285,760 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnata.sys
[2010/09/04 00:52:15 | 000,016,896 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\stcusb.sys
[2010/09/04 00:52:04 | 000,048,736 | ---- | C] (3Com) -- C:\WINDOWS\System32\dllcache\srwlnd5.sys
[2010/09/04 00:51:21 | 000,019,072 | ---- | C] (Adaptec, Inc.) -- C:\WINDOWS\System32\dllcache\sparrow.sys
[2010/09/04 00:50:24 | 000,058,368 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smiminib.sys
[2010/09/04 00:50:18 | 000,147,200 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smidispb.dll
[2010/09/04 00:50:11 | 000,025,034 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smcpwr2n.sys
[2010/09/04 00:50:04 | 000,035,913 | ---- | C] (SMC) -- C:\WINDOWS\System32\dllcache\smcirda.sys
[2010/09/04 00:49:58 | 000,024,576 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smc8000n.sys
[2010/09/04 00:49:03 | 000,063,547 | ---- | C] (Symbol Technologies) -- C:\WINDOWS\System32\dllcache\sla30nd5.sys
[2010/09/04 00:48:57 | 000,091,294 | ---- | C] (SysKonnect, a business unit of Schneider & Koch & Co. Datensysteme GmbH.) -- C:\WINDOWS\System32\dllcache\skfpwin.sys
[2010/09/04 00:48:51 | 000,094,698 | ---- | C] (SysKonnect GmbH.) -- C:\WINDOWS\System32\dllcache\sk98xwin.sys
[2010/09/04 00:48:36 | 000,032,768 | ---- | C] (SiS Corporation) -- C:\WINDOWS\System32\dllcache\sisnic.sys
[2010/09/04 00:47:27 | 000,161,568 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmusb.sys
[2010/09/04 00:47:21 | 000,018,400 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmld.sys
[2010/09/04 00:47:16 | 000,098,080 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiulnt5.sys
[2010/09/04 00:47:10 | 000,386,560 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiul50.dll
[2010/09/04 00:46:20 | 000,017,280 | ---- | C] (SCM Microsystems) -- C:\WINDOWS\System32\dllcache\scr111.sys
[2010/09/04 00:46:03 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmusbm.sys
[2010/09/04 00:45:57 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmn50m.sys
[2010/09/04 00:45:24 | 000,077,824 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4m.sys
[2010/09/04 00:45:18 | 000,198,400 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4.dll
[2010/09/04 00:45:12 | 000,061,504 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3dm.sys
[2010/09/04 00:45:07 | 000,179,264 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3d.dll
[2010/09/04 00:45:01 | 000,210,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mvirge.dll
[2010/09/04 00:44:55 | 000,062,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mtrio.dll
[2010/09/04 00:44:49 | 000,041,216 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.sys
[2010/09/04 00:44:43 | 000,182,272 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.dll
[2010/09/04 00:44:38 | 000,166,720 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3m.sys
[2010/09/04 00:44:23 | 000,082,432 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia450.dll
[2010/09/04 00:44:17 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia430.dll
[2010/09/04 00:44:13 | 000,029,696 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw450ext.dll
[2010/09/04 00:44:11 | 000,027,648 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw430ext.dll
[2010/09/04 00:43:59 | 000,019,017 | ---- | C] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\dllcache\rtl8029.sys
[2010/09/04 00:43:45 | 000,009,216 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\rsmgrstr.dll
[2010/09/04 00:43:33 | 000,079,104 | ---- | C] (Comtrol Corporation) -- C:\WINDOWS\System32\dllcache\rocket.sys
[2010/09/04 00:43:26 | 000,037,563 | ---- | C] (RadioLAN) -- C:\WINDOWS\System32\dllcache\rlnet5.sys
[2010/09/04 00:43:19 | 000,086,097 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\reslog32.dll
[2010/09/04 00:42:53 | 000,714,762 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdmkxx.sys
[2010/09/04 00:42:46 | 000,899,146 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdkxga.sys
[2010/09/04 00:41:46 | 000,130,942 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlv.sys
[2010/09/04 00:41:40 | 000,112,574 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlp.sys
[2010/09/04 00:41:35 | 000,128,286 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserli.sys
[2010/09/04 00:41:09 | 000,016,128 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\pscr.sys
[2010/09/04 00:39:33 | 000,169,984 | ---- | C] (Cisco Systems) -- C:\WINDOWS\System32\dllcache\pcx500.sys
[2010/09/04 00:39:27 | 000,086,016 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\pctspk.exe
[2010/09/04 00:39:04 | 000,026,153 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pcmlm56.sys
[2010/09/04 00:38:51 | 000,029,502 | ---- | C] (Marconi Communications, Inc.) -- C:\WINDOWS\System32\dllcache\pca200e.sys
[2010/09/04 00:38:45 | 000,030,495 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pc100nds.sys
[2010/09/04 00:37:31 | 000,054,186 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otcsercb.sys
[2010/09/04 00:37:26 | 000,043,689 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otceth5.sys
[2010/09/04 00:37:20 | 000,027,209 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otc06x5.sys
[2010/09/04 00:37:13 | 000,054,528 | ---- | C] (Yamaha Corp.) -- C:\WINDOWS\System32\dllcache\opl3sax.sys
[2010/09/04 00:36:26 | 000,051,552 | ---- | C] (Kensington Technology Group) -- C:\WINDOWS\System32\dllcache\ntgrip.sys
[2010/09/04 00:35:57 | 000,087,040 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm6wdm.sys
[2010/09/04 00:35:51 | 000,126,080 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm5a2wdm.sys
[2010/09/04 00:35:39 | 000,032,840 | ---- | C] (NETGEAR Corporation.) -- C:\WINDOWS\System32\dllcache\ngrpci.sys
[2010/09/04 00:35:36 | 000,132,695 | ---- | C] (802.11b) -- C:\WINDOWS\System32\dllcache\netwlan5.sys
[2010/09/04 00:35:17 | 000,039,264 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.sys
[2010/09/04 00:35:11 | 000,060,480 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.dll
[2010/09/04 00:34:50 | 000,091,488 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3disp.dll
[2010/09/04 00:34:45 | 000,027,936 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3d.sys
[2010/09/04 00:34:39 | 000,033,088 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.sys
[2010/09/04 00:34:34 | 000,059,104 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.dll
[2010/09/04 00:34:29 | 000,013,664 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.sys
[2010/09/04 00:34:23 | 000,035,392 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.dll
[2010/09/04 00:34:07 | 000,075,520 | ---- | C] (Moxa Technologies Co., Ltd.) -- C:\WINDOWS\System32\dllcache\mxport.sys
