Solved Need help with XP machine that won't run in normal mode

broni · 2010/09/19

Your MBAM log says "No action taken" after each line.
I need you to FIX everything.
Please, redo.

BillB · 2010/09/20

I reran mbam in safe mode, it found fewer items this time but looks like they were fixed. I still can't get it to run in normal mode, nothing happens when I click on it or try to right click and select open. I am posting from the machine now though in normal mode.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4660

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 6.0.2900.2180

9/20/2010 5:39:19 PM
mbam-log-2010-09-20 (17-39-19).txt

Scan type: Full scan (C:\|)
Objects scanned: 211575
Time elapsed: 33 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\cabaxmur.dll (Trojan.Hiloti) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vzeyogoyineba (Trojan.Hiloti) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{69c84e31-f646-65ff-e015-44f40cc23564} (Trojan.ZbotR.Gen) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.IRCBot) -> Data: c:\program files\quicktime\qttasksrv.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\program files\microsoft\desktoplayer.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (c:\windows\system32\userinit.exe,,c:\program files\quicktime\qttasksrv.exe,c:\program files\microsoft\desktoplayer.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\cabaxmur.dll (Trojan.Hiloti) -> Delete on reboot.
C:\Program Files\QuickTime\QTTaskSrv.exe (Backdoor.IRCBot) -> Quarantined and deleted successfully.
C:\Program Files\riv7\setup.exe.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft\desktoplayer.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Owner\Application Data\Efino\iftiz.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

broni · 2010/09/20

Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under "Configuration and Preferences ", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):

Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.

* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan ", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK ".
* Make sure everything has a checkmark next to it and click "Next ".
* A notification will appear that "Quarantine and Removal is Complete ". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes ".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.

Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.

* Click Close to exit the program.
Post SUPERAntiSpyware log.

==============================================================

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Alternative download: http://majorgeeks.com/Dr.Web_CureIT_d4783.html

Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.

This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.

Once the short scan has finished, select Complete scan.

Click the green arrow at the right, and the scan will start.

Click Yes to all if it asks if you want to cure/move the file.

When the scan has finished, in the menu, click File and choose Save report list

Save the report to your desktop. The report will be called DrWeb.csv

Close Dr.Web Cureit.

[color=5]Important![/color] Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.

BillB · 2010/09/21

Here are the logs;

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/20/2010 at 08:09 PM

Application Version : 4.43.1000

Core Rules Database Version : 5524
Trace Rules Database Version: 3336

Scan type : Complete Scan
Total Scan Time : 00:44:49

Memory items scanned : 237
Memory threats detected : 0
Registry items scanned : 7552
Registry threats detected : 0
File items scanned : 24868
File threats detected : 12

Adware.Tracking Cookie
C:\Documents and Settings\Owner\Cookies\owner@mywebsearch[2].txt
C:\Documents and Settings\Owner\Cookies\owner@cgi-bin[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ad.wsod[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.infinisource[2].txt
C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt
C:\Documents and Settings\Owner\Cookies\owner@insightexpressai[1].txt
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt
core.insightexpressai.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\DHLLYHXR ]
media.scanscout.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\DHLLYHXR ]
secure-us.imrworldwide.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\DHLLYHXR ]

Trojan.SVCHost/Fake
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\SVCHOST.EXE

Trojan.Agent/Gen-Nullo[Short]
C:\QOOBOX\QUARANTINE\C\WINDOWS\ALCXMNTR.EXE.VIR

BillB · 2010/09/21

How can I post the DrWeb log, it is too big to copy and too big to attach?

broni · 2010/09/21

Upload the file(s) here: http://www.filedropper.com/
Post download link (copy URL: link):

BillB · 2010/09/21

Do you have to sign up or something first? I clicked on the file to upload, then it gives me a 'http 404 file not found' page and that's it.

broni · 2010/09/21

No, you don't have to sign up.
Maybe they're having some temporary problems.

Try here: http://uploadmb.com/

BillB · 2010/09/21

I think that worked, try here;

http://www.uploadmb.com/dw.php?id=1285113431

broni · 2010/09/21

Very well.

How is computer doing in normal mode?

Delete your Combofix file, download fresh one, post new log.

BillB · 2010/09/21

The machine is doing much better in normal mode now, Superantispyware is running again. Here's the new combofix log;

ComboFix 10-09-21.01 - Owner 09/21/2010 21:37:03.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.219 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\Locu\ufny.exe
c:\documents and settings\Owner\Local Settings\Application Data\{680CC687-5184-466E-B42F-6EF095245ABA}
c:\documents and settings\Owner\Local Settings\Application Data\{680CC687-5184-466E-B42F-6EF095245ABA}\chrome.manifest
c:\documents and settings\Owner\Local Settings\Application Data\{680CC687-5184-466E-B42F-6EF095245ABA}\chrome\content\_cfg.js
c:\documents and settings\Owner\Local Settings\Application Data\{680CC687-5184-466E-B42F-6EF095245ABA}\chrome\content\overlay.xul
c:\documents and settings\Owner\Local Settings\Application Data\{680CC687-5184-466E-B42F-6EF095245ABA}\install.rdf
c:\program files\Internet Explorer\complete.dat
c:\program files\Internet Explorer\dmlconf.dat
c:\windows\cabaxmur.dll
c:\windows\igidejuzakaxodem.dll

.
((((((((((((((((((((((((( Files Created from 2010-08-22 to 2010-09-22 )))))))))))))))))))))))))))))))
.

2010-09-21 17:08 . 2010-09-21 17:08 -------- d-----w- C:\found.000
2010-09-21 01:18 . 2010-09-21 03:09 -------- d-----w- c:\documents and settings\Owner\DoctorWeb
2010-09-20 21:06 . 2010-09-21 23:56 120 ----a-w- c:\windows\Rcuheriyovu.dat
2010-09-20 21:06 . 2010-09-21 09:05 0 ----a-w- c:\windows\Byivofibu.bin
2010-09-20 21:04 . 2010-09-21 17:09 -------- d-----w- c:\program files\riv7
2010-09-19 13:23 . 2010-09-19 16:43 -------- d-----w- c:\program files\sys32
2010-09-19 13:23 . 2010-09-21 09:05 -------- d-----w- c:\program files\riv87
2010-09-19 04:26 . 2004-08-04 06:10 61056 -c--a-w- c:\windows\system32\dllcache\ohci1394.sys
2010-09-19 04:26 . 2004-08-04 06:10 61056 ----a-w- c:\windows\system32\drivers\ohci1394.sys
2010-09-19 00:53 . 2010-06-14 14:30 743936 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-17 16:45 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-17 16:45 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-17 16:45 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-17 16:45 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-17 16:45 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-17 16:45 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-17 16:45 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-09-17 16:45 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-09-17 16:45 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-17 16:44 . 2010-09-17 16:44 -------- d-----w- c:\program files\Alwil Software
2010-09-17 16:44 . 2010-09-17 16:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-09-17 15:22 . 2010-09-21 21:45 63488 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-17 15:22 . 2010-09-17 16:15 52224 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-17 15:22 . 2010-09-21 21:45 117760 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-17 15:22 . 2010-09-17 15:22 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-09-17 15:22 . 2010-09-17 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-09-17 15:22 . 2010-09-17 16:34 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-09-17 14:38 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-17 14:38 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-17 14:36 . 2010-09-17 14:38 -------- d-----w- C:\tmp
2010-09-17 14:30 . 2010-09-17 14:30 -------- d-----w- C:\log