[2010/09/04 00:34:01 | 000,007,168 | ---- | C] (Moxa Technologies Co., Ltd) -- C:\WINDOWS\System32\dllcache\mxport.dll
[2010/09/04 00:33:56 | 000,019,968 | ---- | C] (Macronix International Co., Ltd. ) -- C:\WINDOWS\System32\dllcache\mxnic.sys
[2010/09/04 00:33:51 | 000,019,968 | ---- | C] (Moxa Technologies Co., Ltd) -- C:\WINDOWS\System32\dllcache\mxicfg.dll
[2010/09/04 00:33:45 | 000,021,888 | ---- | C] (Moxa Technologies Co., Ltd.) -- C:\WINDOWS\System32\dllcache\mxcard.sys
[2010/09/04 00:33:22 | 000,103,296 | ---- | C] (Matrox Graphics Inc) -- C:\WINDOWS\System32\dllcache\mtxvideo.sys
[2010/09/04 00:30:45 | 000,017,280 | ---- | C] (American Megatrends Inc.) -- C:\WINDOWS\System32\dllcache\mraid35x.sys
[2010/09/04 00:29:32 | 000,164,586 | ---- | C] (Madge Networks Ltd) -- C:\WINDOWS\System32\dllcache\mdgndis5.sys
[2010/09/04 00:28:48 | 000,797,500 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltsmt.sys
[2010/09/04 00:28:43 | 000,802,683 | ---- | C] (Lucent Technologies) -- C:\WINDOWS\System32\dllcache\ltsm.sys
[2010/09/04 00:28:40 | 000,420,992 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmntt.sys
[2010/09/04 00:28:35 | 000,576,746 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmntl.sys
[2010/09/04 00:28:28 | 000,727,786 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ltck000c.sys
[2010/09/04 00:28:13 | 000,070,730 | ---- | C] (Linksys Group, Inc.) -- C:\WINDOWS\System32\dllcache\lne100tx.sys
[2010/09/04 00:28:09 | 000,020,573 | ---- | C] (The Linksts Group ) -- C:\WINDOWS\System32\dllcache\lne100.sys
[2010/09/04 00:28:03 | 000,025,065 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\lmndis3.sys
[2010/09/04 00:27:58 | 000,015,744 | ---- | C] (Litronic Industries) -- C:\WINDOWS\System32\dllcache\lit220p.sys
[2010/09/04 00:27:51 | 000,026,442 | ---- | C] (SMSC) -- C:\WINDOWS\System32\dllcache\lanepic5.sys
[2010/09/04 00:27:45 | 000,019,016 | ---- | C] (Kingston Technology Company ) -- C:\WINDOWS\System32\dllcache\ktc111.sys
[2010/09/04 00:26:20 | 000,023,552 | ---- | C] (MKNet Corporation) -- C:\WINDOWS\System32\dllcache\irmk7.sys
[2010/09/04 00:26:03 | 000,045,632 | ---- | C] (Interphase (R) Corporation a Windows (R) 2000 DDK Driver Provider) -- C:\WINDOWS\System32\dllcache\ip5515.sys
[2010/09/04 00:24:45 | 000,372,824 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\iconf32.dll
[2010/09/04 00:20:56 | 000,068,608 | ---- | C] (Avisioin) -- C:\WINDOWS\System32\dllcache\hpgt53tk.dll
[2010/09/04 00:20:39 | 000,126,976 | ---- | C] (Hewlett Packard) -- C:\WINDOWS\System32\dllcache\hpgt34tk.dll
[2010/09/04 00:19:46 | 000,028,288 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\grserial.sys
[2010/09/04 00:19:42 | 000,082,304 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\grclass.sys
[2010/09/04 00:19:37 | 000,017,408 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\gpr400.sys
[2010/09/04 00:19:09 | 000,454,912 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fxusbase.sys
[2010/09/04 00:18:56 | 000,455,296 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fusbbase.sys
[2010/09/04 00:18:51 | 000,455,680 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fus2base.sys
[2010/09/04 00:18:44 | 000,442,240 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpnpbase.sys
[2010/09/04 00:18:39 | 000,441,728 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpcmbase.sys
[2010/09/04 00:18:35 | 000,444,416 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpcibase.sys
[2010/09/04 00:18:33 | 000,034,173 | ---- | C] (Marconi Communications, Inc.) -- C:\WINDOWS\System32\dllcache\forehe.sys
[2010/09/04 00:18:03 | 000,024,618 | ---- | C] (NETGEAR) -- C:\WINDOWS\System32\dllcache\fa410nd5.sys
[2010/09/04 00:17:56 | 000,011,850 | ---- | C] (FUJITSU LIMITED) -- C:\WINDOWS\System32\dllcache\f3ab18xj.sys
[2010/09/04 00:17:51 | 000,012,362 | ---- | C] (FUJITSU LIMITED) -- C:\WINDOWS\System32\dllcache\f3ab18xi.sys
[2010/09/04 00:16:56 | 000,072,192 | ---- | C] (ESS Technology Inc.) -- C:\WINDOWS\System32\dllcache\es1969.sys
[2010/09/04 00:15:03 | 000,334,208 | ---- | C] (Yamaha Corp.) -- C:\WINDOWS\System32\dllcache\ds1wdm.sys
[2010/09/04 00:14:53 | 000,028,062 | ---- | C] (National Semiconductor Coproration) -- C:\WINDOWS\System32\dllcache\dp83820.sys
[2010/09/04 00:14:33 | 000,029,696 | ---- | C] (CNet Technology, Inc. ) -- C:\WINDOWS\System32\dllcache\dm9pci5.sys
[2010/09/04 00:14:30 | 000,026,698 | ---- | C] (D-Link Corporation) -- C:\WINDOWS\System32\dllcache\dlh5xnd5.sys
[2010/09/04 00:14:27 | 000,952,007 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\diwan.sys
[2010/09/04 00:14:18 | 000,236,060 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\ditrace.exe
[2010/09/04 00:14:15 | 000,038,985 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvsu.dll
[2010/09/04 00:14:13 | 000,031,305 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvpp.dll
[2010/09/04 00:14:10 | 000,006,729 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvci.dll
[2010/09/04 00:14:06 | 000,091,305 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\dimaint.sys
[2010/09/04 00:13:23 | 000,024,649 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\dfe650d.sys
[2010/09/04 00:13:21 | 000,024,648 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\dfe650.sys
[2010/09/04 00:13:13 | 000,020,928 | ---- | C] (Digital Networks, LLC) -- C:\WINDOWS\System32\dllcache\defpa.sys
[2010/09/04 00:12:22 | 000,048,640 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwrwdm.sys
[2010/09/04 00:12:20 | 000,093,952 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcwdm.sys
[2010/09/04 00:12:18 | 000,111,872 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcspud.sys
[2010/09/04 00:12:16 | 000,003,584 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcosnt5.sys
[2010/09/04 00:12:13 | 000,072,832 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbwdm.sys
[2010/09/04 00:12:11 | 000,003,072 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbmidi.sys
[2010/09/04 00:12:09 | 000,003,072 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbase.sys
[2010/09/04 00:12:05 | 000,249,856 | ---- | C] (Comtrol® Corporation) -- C:\WINDOWS\System32\dllcache\ctmasetp.dll
[2010/09/04 00:11:49 | 000,216,064 | ---- | C] (COMPAQ Inc.) -- C:\WINDOWS\System32\dllcache\cpscan.dll
[2010/09/04 00:11:46 | 000,060,970 | ---- | C] (Compaq Computer Corp.) -- C:\WINDOWS\System32\dllcache\cpqtrnd5.sys
[2010/09/04 00:11:19 | 000,020,736 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\cmbp0wdm.sys
[2010/09/04 00:11:00 | 000,980,034 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\cicap.sys
[2010/09/04 00:10:45 | 000,049,182 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem56n5.sys
[2010/09/04 00:10:44 | 000,022,044 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem33n5.sys
[2010/09/04 00:10:42 | 000,022,044 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem28n5.sys
[2010/09/04 00:10:41 | 000,027,164 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ce3n5.sys
[2010/09/04 00:10:39 | 000,021,530 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ce2n5.sys
[2010/09/04 00:10:32 | 000,714,698 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cbmdmkxx.sys
[2010/09/04 00:10:30 | 000,046,108 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cben5.sys
[2010/09/04 00:10:29 | 000,039,680 | ---- | C] (Silicom Ltd.) -- C:\WINDOWS\System32\dllcache\cb325.sys
[2010/09/04 00:10:27 | 000,037,916 | ---- | C] (Fast Ethernet Controller Provider) -- C:\WINDOWS\System32\dllcache\cb102.sys
[2010/09/04 00:10:23 | 000,032,256 | ---- | C] (Eicon Technology Corporation) -- C:\WINDOWS\System32\dllcache\diapi2NT.dll
[2010/09/04 00:10:17 | 000,164,923 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\diapi2.sys
[2010/09/04 00:08:51 | 000,031,529 | ---- | C] (BreezeCOM) -- C:\WINDOWS\System32\dllcache\brzwlan.sys
[2010/09/04 00:08:50 | 000,010,368 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brusbscn.sys
[2010/09/04 00:08:49 | 000,011,008 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brusbmdm.sys
[2010/09/04 00:08:47 | 000,060,416 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brserwdm.sys
[2010/09/04 00:08:46 | 000,009,728 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brserif.dll
[2010/09/04 00:08:45 | 000,005,120 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\System32\dllcache\brscnrsm.dll
[2010/09/04 00:08:43 | 000,039,552 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparwdm.sys
[2010/09/04 00:08:41 | 000,003,168 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparimg.sys
[2010/09/04 00:08:38 | 000,041,472 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfusb.dll
[2010/09/04 00:08:37 | 000,032,256 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfrsmg.exe
[2010/09/04 00:08:35 | 000,029,696 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmflpt.dll
[2010/09/04 00:08:33 | 000,015,360 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfbidi.dll
[2010/09/04 00:08:31 | 000,003,968 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltup.sys
[2010/09/04 00:08:30 | 000,012,160 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2010/09/04 00:08:28 | 000,002,944 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brfilt.sys
[2010/09/04 00:08:26 | 000,012,800 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brevif.dll
[2010/09/04 00:08:25 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brcoinst.dll
[2010/09/04 00:08:23 | 000,019,456 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brbidiif.dll
[2010/09/04 00:07:59 | 000,871,388 | ---- | C] (BCM) -- C:\WINDOWS\System32\dllcache\bcmdm.sys
[2010/09/04 00:07:48 | 000,036,128 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.sys
[2010/09/04 00:07:46 | 000,342,336 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.dll
[2010/09/04 00:07:43 | 000,089,952 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\b1cbase.sys
[2010/09/04 00:07:42 | 000,036,992 | ---- | C] (Aztech Systems Ltd) -- C:\WINDOWS\System32\dllcache\aztw2320.sys
[2010/09/04 00:07:40 | 000,037,568 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmwan.sys
[2010/09/04 00:07:39 | 000,144,384 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmenum.dll
[2010/09/04 00:07:37 | 000,087,552 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2010/09/04 00:06:53 | 000,077,568 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\dllcache\ati.sys
[2010/09/04 00:06:50 | 000,097,354 | ---- | C] (Bay Networks, Inc.) -- C:\WINDOWS\System32\dllcache\aspndis3.sys
[2010/09/04 00:06:38 | 000,016,969 | ---- | C] (AmbiCom, Inc.) -- C:\WINDOWS\System32\dllcache\amb8002.sys
[2010/09/04 00:05:15 | 000,046,112 | ---- | C] (Adaptec, Inc ) -- C:\WINDOWS\System32\dllcache\adptsf50.sys
[2010/09/04 00:05:13 | 000,010,880 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\admjoy.sys
[2010/09/04 00:05:12 | 000,747,392 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8830.sys
[2010/09/04 00:05:11 | 000,553,984 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8820.sys
[2010/09/04 00:05:10 | 000,584,448 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8810.sys
[2010/09/04 00:05:08 | 000,020,160 | ---- | C] (ADMtek Incorporated) -- C:\WINDOWS\System32\dllcache\adm8511.sys
[2010/09/04 00:05:04 | 000,061,440 | ---- | C] (Color Flatbed Scanner) -- C:\WINDOWS\System32\dllcache\acerscad.dll
[2010/09/04 00:05:01 | 000,297,728 | ---- | C] (Silicon Integrated Systems Corp.) -- C:\WINDOWS\System32\dllcache\ac97sis.sys
[2010/09/04 00:04:57 | 000,462,848 | ---- | C] (Aureal Inc.) -- C:\WINDOWS\System32\dllcache\a3dapi.dll
[2010/09/04 00:04:53 | 000,148,352 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2010/09/04 00:04:52 | 000,689,216 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2010/09/04 00:04:50 | 000,762,780 | ---- | C] (3Com, Inc.) -- C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2010/08/28 02:03:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/08/28 01:57:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP Authorized Custom\Application Data\Malwarebytes
[2010/08/28 01:57:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/08/28 01:57:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/08/28 01:57:33 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/08/28 01:57:32 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/26 14:22:15 | 000,000,000 | ---D | C] -- F:\catalog.wci
[2010/08/26 14:20:15 | 000,000,000 | ---D | C] -- C:\catalog.wci
[2010/08/25 21:21:42 | 000,028,552 | ---- | C] (Panda Security, S.L.) -- C:\WINDOWS\System32\drivers\pavboot.sys
[2010/08/25 19:10:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/08/25 19:01:16 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/08/25 16:18:32 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard
[2010/08/25 13:42:28 | 000,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2010/08/23 17:57:02 | 000,000,000 | ---D | C] -- C:\FOUND.002
[2010/08/19 02:18:53 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/08/18 01:04:40 | 000,000,000 | ---D | C] -- C:\Program Files\Citrix
[2010/08/12 14:59:14 | 000,000,000 | ---D | C] -- F:\56281fb2c4b3ca310aec80cf12039a
[2010/07/29 18:45:02 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2010/07/29 18:44:10 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2010/06/29 00:12:47 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr