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-22 01:43 . 2010-05-22 03:25 -------- d-----w- c:\documents and settings\Owner\Application Data\Locu
2010-09-22 01:32 . 2006-07-21 02:11 -------- d-----w- c:\documents and settings\Owner\Application Data\Omkey
2010-09-21 17:09 . 2010-07-19 20:04 -------- d-----w- c:\program files\Microsoft
2010-09-21 06:22 . 2009-05-27 17:42 -------- d-----w- c:\program files\Verizon
2010-09-21 06:13 . 2008-06-07 21:47 -------- d-----w- c:\program files\QuickTime
2010-09-21 05:43 . 2004-04-02 09:58 -------- d-----w- c:\program files\Microsoft Works
2010-09-21 05:36 . 2004-04-02 09:54 -------- d-----w- c:\program files\Microsoft Plus! Digital Media Edition
2010-09-21 04:59 . 2008-06-07 21:49 -------- d-----w- c:\program files\iTunes
2010-09-21 04:32 . 2004-04-03 00:21 -------- d-----w- c:\program files\Easy Internet signup
2010-09-21 04:08 . 2004-09-12 19:53 -------- d-----w- c:\program files\America Online 9.0
2010-09-20 21:39 . 2009-10-17 01:07 -------- d-----w- c:\documents and settings\Owner\Application Data\Irfy
2010-09-20 21:39 . 2009-11-22 00:23 -------- d-----w- c:\documents and settings\Owner\Application Data\Efino
2010-09-19 16:43 . 2009-01-30 00:59 -------- d-----w- c:\documents and settings\Owner\Application Data\Fusia
2010-09-19 13:23 . 2010-04-02 21:43 -------- d-----w- c:\documents and settings\Owner\Application Data\Soha
2010-09-18 22:53 . 2002-08-29 08:05 37376 ----a-w- c:\windows\system32\drivers\amdk7.sys
2010-09-18 19:41 . 2010-07-19 20:04 -------- d-----w- c:\program files\riva
2010-09-17 16:38 . 2010-08-01 21:02 452104 ----a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.12\setup.exe
2010-09-17 16:30 . 2004-09-18 04:42 -------- d-----w- c:\program files\AIM
2010-09-17 16:23 . 2004-09-12 19:53 -------- d-----w- c:\program files\Common Files\AOL
2010-09-17 14:30 . 2009-05-27 19:28 -------- d-----w- c:\documents and settings\Owner\Application Data\Verizon
2010-09-17 14:30 . 2009-05-27 19:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon
2010-09-17 00:10 . 2009-05-27 20:19 99908 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-09-17 00:10 . 2009-05-27 20:19 1148960 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-09-17 00:10 . 2009-05-27 20:19 324764 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-09-17 00:10 . 2009-05-27 20:19 24607776 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-08-24 00:46 . 2010-08-09 13:49 -------- d-----w- c:\program files\riv
2010-08-14 17:46 . 2010-04-01 14:59 45056 ----a-w- c:\documents and settings\Owner\Application Data\Verizon\VSP\downloads\VerizonVasDetectionScripts.v6.41.zip.dir\resources\McAfeeSecurityScanIcon.v2-1-119-2.exe
2010-08-09 23:28 . 2009-05-27 17:51 -------- d-----w- c:\program files\Common Files\Motive
2010-08-04 00:33 . 2004-04-03 00:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2010-08-01 09:23 . 2008-06-07 21:47 -------- d-----w- c:\program files\Apple Software Update
2010-07-26 20:48 . 2006-03-23 23:06 -------- d-----w- c:\program files\Google
2010-07-26 00:22 . 2008-02-06 01:49 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-07-25 14:48 . 2010-07-21 21:39 -------- d-----w- c:\program files\RMNetwork
2010-07-19 20:10 . 2009-03-04 19:32 68608 -c--a-w- c:\documents and settings\Owner\Application Data\Verizon\VSP\downloads\Verizon_VISS_Mac_Promotion_Campaign.18467.zip.dir\en\tools\RpsInstallerFinder.exe
2010-07-19 20:10 . 2007-12-30 17:53 110592 -c--a-w- c:\documents and settings\Owner\Application Data\U3\temp\cleanup.exe
2010-07-19 20:10 . 2006-11-29 21:42 1650688 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\LPSecurityExtension.dll
2010-07-19 20:10 . 2006-11-05 14:44 1163264 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\u3dapi10.dll
2010-07-19 20:10 . 2006-10-12 21:38 49152 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\U3AccessGrant.exe
2010-07-19 20:10 . 2007-02-07 17:45 3477504 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\Launchpad.exe
2010-07-19 20:10 . 2006-08-15 15:15 110592 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\cleanup.exe
2010-07-19 20:09 . 2006-04-18 08:15 172032 -c--a-w- c:\documents and settings\Owner\Application Data\Juniper Networks\Host Checker\EPCheck.dll
2010-07-19 20:09 . 2008-06-07 19:42 536576 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll
2010-07-19 20:09 . 2008-06-07 19:42 200704 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll
2010-07-19 20:09 . 2008-06-07 19:42 102400 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll
2010-07-19 20:06 . 2004-09-15 01:23 344064 -c--a-w- c:\documents and settings\All Users\Application Data\PopCap\PopCapLoader\Shockwave\insaniquarium\Insaniquarium.dll
2010-07-19 20:06 . 2005-03-19 21:24 401408 -c--a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_3f1_9bd5a28\EasyShrx.Dll
2010-07-19 20:04 . 2006-06-21 23:06 14336 -c--a-w- c:\documents and settings\All Users\Application Data\AOL\C_America Online 9.0\OptClean.exe
2010-07-19 20:04 . 2005-03-20 19:45 10752 -c--a-w- c:\documents and settings\All Users\Application Data\AOL\C_America Online 9.0\OptScan.exe
2010-07-19 20:04 . 2007-12-29 16:02 110592 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\temp\cleanup.exe
2010-07-19 20:04 . 2006-11-05 14:44 1163264 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\u3dapi10.dll
2010-07-19 20:04 . 2006-11-29 21:42 1650688 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\LPSecurityExtension.dll
2010-07-19 20:04 . 2006-10-12 21:38 49152 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\U3AccessGrant.exe
2010-07-19 20:04 . 2007-02-07 17:45 3477504 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\Launchpad.exe
2010-07-19 20:04 . 2006-08-15 15:15 110592 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\cleanup.exe
2010-07-02 00:39 . 2010-05-12 23:28 439816 ----a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b} "= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
2009-07-02 14:18 2215960 ----a-w- c:\program files\ToggleEN\tbTogg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-09 02:08 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b} "= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WebAgent]
@= "{D540B3B0-7DA0-4AA5-B548-236124A56CD0} "
[HKEY_CLASSES_ROOT\CLSID\{D540B3B0-7DA0-4AA5-B548-236124A56CD0}]
2010-07-21 21:39 161792 ----a-w- c:\program files\RMNetwork\webagent.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-09-17 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-08-01 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Verizon_McciTrayApp "= "c:\program files\Verizon\McciTrayApp.exe" [2010-08-01 1565696]
"VerizonServicepoint.exe "= "c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2009-03-12 2303216]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-11-20 180269]
"Twoseguwivi "= "c:\windows\igidejuzakaxodem.dll" [BU]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2010-09-17 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2010-09-17 15:40 595456 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-01-19 16:45 10536 ----a-w- c:\program files\Citrix\GoToAssist\508\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^findfast.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TA_Start.lnk]
backup=c:\windows\pss\TA_Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Think-Adz.lnk]
backup=c:\windows\pss\Think-Adz.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-03-04 16:01 88209 -c--a-w- c:\windows\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
2010-07-19 20:21 102400 ----a-w- c:\program files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2010-07-19 20:24 49152 -c--a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
1998-05-08 00:04 52736 -c--a-w- c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2010-07-19 20:13 61440 -c--a-w- c:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
2003-06-19 03:00 200704 -c--a-w- c:\program files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-01 22:25 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2004-04-02 08:49 32881 -c--a-w- c:\program files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2005-11-20 00:02 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\wt\\webdriver\\4.1.1\\wthost.exe "=
"c:\\Program Files\\America Online 9.0\\waol.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13066:TCP "= 13066:TCP:spport
"23208:TCP "= 23208:TCP:spport
"14064:TCP "= 14064:TCP:spport
"5688:TCP "= 5688:TCP:spport
"26854:TCP "= 26854:TCP:spport
"19089:TCP "= 19089:TCP:spport
"24565:TCP "= 24565:TCP:spport
"29918:TCP "= 29918:TCP:spport
"27867:TCP "= 27867:TCP:spport
"17731:TCP "= 17731:TCP:spport
"18641:TCP "= 18641:TCP:spport
"24206:TCP "= 24206:TCP:spport
"9883:TCP "= 9883:TCP:spport
"19177:TCP "= 19177:TCP:spport
"15239:TCP "= 15239:TCP:spport