========== Files - Modified Within 90 Days ==========

[2010/09/19 08:29:54 | 002,621,440 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\ntuser.dat
[2010/09/19 08:22:04 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP Authorized Custom\Desktop\OTL.exe
[2010/09/19 06:08:26 | 000,000,452 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{A00A74B8-F50F-4E6E-952F-48837BDFDE7E}.job
[2010/09/18 22:10:50 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/17 01:04:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/17 01:01:46 | 000,000,627 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/09/17 00:49:48 | 000,000,334 | RHS- | M] () -- C:\boot.ini
[2010/09/17 00:42:34 | 000,013,740 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/09/17 00:42:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/09/17 00:42:28 | 402,182,144 | -HS- | M] () -- C:\hiberfil.sys
[2010/09/17 00:41:42 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\HP Authorized Custom\ntuser.ini
[2010/09/16 23:22:50 | 003,846,241 | R--- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\ComboFix.exe
[2010/09/15 04:31:26 | 002,565,432 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\NTBR_CD.exe
[2010/09/10 15:55:30 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\MBRCheck.exe
[2010/09/10 05:25:02 | 001,792,673 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\deskref.exe
[2010/09/10 05:24:14 | 000,071,168 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\scsimax.exe
[2010/09/10 05:23:08 | 007,923,712 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\SeaToolsDOS221ALL.576.ISO
[2010/09/10 05:11:10 | 000,716,496 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\RATTV3Setup.exe
[2010/09/10 05:09:28 | 000,315,552 | ---- | M] (Thesycon GmbH) -- C:\Documents and Settings\HP Authorized Custom\Desktop\DPC Latency Checker.exe
[2010/09/10 01:23:28 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\dds-pif.pif
[2010/09/07 17:32:06 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/09/07 08:12:18 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2010/09/07 08:11:54 | 000,167,592 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/09/07 07:52:26 | 000,046,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/09/07 07:52:04 | 000,165,584 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/09/07 07:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/09/07 07:47:20 | 000,100,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/09/07 07:47:16 | 000,094,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/09/07 07:47:08 | 000,017,744 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/09/07 07:46:52 | 000,028,880 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/08/28 01:57:46 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/26 12:44:28 | 000,031,176 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Application Data\GDIPFONTCACHEV1.DAT
[2010/08/25 16:54:02 | 000,001,579 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/08/25 16:54:02 | 000,000,217 | ---- | M] () -- C:\Boot.bak
[2010/08/25 16:17:52 | 000,000,193 | ---- | M] () -- C:\WINDOWS\hpfsched.ini
[2010/08/25 16:17:50 | 000,000,334 | ---- | M] () -- C:\WINDOWS\reg.prm
[2010/08/25 15:39:46 | 002,359,296 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\ntuser.bak
[2010/08/22 22:20:14 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/08/20 02:39:14 | 000,002,081 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/08/20 02:39:12 | 000,002,143 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\Google Chrome.lnk
[2010/08/19 02:19:04 | 000,001,535 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/19 02:19:04 | 000,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/08/12 15:31:32 | 000,153,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/16 22:15:14 | 000,006,656 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/22 15:00:30 | 000,463,302 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/22 15:00:30 | 000,409,172 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/22 15:00:30 | 000,065,386 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

ravn87 · 2010/09/19

OTL complete - scan 1: "OTL" (PT 2/2) =)

========== Files Created - No Company Name ==========

[2010/09/17 00:48:35 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/09/17 00:48:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/09/17 00:48:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/09/17 00:48:35 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/09/17 00:48:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/09/17 00:35:56 | 402,182,144 | -HS- | C] () -- C:\hiberfil.sys
[2010/09/16 23:48:54 | 000,000,217 | ---- | C] () -- C:\Boot.bak
[2010/09/16 23:48:51 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/09/16 23:28:27 | 002,621,440 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\ntuser.dat
[2010/09/16 23:21:49 | 003,846,241 | R--- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\ComboFix.exe
[2010/09/15 04:31:15 | 002,565,432 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\NTBR_CD.exe
[2010/09/10 15:57:22 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\gmer.exe
[2010/09/10 15:57:21 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\MBRCheck.exe
[2010/09/10 05:24:56 | 001,792,673 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\deskref.exe
[2010/09/10 05:24:17 | 000,071,168 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\scsimax.exe
[2010/09/10 05:23:06 | 007,923,712 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\SeaToolsDOS221ALL.576.ISO
[2010/09/10 05:11:08 | 000,716,496 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\RATTV3Setup.exe
[2010/09/10 01:23:29 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\dds-pif.pif
[2010/09/04 01:04:37 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xrxscnui.dll
[2010/09/04 01:04:30 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xrxftplt.exe
[2010/09/04 00:41:24 | 000,033,280 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisrndr.ax
[2010/09/04 00:41:15 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisdecd.dll
[2010/09/04 00:31:11 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdvbnp.ax
[2010/09/04 00:27:32 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2010/09/04 00:25:18 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2010/09/04 00:20:52 | 000,165,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt53.dll
[2010/09/04 00:20:43 | 000,093,696 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt42.dll
[2010/09/04 00:20:35 | 000,101,376 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt34.dll
[2010/09/04 00:20:26 | 000,089,088 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt33.dll
[2010/09/04 00:20:17 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt21.dll
[2010/09/04 00:19:48 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2010/09/04 00:14:25 | 000,029,768 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divasu.dll
[2010/09/04 00:14:22 | 000,037,962 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaprop.dll
[2010/09/04 00:14:20 | 000,006,216 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaci.dll
[2010/09/04 00:07:24 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atixbar.sys
[2010/09/04 00:07:23 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativxbar.sys
[2010/09/04 00:07:21 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativttxx.sys
[2010/09/04 00:07:20 | 000,009,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2010/09/04 00:07:19 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2010/09/04 00:07:17 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitunep.sys
[2010/09/04 00:07:16 | 000,026,880 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2010/09/04 00:07:15 | 000,049,920 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtcap.sys
[2010/09/04 00:07:12 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2010/09/04 00:06:59 | 000,046,464 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atibt829.sys
[2010/08/28 01:57:45 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/25 16:17:47 | 000,000,334 | ---- | C] () -- C:\WINDOWS\reg.prm
[2010/08/19 02:19:03 | 000,001,535 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/19 02:19:03 | 000,001,517 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/07/16 22:15:09 | 000,006,656 | ---- | C] () -- C:\Documents and Settings\HP Authorized Custom\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/03 06:16:21 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2010/05/28 19:33:58 | 000,000,192 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2010/05/28 19:33:58 | 000,000,097 | ---- | C] () -- C:\WINDOWS\Tb98.ini
[2010/05/28 19:33:45 | 000,046,512 | ---- | C] () -- C:\WINDOWS\System32\EPSN.DLL
[2010/05/28 19:33:45 | 000,012,126 | ---- | C] () -- C:\WINDOWS\System32\PIXPCZ.DLL
[2010/05/28 19:33:45 | 000,011,934 | ---- | C] () -- C:\WINDOWS\System32\PIXPNR.DLL
[2010/05/28 19:33:45 | 000,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL
[2010/05/28 19:32:46 | 000,000,072 | ---- | C] () -- C:\WINDOWS\System32\epDPE.ini
[2010/05/28 19:32:45 | 000,096,768 | ---- | C] () -- C:\WINDOWS\SlantAdj.dll
[2010/05/28 19:32:01 | 000,000,018 | ---- | C] () -- C:\WINDOWS\Epson1240U.ini
[2010/05/14 14:24:31 | 000,000,193 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2010/05/08 01:39:30 | 000,001,714 | ---- | C] () -- C:\WINDOWS\Sandboxie.ini
[2010/04/30 14:36:16 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2010/04/30 07:51:07 | 000,000,472 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2010/04/30 07:49:26 | 000,012,783 | ---- | C] () -- C:\WINDOWS\IOS.INI
[2010/04/30 07:49:26 | 000,007,885 | ---- | C] () -- C:\WINDOWS\NETDET.INI
[2010/04/30 07:49:26 | 000,005,068 | ---- | C] () -- C:\WINDOWS\DELETEFI.INI
[2010/04/30 07:49:26 | 000,003,598 | ---- | C] () -- C:\WINDOWS\HTMLHELP.INI
[2010/04/30 07:49:26 | 000,000,825 | ---- | C] () -- C:\WINDOWS\mrun32.ini
[2010/04/30 07:49:26 | 000,000,787 | ---- | C] () -- C:\WINDOWS\SCANREG.INI
[2010/04/30 07:49:26 | 000,000,520 | ---- | C] () -- C:\WINDOWS\photoprn.ini
[2010/04/30 07:49:26 | 000,000,513 | ---- | C] () -- C:\WINDOWS\fantasy2.ini
[2010/04/30 07:49:26 | 000,000,303 | ---- | C] () -- C:\WINDOWS\SMSI.INI
[2010/04/30 07:49:26 | 000,000,244 | ---- | C] () -- C:\WINDOWS\pstudio.ini
[2010/04/30 07:49:26 | 000,000,225 | ---- | C] () -- C:\WINDOWS\TELEPHON.INI
[2010/04/30 07:49:26 | 000,000,138 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/04/30 07:49:26 | 000,000,060 | ---- | C] () -- C:\WINDOWS\POWERPNT.INI
[2010/04/30 07:49:26 | 000,000,054 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2010/04/30 07:49:26 | 000,000,047 | ---- | C] () -- C:\WINDOWS\warhead.ini
[2010/04/30 07:49:26 | 000,000,030 | ---- | C] () -- C:\WINDOWS\MAIN.INI
[2010/04/30 07:49:26 | 000,000,028 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2010/04/30 07:49:26 | 000,000,026 | ---- | C] () -- C:\WINDOWS\MSOFFICE.INI
[2010/04/30 07:49:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\progman.ini
[1980/01/01 00:00:00 | 000,249,921 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM15.dll
[1980/01/01 00:00:00 | 000,157,032 | ---- | C] () -- C:\WINDOWS\System32\TwnPRO20.dll
[1980/01/01 00:00:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\PCDRJNI.DLL
[1980/01/01 00:00:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes15.dll
[1980/01/01 00:00:00 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\TlxDlgUtil.dll
[1980/01/01 00:00:00 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\icmfilter.dll
[1980/01/01 00:00:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\rdbios32.dll
[1980/01/01 00:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\quick.dll
[1980/01/01 00:00:00 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\I81X329X.DLL
[1980/01/01 00:00:00 | 000,023,357 | -H-- | C] () -- C:\Program Files\folder.htt
[1980/01/01 00:00:00 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[1980/01/01 00:00:00 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\IGFXDGPS.DLL
[1980/01/01 00:00:00 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\HpSocEx.dll
[1980/01/01 00:00:00 | 000,001,646 | ---- | C] () -- C:\WINDOWS\MSDOS.SYS