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [9/17/2010 12:45 PM 165456]
R1 NEOFLTR_510_10575;Juniper Networks TDI Filter Driver (NEOFLTR_510_10575);c:\windows\system32\drivers\NEOFLTR_510_10575.sys [4/18/2006 4:08 AM 57063]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/17/2010 12:45 PM 17744]
S2 mrtRate;mrtRate; [x]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [9/11/2004 7:21 PM 20160]
.
Contents of the 'Scheduled Tasks' folder

2010-08-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:57]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
DPF: {B8E73359-3422-4384-8D27-4EA1B4C01232} - hxxps://wcac.magellanhealth.com/+CSCOL+/cscopf.cab
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Vzeyogoyineba - c:\windows\cabaxmur.dll
HKCU-Run-{69C84E31-F646-65FF-E015-44F40CC23564} - c:\documents and settings\Owner\Application Data\Locu\ufny.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-21 21:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\program files\Citrix\GoToAssist\508\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(3916)
c:\program files\RMNetwork\webagent.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.EXE
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wdfmgr.exe
c:\windows\wanmpsvc.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-09-21 21:53:11 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-22 01:53
ComboFix2.txt 2010-09-19 13:31
ComboFix3.txt 2010-09-19 05:08
ComboFix4.txt 2010-09-18 23:50
ComboFix5.txt 2010-09-22 01:35

Pre-Run: 141,425,737,728 bytes free
Post-Run: 141,480,644,608 bytes free

- - End Of File - - 911E340C94BFA996C99D76F29B1BF851

broni · 2010/09/21

Good news

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\windows\Rcuheriyovu.dat
c:\windows\Byivofibu.bin
c:\windows\igidejuzakaxodem.dll


DirLook::
c:\program files\riv7
c:\program files\sys32
c:\program files\riv87
c:\program files\riv


Folder::
c:\documents and settings\Owner\Application Data\Locu
c:\documents and settings\Owner\Application Data\Omkey
c:\documents and settings\Owner\Application Data\Irfy
c:\documents and settings\Owner\Application Data\Efino
c:\documents and settings\Owner\Application Data\Fusia
c:\documents and settings\Owner\Application Data\Soha
c:\program files\AskBarDis


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
 "{3041d03e-fd4b-44e0-b742-2d9b88305f98} "=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
 "{3041D03E-FD4B-44E0-B742-2D9B88305F98} "=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "Twoseguwivi "=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[IMG]

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

BillB · 2010/09/22

Here's the new combofix log;

ComboFix 10-09-21.03 - Owner 09/22/2010 8:26.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.108 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\Efino
c:\documents and settings\Owner\Application Data\Fusia
c:\documents and settings\Owner\Application Data\Irfy
c:\documents and settings\Owner\Application Data\Locu
c:\documents and settings\Owner\Application Data\Omkey
c:\documents and settings\Owner\Application Data\Soha
c:\documents and settings\Owner\Application Data\Soha\ximu.tmp
c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\00013B6E.bin
c:\program files\AskBarDis\bar\Cache\00013D33.bin
c:\program files\AskBarDis\bar\Cache\00013DFE.bin
c:\program files\AskBarDis\bar\Cache\00013F56.bin
c:\program files\AskBarDis\bar\Cache\00013FE2.bin
c:\program files\AskBarDis\bar\Cache\0001408E.bin
c:\program files\AskBarDis\bar\Cache\0004B979
c:\program files\AskBarDis\bar\Cache\0004C05E
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\PopSwatter\History\allowed
c:\program files\AskBarDis\PopSwatter\History\notallow
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe

.
((((((((((((((((((((((((( Files Created from 2010-08-22 to 2010-09-22 )))))))))))))))))))))))))))))))
.

2010-09-21 17:08 . 2010-09-21 17:08 -------- d-----w- C:\found.000
2010-09-21 01:18 . 2010-09-21 03:09 -------- d-----w- c:\documents and settings\Owner\DoctorWeb
2010-09-20 21:06 . 2010-09-21 23:56 120 ----a-w- c:\windows\Rcuheriyovu.dat
2010-09-20 21:06 . 2010-09-21 09:05 0 ----a-w- c:\windows\Byivofibu.bin
2010-09-20 21:04 . 2010-09-21 17:09 -------- d-----w- c:\program files\riv7
2010-09-19 13:23 . 2010-09-19 16:43 -------- d-----w- c:\program files\sys32
2010-09-19 13:23 . 2010-09-21 09:05 -------- d-----w- c:\program files\riv87
2010-09-19 04:26 . 2004-08-04 06:10 61056 -c--a-w- c:\windows\system32\dllcache\ohci1394.sys
2010-09-19 04:26 . 2004-08-04 06:10 61056 ----a-w- c:\windows\system32\drivers\ohci1394.sys
2010-09-19 00:53 . 2010-06-14 14:30 743936 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-17 16:45 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-17 16:45 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-17 16:45 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-17 16:45 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-17 16:45 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-17 16:45 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-17 16:45 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-09-17 16:45 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-09-17 16:45 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-17 16:44 . 2010-09-17 16:44 -------- d-----w- c:\program files\Alwil Software
2010-09-17 16:44 . 2010-09-17 16:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-09-17 15:22 . 2010-09-21 21:45 63488 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-17 15:22 . 2010-09-17 16:15 52224 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-17 15:22 . 2010-09-21 21:45 117760 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-17 15:22 . 2010-09-17 15:22 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-09-17 15:22 . 2010-09-17 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-09-17 15:22 . 2010-09-17 16:34 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-09-17 14:38 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-17 14:38 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-17 14:36 . 2010-09-17 14:38 -------- d-----w- C:\tmp
2010-09-17 14:30 . 2010-09-17 14:30 -------- d-----w- C:\log

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-21 17:09 . 2010-07-19 20:04 -------- d-----w- c:\program files\Microsoft
2010-09-21 06:22 . 2009-05-27 17:42 -------- d-----w- c:\program files\Verizon
2010-09-21 06:13 . 2008-06-07 21:47 -------- d-----w- c:\program files\QuickTime
2010-09-21 05:43 . 2004-04-02 09:58 -------- d-----w- c:\program files\Microsoft Works
2010-09-21 05:36 . 2004-04-02 09:54 -------- d-----w- c:\program files\Microsoft Plus! Digital Media Edition
2010-09-21 04:59 . 2008-06-07 21:49 -------- d-----w- c:\program files\iTunes
2010-09-21 04:32 . 2004-04-03 00:21 -------- d-----w- c:\program files\Easy Internet signup
2010-09-21 04:08 . 2004-09-12 19:53 -------- d-----w- c:\program files\America Online 9.0
2010-09-18 22:53 . 2002-08-29 08:05 37376 ----a-w- c:\windows\system32\drivers\amdk7.sys
2010-09-18 19:41 . 2010-07-19 20:04 -------- d-----w- c:\program files\riva
2010-09-17 16:38 . 2010-08-01 21:02 452104 ----a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.12\setup.exe
2010-09-17 16:30 . 2004-09-18 04:42 -------- d-----w- c:\program files\AIM
2010-09-17 16:23 . 2004-09-12 19:53 -------- d-----w- c:\program files\Common Files\AOL
2010-09-17 14:30 . 2009-05-27 19:28 -------- d-----w- c:\documents and settings\Owner\Application Data\Verizon
2010-09-17 14:30 . 2009-05-27 19:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon
2010-09-17 00:10 . 2009-05-27 20:19 99908 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-09-17 00:10 . 2009-05-27 20:19 1148960 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-09-17 00:10 . 2009-05-27 20:19 324764 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-09-17 00:10 . 2009-05-27 20:19 24607776 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-08-24 00:46 . 2010-08-09 13:49 -------- d-----w- c:\program files\riv
2010-08-14 17:46 . 2010-04-01 14:59 45056 ----a-w- c:\documents and settings\Owner\Application Data\Verizon\VSP\downloads\VerizonVasDetectionScripts.v6.41.zip.dir\resources\McAfeeSecurityScanIcon.v2-1-119-2.exe
2010-08-09 23:28 . 2009-05-27 17:51 -------- d-----w- c:\program files\Common Files\Motive
2010-08-04 00:33 . 2004-04-03 00:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2010-08-01 09:23 . 2008-06-07 21:47 -------- d-----w- c:\program files\Apple Software Update
2010-07-26 20:48 . 2006-03-23 23:06 -------- d-----w- c:\program files\Google
2010-07-26 00:22 . 2008-02-06 01:49 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-07-25 14:48 . 2010-07-21 21:39 -------- d-----w- c:\program files\RMNetwork
2010-07-19 20:10 . 2009-03-04 19:32 68608 -c--a-w- c:\documents and settings\Owner\Application Data\Verizon\VSP\downloads\Verizon_VISS_Mac_Promotion_Campaign.18467.zip.dir\en\tools\RpsInstallerFinder.exe
2010-07-19 20:10 . 2007-12-30 17:53 110592 -c--a-w- c:\documents and settings\Owner\Application Data\U3\temp\cleanup.exe
2010-07-19 20:10 . 2006-11-29 21:42 1650688 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\LPSecurityExtension.dll
2010-07-19 20:10 . 2006-11-05 14:44 1163264 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\u3dapi10.dll
2010-07-19 20:10 . 2006-10-12 21:38 49152 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\U3AccessGrant.exe
2010-07-19 20:10 . 2007-02-07 17:45 3477504 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\Launchpad.exe
2010-07-19 20:10 . 2006-08-15 15:15 110592 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\cleanup.exe
2010-07-19 20:09 . 2006-04-18 08:15 172032 -c--a-w- c:\documents and settings\Owner\Application Data\Juniper Networks\Host Checker\EPCheck.dll
2010-07-19 20:09 . 2008-06-07 19:42 536576 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll
2010-07-19 20:09 . 2008-06-07 19:42 200704 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll
2010-07-19 20:09 . 2008-06-07 19:42 102400 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll
2010-07-19 20:06 . 2004-09-15 01:23 344064 -c--a-w- c:\documents and settings\All Users\Application Data\PopCap\PopCapLoader\Shockwave\insaniquarium\Insaniquarium.dll
2010-07-19 20:06 . 2005-03-19 21:24 401408 -c--a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_3f1_9bd5a28\EasyShrx.Dll
2010-07-19 20:04 . 2006-06-21 23:06 14336 -c--a-w- c:\documents and settings\All Users\Application Data\AOL\C_America Online 9.0\OptClean.exe
2010-07-19 20:04 . 2005-03-20 19:45 10752 -c--a-w- c:\documents and settings\All Users\Application Data\AOL\C_America Online 9.0\OptScan.exe
2010-07-19 20:04 . 2007-12-29 16:02 110592 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\temp\cleanup.exe
2010-07-19 20:04 . 2006-11-05 14:44 1163264 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\u3dapi10.dll
2010-07-19 20:04 . 2006-11-29 21:42 1650688 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\LPSecurityExtension.dll
2010-07-19 20:04 . 2006-10-12 21:38 49152 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\U3AccessGrant.exe
2010-07-19 20:04 . 2007-02-07 17:45 3477504 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\Launchpad.exe
2010-07-19 20:04 . 2006-08-15 15:15 110592 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\cleanup.exe
2010-07-02 00:39 . 2010-05-12 23:28 439816 ----a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\setup.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\program files\riv ----