========== LOP Check ==========

[2010/04/30 18:15:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATTToolbar
[2010/04/30 23:19:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/09/19 06:08:26 | 000,000,452 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{A00A74B8-F50F-4E6E-952F-48837BDFDE7E}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/04/30 06:40:44 | 000,000,194 | -H-- | M] () -- C:\AUTOEXEC.BAT
[2000/11/01 15:43:56 | 000,249,888 | RH-- | M] () -- C:\CLASSES.1ST
[2010/09/17 00:42:28 | 402,182,144 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/30 06:40:44 | 000,000,000 | -H-- | M] () -- C:\CONFIG.SYS
[2010/04/30 06:40:46 | 000,000,153 | -HS- | M] () -- C:\AUTOEXEC.BAK
[2000/11/01 15:49:28 | 000,001,660 | RHS- | M] () -- C:\MSDOS.SYS
[2010/08/25 18:43:38 | 000,006,369 | ---- | M] () -- C:\JavaRa.log
[2010/08/25 16:54:02 | 000,000,217 | ---- | M] () -- C:\Boot.bak
[2010/09/07 02:24:22 | 000,015,874 | ---- | M] () -- C:\chkdsk.txt
[2000/11/01 15:49:10 | 000,040,960 | -HS- | M] () -- C:\VIDEOROM.BIN
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/09/17 01:04:20 | 000,027,850 | ---- | M] () -- C:\ComboFix.txt
[2010/04/30 07:31:00 | 000,000,343 | ---- | M] () -- C:\uuc.scp
[2000/06/08 17:00:00 | 000,110,080 | RHS- | M] () -- C:\io.sys
[2010/04/30 07:22:08 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS
[2010/05/01 03:40:32 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2004/08/04 12:00:00 | 000,047,564 | RHS- | M] () -- C:\ntdetect.com
[2010/09/17 00:49:48 | 000,000,334 | RHS- | M] () -- C:\boot.ini
[2010/09/17 00:42:26 | 602,931,200 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/04/30 07:48:18 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\FONTS\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 03:50:04 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 08:12:18 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2000/06/06 16:21:34 | 000,071,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Channel Screen Saver.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >
[2010/04/30 18:13:50 | 000,000,939 | -H-- | M] () -- C:\Documents and Settings\All Users\Favorites\helpme_att.lnk
[2010/05/21 23:32:26 | 000,000,077 | -HS- | M] () -- C:\Documents and Settings\All Users\Favorites\Desktop.ini

< %APPDATA%\Microsoft\*.* >
[2010/06/27 15:54:10 | 002,359,350 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Application Data\Microsoft\Wallpaper1.bmp

< %PROGRAMFILES%\*.* >
[2000/11/01 15:51:20 | 000,000,271 | -HS- | M] () -- C:\Program Files\desktop.ini
[2000/11/01 15:51:20 | 000,023,357 | -H-- | M] () -- C:\Program Files\folder.htt