2010-08-24 00:46 . 2010-08-24 01:03 49664 ----a-w- c:\program files\riv\MIX.exe

---- Directory of c:\program files\riv7 ----

---- Directory of c:\program files\riv87 ----

---- Directory of c:\program files\sys32 ----

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b} "= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
2009-07-02 14:18 2215960 ----a-w- c:\program files\ToggleEN\tbTogg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b} "= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WebAgent]
@= "{D540B3B0-7DA0-4AA5-B548-236124A56CD0} "
[HKEY_CLASSES_ROOT\CLSID\{D540B3B0-7DA0-4AA5-B548-236124A56CD0}]
2010-07-21 21:39 161792 ----a-w- c:\program files\RMNetwork\webagent.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-09-17 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-08-01 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Verizon_McciTrayApp "= "c:\program files\Verizon\McciTrayApp.exe" [2010-08-01 1565696]
"VerizonServicepoint.exe "= "c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2009-03-12 2303216]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-11-20 180269]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2010-09-17 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2010-09-17 15:40 595456 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-01-19 16:45 10536 ----a-w- c:\program files\Citrix\GoToAssist\508\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs "=1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^findfast.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TA_Start.lnk]
backup=c:\windows\pss\TA_Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Think-Adz.lnk]
backup=c:\windows\pss\Think-Adz.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-03-04 16:01 88209 -c--a-w- c:\windows\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
2010-07-19 20:21 102400 ----a-w- c:\program files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2010-07-19 20:24 49152 -c--a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
1998-05-08 00:04 52736 -c--a-w- c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2010-07-19 20:13 61440 -c--a-w- c:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
2003-06-19 03:00 200704 -c--a-w- c:\program files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-01 22:25 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2004-04-02 08:49 32881 -c--a-w- c:\program files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2005-11-20 00:02 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\wt\\webdriver\\4.1.1\\wthost.exe "=
"c:\\Program Files\\America Online 9.0\\waol.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13066:TCP "= 13066:TCP:spport
"23208:TCP "= 23208:TCP:spport
"14064:TCP "= 14064:TCP:spport
"5688:TCP "= 5688:TCP:spport
"26854:TCP "= 26854:TCP:spport
"19089:TCP "= 19089:TCP:spport
"24565:TCP "= 24565:TCP:spport
"29918:TCP "= 29918:TCP:spport
"27867:TCP "= 27867:TCP:spport
"17731:TCP "= 17731:TCP:spport
"18641:TCP "= 18641:TCP:spport
"24206:TCP "= 24206:TCP:spport
"9883:TCP "= 9883:TCP:spport
"19177:TCP "= 19177:TCP:spport
"15239:TCP "= 15239:TCP:spport

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [9/17/2010 12:45 PM 165456]
R1 NEOFLTR_510_10575;Juniper Networks TDI Filter Driver (NEOFLTR_510_10575);c:\windows\system32\drivers\NEOFLTR_510_10575.sys [4/18/2006 4:08 AM 57063]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/17/2010 12:45 PM 17744]
S2 mrtRate;mrtRate; [x]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [9/11/2004 7:21 PM 20160]
.
Contents of the 'Scheduled Tasks' folder

2010-08-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:57]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
DPF: {B8E73359-3422-4384-8D27-4EA1B4C01232} - hxxps://wcac.magellanhealth.com/+CSCOL+/cscopf.cab
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-22 08:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\program files\Citrix\GoToAssist\508\G2AWinLogon.dll
.
Completion time: 2010-09-22 08:35:47
ComboFix-quarantined-files.txt 2010-09-22 12:35
ComboFix2.txt 2010-09-22 01:53
ComboFix3.txt 2010-09-19 13:31
ComboFix4.txt 2010-09-19 05:08
ComboFix5.txt 2010-09-22 12:24

Pre-Run: 141,472,620,544 bytes free
Post-Run: 141,456,465,920 bytes free

- - End Of File - - 86643F7CE8F156A6DE7377350C02155D

broni · 2010/09/22

It looks better and better

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\Rcuheriyovu.dat
c:\windows\Byivofibu.bin


Folder::
c:\program files\riv
c:\program files\riv7
c:\program files\riv87
c:\program files\sys32
3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

BillB · 2010/09/22

I started combofix with the script you posted, it did an update then started to run. It has been sitting at the screen saying preparing log report for over an hour now and there is a window that says 'ReGt.cfxxe application error, application failed to initialize properly (0xC0000005) click ok to terminate the application'. When you click ok, the window just pops up again. Combofix has apparently stopped executing. Should I just reboot?

broni · 2010/09/22

Yes and run it again.

BillB · 2010/09/22

Guess I just hadn't clicked 'ok' enough times, that window finally cleared and combofix log appeared, along with another window about regedit.exe failing with the same code. Here's the log file;

ComboFix 10-09-22.02 - Owner 09/22/2010 16:18:42.7.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.195 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

FILE ::
"c:\windows\Byivofibu.bin "
"c:\windows\Rcuheriyovu.dat "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\riv
c:\program files\riv\MIX.exe
c:\program files\riv7
c:\program files\riv87
c:\program files\sys32
c:\windows\Byivofibu.bin
c:\windows\Rcuheriyovu.dat

.
((((((((((((((((((((((((( Files Created from 2010-08-22 to 2010-09-22 )))))))))))))))))))))))))))))))
.

2010-09-21 17:08 . 2010-09-21 17:08 -------- d-----w- C:\found.000
2010-09-21 01:18 . 2010-09-21 03:09 -------- d-----w- c:\documents and settings\Owner\DoctorWeb
2010-09-19 04:26 . 2004-08-04 06:10 61056 -c--a-w- c:\windows\system32\dllcache\ohci1394.sys
2010-09-19 04:26 . 2004-08-04 06:10 61056 ----a-w- c:\windows\system32\drivers\ohci1394.sys
2010-09-19 00:53 . 2010-06-14 14:30 743936 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-17 16:45 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-17 16:45 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-17 16:45 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-17 16:45 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-17 16:45 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-17 16:45 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-17 16:45 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-09-17 16:45 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-09-17 16:45 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-17 16:44 . 2010-09-17 16:44 -------- d-----w- c:\program files\Alwil Software
2010-09-17 16:44 . 2010-09-17 16:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-09-17 15:22 . 2010-09-21 21:45 63488 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-17 15:22 . 2010-09-17 16:15 52224 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-17 15:22 . 2010-09-21 21:45 117760 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-17 15:22 . 2010-09-17 15:22 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-09-17 15:22 . 2010-09-17 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-09-17 15:22 . 2010-09-17 16:34 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-09-17 14:38 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-17 14:38 . 2010-09-17 14:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-17 14:38 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-17 14:36 . 2010-09-17 14:38 -------- d-----w- C:\tmp
2010-09-17 14:30 . 2010-09-17 14:30 -------- d-----w- C:\log

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-21 17:09 . 2010-07-19 20:04 -------- d-----w- c:\program files\Microsoft
2010-09-21 06:22 . 2009-05-27 17:42 -------- d-----w- c:\program files\Verizon
2010-09-21 06:13 . 2008-06-07 21:47 -------- d-----w- c:\program files\QuickTime
2010-09-21 05:43 . 2004-04-02 09:58 -------- d-----w- c:\program files\Microsoft Works
2010-09-21 05:36 . 2004-04-02 09:54 -------- d-----w- c:\program files\Microsoft Plus! Digital Media Edition
2010-09-21 04:59 . 2008-06-07 21:49 -------- d-----w- c:\program files\iTunes
2010-09-21 04:32 . 2004-04-03 00:21 -------- d-----w- c:\program files\Easy Internet signup
2010-09-21 04:08 . 2004-09-12 19:53 -------- d-----w- c:\program files\America Online 9.0
2010-09-18 22:53 . 2002-08-29 08:05 37376 ----a-w- c:\windows\system32\drivers\amdk7.sys
2010-09-18 19:41 . 2010-07-19 20:04 -------- d-----w- c:\program files\riva
2010-09-17 16:38 . 2010-08-01 21:02 452104 ----a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.12\setup.exe
2010-09-17 16:30 . 2004-09-18 04:42 -------- d-----w- c:\program files\AIM
2010-09-17 16:23 . 2004-09-12 19:53 -------- d-----w- c:\program files\Common Files\AOL
2010-09-17 14:30 . 2009-05-27 19:28 -------- d-----w- c:\documents and settings\Owner\Application Data\Verizon
2010-09-17 14:30 . 2009-05-27 19:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Verizon
2010-09-17 00:10 . 2009-05-27 20:19 99908 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-09-17 00:10 . 2009-05-27 20:19 1148960 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-09-17 00:10 . 2009-05-27 20:19 324764 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-09-17 00:10 . 2009-05-27 20:19 24607776 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-08-14 17:46 . 2010-04-01 14:59 45056 ----a-w- c:\documents and settings\Owner\Application Data\Verizon\VSP\downloads\VerizonVasDetectionScripts.v6.41.zip.dir\resources\McAfeeSecurityScanIcon.v2-1-119-2.exe
2010-08-09 23:28 . 2009-05-27 17:51 -------- d-----w- c:\program files\Common Files\Motive
2010-08-04 00:33 . 2004-04-03 00:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2010-08-01 09:23 . 2008-06-07 21:47 -------- d-----w- c:\program files\Apple Software Update
2010-07-26 20:48 . 2006-03-23 23:06 -------- d-----w- c:\program files\Google
2010-07-26 00:22 . 2008-02-06 01:49 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-07-25 14:48 . 2010-07-21 21:39 -------- d-----w- c:\program files\RMNetwork
2010-07-19 20:10 . 2009-03-04 19:32 68608 -c--a-w- c:\documents and settings\Owner\Application Data\Verizon\VSP\downloads\Verizon_VISS_Mac_Promotion_Campaign.18467.zip.dir\en\tools\RpsInstallerFinder.exe
2010-07-19 20:10 . 2007-12-30 17:53 110592 -c--a-w- c:\documents and settings\Owner\Application Data\U3\temp\cleanup.exe
2010-07-19 20:10 . 2006-11-29 21:42 1650688 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\LPSecurityExtension.dll
2010-07-19 20:10 . 2006-11-05 14:44 1163264 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\u3dapi10.dll
2010-07-19 20:10 . 2006-10-12 21:38 49152 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\U3AccessGrant.exe
2010-07-19 20:10 . 2007-02-07 17:45 3477504 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\Launchpad.exe
2010-07-19 20:10 . 2006-08-15 15:15 110592 -c--a-w- c:\documents and settings\Owner\Application Data\U3\0F607961415068C6\cleanup.exe
2010-07-19 20:09 . 2006-04-18 08:15 172032 -c--a-w- c:\documents and settings\Owner\Application Data\Juniper Networks\Host Checker\EPCheck.dll
2010-07-19 20:09 . 2008-06-07 19:42 536576 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll
2010-07-19 20:09 . 2008-06-07 19:42 200704 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll
2010-07-19 20:09 . 2008-06-07 19:42 102400 -c--a-w- c:\documents and settings\Owner\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll
2010-07-19 20:06 . 2004-09-15 01:23 344064 -c--a-w- c:\documents and settings\All Users\Application Data\PopCap\PopCapLoader\Shockwave\insaniquarium\Insaniquarium.dll
2010-07-19 20:06 . 2005-03-19 21:24 401408 -c--a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_3f1_9bd5a28\EasyShrx.Dll
2010-07-19 20:04 . 2006-06-21 23:06 14336 -c--a-w- c:\documents and settings\All Users\Application Data\AOL\C_America Online 9.0\OptClean.exe
2010-07-19 20:04 . 2005-03-20 19:45 10752 -c--a-w- c:\documents and settings\All Users\Application Data\AOL\C_America Online 9.0\OptScan.exe
2010-07-19 20:04 . 2007-12-29 16:02 110592 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\temp\cleanup.exe
2010-07-19 20:04 . 2006-11-05 14:44 1163264 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\u3dapi10.dll
2010-07-19 20:04 . 2006-11-29 21:42 1650688 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\LPSecurityExtension.dll
2010-07-19 20:04 . 2006-10-12 21:38 49152 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\U3AccessGrant.exe
2010-07-19 20:04 . 2007-02-07 17:45 3477504 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\Launchpad.exe
2010-07-19 20:04 . 2006-08-15 15:15 110592 -c--a-w- c:\documents and settings\Administrator\Application Data\U3\0F607961415068C6\cleanup.exe
2010-07-02 00:39 . 2010-05-12 23:28 439816 ----a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b} "= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
2009-07-02 14:18 2215960 ----a-w- c:\program files\ToggleEN\tbTogg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b} "= "c:\program files\ToggleEN\tbTogg.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WebAgent]
@= "{D540B3B0-7DA0-4AA5-B548-236124A56CD0} "
[HKEY_CLASSES_ROOT\CLSID\{D540B3B0-7DA0-4AA5-B548-236124A56CD0}]
2010-07-21 21:39 161792 ----a-w- c:\program files\RMNetwork\webagent.dll

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2010-09-17 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2010-09-17 15:40 595456 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-01-19 16:45 10536 ----a-w- c:\program files\Citrix\GoToAssist\508\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs "=1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^findfast.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^TA_Start.lnk]
backup=c:\windows\pss\TA_Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Think-Adz.lnk]
backup=c:\windows\pss\Think-Adz.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-03-04 16:01 88209 -c--a-w- c:\windows\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
2010-07-19 20:21 102400 ----a-w- c:\program files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2010-07-19 20:24 49152 -c--a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
1998-05-08 00:04 52736 -c--a-w- c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2010-07-19 20:13 61440 -c--a-w- c:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
2003-06-19 03:00 200704 -c--a-w- c:\program files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-01 22:25 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2004-04-02 08:49 32881 -c--a-w- c:\program files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2005-11-20 00:02 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\wt\\webdriver\\4.1.1\\wthost.exe "=
"c:\\Program Files\\America Online 9.0\\waol.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13066:TCP "= 13066:TCP:spport
"23208:TCP "= 23208:TCP:spport
"14064:TCP "= 14064:TCP:spport
"5688:TCP "= 5688:TCP:spport
"26854:TCP "= 26854:TCP:spport
"19089:TCP "= 19089:TCP:spport
"24565:TCP "= 24565:TCP:spport
"29918:TCP "= 29918:TCP:spport
"27867:TCP "= 27867:TCP:spport
"17731:TCP "= 17731:TCP:spport
"18641:TCP "= 18641:TCP:spport
"24206:TCP "= 24206:TCP:spport
"9883:TCP "= 9883:TCP:spport
"19177:TCP "= 19177:TCP:spport
"15239:TCP "= 15239:TCP:spport

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [9/17/2010 12:45 PM 165456]
R1 NEOFLTR_510_10575;Juniper Networks TDI Filter Driver (NEOFLTR_510_10575);c:\windows\system32\drivers\NEOFLTR_510_10575.sys [4/18/2006 4:08 AM 57063]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/17/2010 12:45 PM 17744]
S2 mrtRate;mrtRate; [x]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [9/11/2004 7:21 PM 20160]
.
Contents of the 'Scheduled Tasks' folder

2010-08-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:57]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
DPF: {B8E73359-3422-4384-8D27-4EA1B4C01232} - hxxps://wcac.magellanhealth.com/+CSCOL+/cscopf.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-22 16:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NET CLR Data]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NET CLR Networking]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NETFramework]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Aavmker4]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Abiosdsk]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\abp480n5]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ACPI]
"ImagePath "= "System32\DRIVERS\ACPI.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ACPIEC]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ADM8511]
"ImagePath "= "System32\DRIVERS\ADM8511.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\adpu160m]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aec]
"ImagePath "= "system32\drivers\aec.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AFD]
"ImagePath "= "\SystemRoot\System32\drivers\afd.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AgereSoftModem]
"ImagePath "= "System32\DRIVERS\AGRSM.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Aha154x]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aic78u2]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aic78xx]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ALCXSENS]
"ImagePath "= "system32\drivers\ALCXSENS.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ALCXWDM]
"ImagePath "= "system32\drivers\ALCXWDM.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Alerter]
"ServiceDll "= "%SystemRoot%\system32\alrsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ALG]
"ImagePath "= "%SystemRoot%\System32\alg.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AliIde]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AmdK7]
"ImagePath "= "System32\DRIVERS\amdk7.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\amsint]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AOL ACS]
"ImagePath "= "c:\progra~1\COMMON~1\AOL\ACS\acsd.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Apple Mobile Device]
"ImagePath "= "\ "c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AppMgmt]
"ServiceDll "= "%SystemRoot%\System32\appmgmts.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Arp1394]
"ImagePath "= "System32\DRIVERS\arp1394.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\asc]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\asc3350p]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\asc3550]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASP.NET]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASP.NET_1.1.4322]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aspnet_state]
"ImagePath "= "%SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aswFsBlk]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aswMon2]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aswRdr]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aswSP]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aswTdi]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AsyncMac]
"ImagePath "= "system32\DRIVERS\asyncmac.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\atapi]
"ImagePath "= "System32\DRIVERS\atapi.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Atdisk]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Atmarpc]
"ImagePath "= "System32\DRIVERS\atmarpc.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AudioSrv]
"ServiceDll "= "%SystemRoot%\System32\audiosrv.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\audstub]
"ImagePath "= "System32\DRIVERS\audstub.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\avast! Antivirus]
"ImagePath "= "\ "c:\program files\Alwil Software\Avast5\AvastSvc.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\avast! Mail Scanner]
"ImagePath "= "\ "c:\program files\Alwil Software\Avast5\AvastSvc.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\avast! Web Scanner]
"ImagePath "= "\ "c:\program files\Alwil Software\Avast5\AvastSvc.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\BattC]
"MofImagePath "= "System32\Drivers\battc.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Beep]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\BITS]
"ServiceDll "= "%systemroot%\system32\qmgr.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Bonjour Service]
"ImagePath "= "\ "c:\program files\Bonjour\mDNSResponder.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Browser]
"ServiceDll "= "%SystemRoot%\System32\browser.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\catchme]
"ImagePath "= "\??\c:\docume~1\Owner\LOCALS~1\Temp\catchme.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\cbidf2k]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\cd20xrnt]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cdaudio]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cdfs]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cdrom]
"ImagePath "= "System32\DRIVERS\cdrom.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Changer]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\CiSvc]
"ImagePath "= "%SystemRoot%\system32\cisvc.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ClipSrv]
"ImagePath "= "%SystemRoot%\system32\clipsrv.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\CmdIde]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\COMSysApp]
"ImagePath "= "c:\windows\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ContentFilter]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ContentIndex]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cpqarray]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Creative Service for CDROM Access]
"ImagePath "= "c:\windows\system32\CTsvcCDA.EXE "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\CryptSvc]
"ServiceDll "= "%SystemRoot%\System32\cryptsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dac2w2k]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dac960nt]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\DcomLaunch]
"ServiceDll "= "%SystemRoot%\system32\rpcss.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Dhcp]
"ServiceDll "= "%SystemRoot%\System32\dhcpcsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Disk]
"ImagePath "= "System32\DRIVERS\disk.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmadmin]
"ImagePath "= "%SystemRoot%\System32\dmadmin.exe /com "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmboot]
"ImagePath "= "System32\drivers\dmboot.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmio]
"ImagePath "= "System32\drivers\dmio.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmload]
"ImagePath "= "System32\drivers\dmload.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmserver]
"ServiceDll "= "%SystemRoot%\System32\dmserver.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\DMusic]
"ImagePath "= "system32\drivers\DMusic.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Dnscache]
"ServiceDll "= "%SystemRoot%\System32\dnsrslvr.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dpti2o]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\drmkaud]
"ImagePath "= "system32\drivers\drmkaud.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dwshd]
"ImagePath "= "\SystemRoot\System32\drivers\dwshd.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ERSvc]
"ServiceDll "= "%SystemRoot%\System32\ersvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Eventlog]
"ImagePath "= "%SystemRoot%\system32\services.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EventSystem]
"ServiceDll "= "c:\windows\System32\es.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fastfat]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\fasttx2k]
"ImagePath "= "System32\DRIVERS\fasttx2k.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\FastUserSwitchingCompatibility]
"ServiceDll "= "%SystemRoot%\System32\shsvcs.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fax]
"ImagePath "= "%systemroot%\system32\fxssvc.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fdc]
"ImagePath "= "System32\DRIVERS\fdc.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\FETND5BV]
"ImagePath "= "system32\DRIVERS\fetnd5bv.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\FETNDISB]
"ImagePath "= "System32\DRIVERS\fetnd5b.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fips]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Flpydisk]
"ImagePath "= "System32\DRIVERS\flpydisk.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\FltMgr]
"ImagePath "= "system32\drivers\fltmgr.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Freedom]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fs_Rec]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ftdisk]
"ImagePath "= "System32\DRIVERS\ftdisk.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\GEARAspiWDM]
"ImagePath "= "SYSTEM32\DRIVERS\GEARAspiWDM.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\GoToAssist]
"ImagePath "= "\ "c:\program files\Citrix\GoToAssist\508\g2aservice.exe\" Start=service "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Gpc]
"ImagePath "= "System32\DRIVERS\msgpc.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\helpsvc]
"ServiceDll "= "%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HidServ]
"ServiceDll "=" %SystemRoot%\System32\hidserv.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HidUsb]
"ImagePath "= "system32\DRIVERS\hidusb.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\hpn]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HPZid412]
"ImagePath "= "system32\DRIVERS\HPZid412.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HPZipr12]
"ImagePath "= "system32\DRIVERS\HPZipr12.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HPZius12]
"ImagePath "= "system32\DRIVERS\HPZius12.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HTTP]
"ImagePath "= "System32\Drivers\HTTP.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HTTPFilter]
"ServiceDll "= "%SystemRoot%\System32\w3ssl.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\i2omgmt]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\i2omp]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\i8042prt]
"ImagePath "= "System32\DRIVERS\i8042prt.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ialm]
"ImagePath "= "System32\DRIVERS\ialmnt5.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Imapi]
"ImagePath "= "System32\DRIVERS\imapi.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ImapiService]
"ImagePath "= "%systemroot%\system32\imapi.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\inetaccs]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ini910u]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Inport]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IntelIde]
"ImagePath "= "System32\DRIVERS\intelide.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\intelppm]
"ImagePath "= "System32\DRIVERS\intelppm.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ip6fw]
"ImagePath "= "system32\drivers\ip6fw.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IpFilterDriver]
"ImagePath "= "System32\DRIVERS\ipfltdrv.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IpInIp]
"ImagePath "= "System32\DRIVERS\ipinip.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IpNat]
"ImagePath "= "System32\DRIVERS\ipnat.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\iPod Service]
"ImagePath "= "\ "c:\program files\iPod\bin\iPodService.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IPSec]
"ImagePath "= "System32\DRIVERS\ipsec.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IRENUM]
"ImagePath "= "System32\DRIVERS\irenum.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ISAPISearch]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\isapnp]
"ImagePath "= "System32\DRIVERS\isapnp.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Iviaspi]
"ImagePath "= "system32\drivers\iviaspi.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Kbdclass]
"ImagePath "= "System32\DRIVERS\kbdclass.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\kbdhid]
"ImagePath "= "system32\DRIVERS\kbdhid.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\kmixer]
"ImagePath "= "system32\drivers\kmixer.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\KSecDD]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lanmanserver]
"ServiceDll "= "%SystemRoot%\System32\srvsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lanmanworkstation]
"ServiceDll "= "%SystemRoot%\System32\wkssvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ldap]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\LicenseService]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\LmHosts]
"ServiceDll "= "%SystemRoot%\System32\lmhsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\McciCMService]
"ImagePath "= "\ "c:\program files\Common Files\Motive\McciCMService.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Messenger]
"ServiceDll "= "%SystemRoot%\System32\msgsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mnmdd]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mnmsrvc]
"ImagePath "= "c:\windows\System32\mnmsrvc.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Modem]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Mouclass]
"ImagePath "= "System32\DRIVERS\mouclass.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mouhid]
"ImagePath "= "System32\DRIVERS\mouhid.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MountMgr]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mraid35x]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MREMP50]
"ImagePath "= "\??\c:\progra~1\COMMON~1\Motive\MREMP50.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MREMP50a64]
"ImagePath "= "\??\c:\progra~1\COMMON~1\Motive\MREMP50a64.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MREMPR5]
"ImagePath "= "\??\c:\progra~1\COMMON~1\Motive\MREMPR5.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MRENDIS5]
"ImagePath "= "\??\c:\progra~1\COMMON~1\Motive\MRENDIS5.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MRESP50]
"ImagePath "= "\??\c:\progra~1\COMMON~1\Motive\MRESP50.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MRESP50a64]
"ImagePath "= "\??\c:\progra~1\COMMON~1\Motive\MRESP50a64.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mrtRate]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MRxDAV]
"ImagePath "= "System32\DRIVERS\mrxdav.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MRxSmb]
"ImagePath "= "System32\DRIVERS\mrxsmb.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSDTC]
"ImagePath "= "c:\windows\System32\msdtc.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Msfs]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSIServer]
"ImagePath "= "%systemroot%\system32\msiexec.exe /V "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSKSSRV]
"ImagePath "= "system32\drivers\MSKSSRV.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSPCLOCK]
"ImagePath "= "system32\drivers\MSPCLOCK.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSPQM]
"ImagePath "= "system32\drivers\MSPQM.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mssmbios]
"ImagePath "= "System32\DRIVERS\mssmbios.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Mup]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NDIS]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NdisTapi]
"ImagePath "= "System32\DRIVERS\ndistapi.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ndisuio]
"ImagePath "= "System32\DRIVERS\ndisuio.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NdisWan]
"ImagePath "= "System32\DRIVERS\ndiswan.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NDProxy]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NEOFLTR_510_10575]
"ImagePath "= "\??\c:\windows\system32\Drivers\NEOFLTR_510_10575.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetBIOS]
"ImagePath "= "System32\DRIVERS\netbios.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetBT]
"ImagePath "= "System32\DRIVERS\netbt.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetDDE]
"ImagePath "= "%SystemRoot%\system32\netdde.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetDDEdsdm]
"ImagePath "= "%SystemRoot%\system32\netdde.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Netlogon]
"ImagePath "= "%SystemRoot%\system32\lsass.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Netman]
"ServiceDll "= "%SystemRoot%\System32\netman.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NIC1394]
"ImagePath "= "System32\DRIVERS\nic1394.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Nla]
"ServiceDll "= "%SystemRoot%\System32\mswsock.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Npfs]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ntfs]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NtLmSsp]
"ImagePath "= "%SystemRoot%\System32\lsass.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NtmsSvc]
"ServiceDll "= "%SystemRoot%\system32\ntmssvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NuidFltr]
"ImagePath "= "system32\DRIVERS\NuidFltr.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Null]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NwlnkFlt]
"ImagePath "= "System32\DRIVERS\nwlnkflt.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NwlnkFwd]
"ImagePath "= "System32\DRIVERS\nwlnkfwd.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ohci1394]
"ImagePath "= "System32\DRIVERS\ohci1394.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ose]
"ImagePath "= "\ "c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Outlook]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Parport]
"ImagePath "= "System32\DRIVERS\parport.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PartMgr]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ParVdm]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCI]
"ImagePath "= "System32\DRIVERS\pci.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCIDump]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCIIde]
"ImagePath "= "System32\DRIVERS\pciide.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Pcmcia]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDCOMP]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDFRAME]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDRELI]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDRFRAME]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\perc2]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\perc2hib]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfDisk]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfNet]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfOS]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfProc]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Pfc]
"ImagePath "= "system32\drivers\pfc.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PlugPlay]
"ImagePath "= "%SystemRoot%\system32\services.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Pml Driver HPZ12]
"ImagePath "= "c:\windows\system32\HPZipm12.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PolicyAgent]
"ImagePath "= "%SystemRoot%\system32\lsass.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PptpMiniport]
"ImagePath "= "System32\DRIVERS\raspptp.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Processor]
"ImagePath "= "System32\DRIVERS\processr.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ProtectedStorage]
"ImagePath "= "%SystemRoot%\system32\lsass.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ps2]
"ImagePath "= "System32\DRIVERS\PS2.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PSched]
"ImagePath "= "System32\DRIVERS\psched.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ptilink]
"ImagePath "= "System32\DRIVERS\ptilink.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PxHelp20]
"ImagePath "= "System32\DRIVERS\PxHelp20.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql1080]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ql10wnt