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/04/30 07:35:06 | 000,884,736 | ---- | M] () -- C:\WINDOWS\SYSTEM32\config\system.sav
[2010/04/30 07:35:06 | 000,634,880 | ---- | M] () -- C:\WINDOWS\SYSTEM32\config\software.sav
[2010/04/30 07:35:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\SYSTEM32\config\default.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/05/01 03:59:14 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2010/09/10 05:09:28 | 000,315,552 | ---- | M] (Thesycon GmbH) -- C:\Documents and Settings\HP Authorized Custom\Desktop\DPC Latency Checker.exe
[2010/09/10 05:11:10 | 000,716,496 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\RATTV3Setup.exe
[2010/09/10 05:24:14 | 000,071,168 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\scsimax.exe
[2010/09/10 05:25:02 | 001,792,673 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\deskref.exe
[2010/09/10 15:55:30 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\MBRCheck.exe
[2010/03/18 04:18:02 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\gmer.exe
[2010/09/16 23:22:50 | 003,846,241 | R--- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\ComboFix.exe
[2010/09/19 08:22:04 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP Authorized Custom\Desktop\OTL.exe
[2010/09/15 04:31:26 | 002,565,432 | ---- | M] () -- C:\Documents and Settings\HP Authorized Custom\Desktop\NTBR_CD.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/04/30 14:34:50 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\HP Authorized Custom\Favorites\Desktop.ini
[2010/04/30 18:13:50 | 000,000,939 | -H-- | M] () -- C:\Documents and Settings\HP Authorized Custom\Favorites\helpme_att.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/19 08:23:06 | 000,114,688 | -HS- | M] () -- C:\Documents and Settings\HP Authorized Custom\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\INF\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >
[2010/05/08 01:39:14 | 000,670,880 | ---- | M] (tzuk) -- C:\WINDOWS\Installer\SandboxieInstall32.exe
[2 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2000/06/08 17:00:00 | 000,000,000 | ---- | M] () -- C:\Program Files\Messenger\BLOGO.GI_
[2000/06/08 17:00:00 | 000,020,752 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\MSMSGSC.DLL
[2000/06/08 17:00:00 | 000,012,560 | ---- | M] () -- C:\Program Files\Messenger\MSMSGSIN.EXE
[2000/06/08 17:00:00 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\NEWEMAIL.WA_
[2000/06/08 17:00:00 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\ONLINE.WA_
[2000/06/08 17:00:00 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\TYPE.WA_
[2004/08/04 01:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 01:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2004/08/04 01:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 01:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 01:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 01:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 01:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm
[2008/04/13 17:12:28 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2008/04/13 10:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 17:11:52 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2008/05/02 07:01:50 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[2000/08/30 03:00:00 | 000,043,592 | ---- | M] () -- C:\WINDOWS\SYSTEM\getdmi.exe
[2000/08/08 14:47:22 | 000,036,864 | ---- | M] (Intel Corporation) -- C:\WINDOWS\SYSTEM\I81XGHLP.EXE
[2000/10/24 12:34:20 | 000,082,992 | ---- | M] () -- C:\WINDOWS\SYSTEM\READ16.EXE
[2000/04/03 15:54:28 | 000,079,156 | ---- | M] () -- C:\WINDOWS\SYSTEM\getrstr.exe
[2000/08/30 03:00:00 | 000,041,021 | ---- | M] () -- C:\WINDOWS\SYSTEM\pcbeep.exe

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

ravn87 · 2010/09/19

OTL complete - scan 2: "EXTRAS "

OTL Extras logfile created on: 9/19/2010 8:23:48 AM - Run 1
OTL by OldTimer - Version 3.2.14.0 Folder = C:\Documents and Settings\HP Authorized Custom\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

383.00 Mb Total Physical Memory | 229.00 Mb Available Physical Memory | 60.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 20.00 Gb Total Space | 8.56 Gb Free Space | 42.79% Space Free | Partition Type: FAT32
Drive D: | 2.00 Gb Total Space | 1.46 Gb Free Space | 73.13% Space Free | Partition Type: FAT32
Drive E: | 2.00 Gb Total Space | 1.91 Gb Free Space | 95.70% Space Free | Partition Type: FAT32
Drive F: | 52.31 Gb Total Space | 52.08 Gb Free Space | 99.55% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: VAVRA
Current User Name: HP Authorized Custom
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [- Browse path with PeaZip] -- "C:\Program Files\PeaZip\PEAZIP.EXE" "-ext2browsepath" "%1" (Giorgio Tani)
Directory [+ Add to .7Z] -- "C:\Program Files\PeaZip\PEAZIP.EXE" "-add2multi7z" "%1" (Giorgio Tani)
Directory [+ Add to .ZIP] -- "C:\Program Files\PeaZip\PEAZIP.EXE" "-add2multizip" "%1" (Giorgio Tani)
Directory [+ Add to archive] -- "C:\Program Files\PeaZip\PEAZIP.EXE" "-add2multi" "%1" (Giorgio Tani)
Directory [+ Add to self-extracting archive] -- "C:\Program Files\PeaZip\PEAZIP.EXE" "-add2multisfx" "%1" (Giorgio Tani)
Directory [+ Add to separate archive(s)] -- "C:\Program Files\PeaZip\PEAZIP.EXE" "-add2archive" "%1" (Giorgio Tani)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{44635DD7-3F85-4368-8186-6A662A03714C}" = HP_WildTangent_Games
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1" = PeaZip 3.0
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0B165DC-F037-483F-B1C9-D89D91529CEB}" = Citrix XenApp Web Plugin
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{FAF7F1D7-C0E7-47EA-8AAA-84E4F9EA3C94}" = Works Suite OS Pack
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ATT-HSI" = ATT-HSI
"ATT-SST" = AT&T Self Support Tool
"avast5" = avast! Free Antivirus
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"ERUNT_is1" = ERUNT 1.1j
"HP Photo Printing Software" = HP Photo Printing Software
"hp photosmart 1218 series" = hp photosmart 1218 series (Remove only)
"ie8" = Windows Internet Explorer 8
"InterVideo WinDVD" = InterVideo WinDVD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"My Photo Center" = My Photo Center
"NTREGOPT_is1" = NTREGOPT 1.1j
"PCDoctor WINDSAPI SDK" = PC-Doctor for Windows
"PS2" = PS2
"Python 1.5 combined Win32 extensions" = Python 1.5 combined Win32 extensions
"Python 1.5.2 (final)" = Python 1.5.2 (final)
"QuickLink III" = QuickLink III
"Remove on Reboot Shell Extension_is1" = Remove on Reboot Shell Extension
"Revo Uninstaller" = Revo Uninstaller 1.88
"Sandboxie" = Sandboxie 3.442
"SBPCIUnInstall" = Creative PCI Audio Drivers
"SMART PANEL for Scanner" = EPSON SMART PANEL for Scanner
"Speccy" = Speccy
"Surfbrd" = HP Internet Center
"Tcl 8.0.5 for Windows" = Tcl 8.0.5 for Windows
"TextBridge Pro 8.0" = TextBridge Pro 8.0
"Trellix2DeinstKey9" = Trellix Web
"Unlocker" = Unlocker 1.8.5
"Windows" = Windows XP Uninstall
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/3/2010 12:54:03 PM | Computer Name = VAVRA | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/3/2010 6:49:02 PM | Computer Name = VAVRA | Source = Ci | ID = 4126
Description = Cleaning up corrupt content index metadata on f:\system volume information\catalog.wci.
Index will be automatically restored by refiltering all documents.

Error - 6/5/2010 4:16:36 AM | Computer Name = VAVRA | Source = Google Update | ID = 20
Description =

Error - 6/5/2010 4:29:20 AM | Computer Name = VAVRA | Source = Google Update | ID = 20
Description =

Error - 6/8/2010 8:40:48 AM | Computer Name = VAVRA | Source = Ci | ID = 4124
Description = Content index on f:\system volume information\catalog.wci is corrupt.
Please shutdown and restart the Indexing Service (cisvc).

Error - 6/8/2010 8:40:48 AM | Computer Name = VAVRA | Source = Ci | ID = 4126
Description = Cleaning up corrupt content index metadata on f:\system volume information\catalog.wci.
Index will be automatically restored by refiltering all documents.

Error - 6/9/2010 7:50:44 AM | Computer Name = VAVRA | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/10/2010 1:52:50 AM | Computer Name = VAVRA | Source = Google Update | ID = 20
Description =

Error - 6/10/2010 2:53:59 AM | Computer Name = VAVRA | Source = Ci | ID = 4124
Description = Content index on f:\system volume information\catalog.wci is corrupt.
Please shutdown and restart the Indexing Service (cisvc).

Error - 6/10/2010 2:53:59 AM | Computer Name = VAVRA | Source = Ci | ID = 4126
Description = Cleaning up corrupt content index metadata on f:\system volume information\catalog.wci.
Index will be automatically restored by refiltering all documents.

[ System Events ]
Error - 9/17/2010 3:48:33 AM | Computer Name = VAVRA | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.64 for the Network Card with network
address 0010B5C6E383 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/17/2010 3:52:09 AM | Computer Name = VAVRA | Source = Service Control Manager | ID = 7034
Description = The Indexing Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/17/2010 3:52:11 AM | Computer Name = VAVRA | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/17/2010 4:01:38 AM | Computer Name = VAVRA | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_UNLOCKERDRIVER5\0000 disappeared from the system
without first being prepared for removal.

Error - 9/17/2010 4:10:38 AM | Computer Name = VAVRA | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.64 for the Network Card with network
address 0010B5C6E383 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/17/2010 7:33:22 AM | Computer Name = VAVRA | Source = ACPI | ID = 327685
Description = AMLI: ACPI BIOS is attempting to write to an illegal IO port address
(0x70), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 9/17/2010 7:33:22 AM | Computer Name = VAVRA | Source = ACPI | ID = 327684
Description = AMLI: ACPI BIOS is attempting to read from an illegal IO port address
(0x71), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 9/17/2010 7:33:22 AM | Computer Name = VAVRA | Source = ACPI | ID = 327690
Description = ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation
Region (0x4), Please contact your system vendor for technical assistance.

Error - 9/17/2010 7:33:22 AM | Computer Name = VAVRA | Source = Dhcp | ID = 1000
Description = Your computer has lost the lease to its IP address 76.213.226.167
on the Network Card with network address 0010B5C6E383.

Error - 9/18/2010 5:15:33 PM | Computer Name = VAVRA | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.64 for the Network Card with network
address 0010B5C6E383 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

< End of report >

broni · 2010/09/19

You have very little of RAM:

383.00 Mb Total Physical Memory
Click to expand...

XP would like to have at least 512MB of RAM (1GB ideally).

=================================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso4.cab (Reg Error: Key error.)
O16 - DPF: Win32 Classes Reg Error: Key error. (Reg Error: Key error.)


:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
==============================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Go to Kaspersky website and perform an online antivirus scan.

Disable your active antivirus program.

Read through the requirements and privacy statement and click on Accept button.

It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.

When the downloads have finished, click on Settings.

Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

Spyware, Adware, Dialers, and other potentially dangerous programs

Archives

Mail databases

Click on My Computer under Scan.

Once the scan is complete, it will display the results. Click on View Scan Report.

You will see a list of infected items there. Click on Save Report As....

Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Log in or Sign up

Solved Scans requested by BRONI- RE: "Hardware Interruptions" - Part 1

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Scans requested by BRONI- RE: "Hardware Interruptions" - Part 1

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

ravn87 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches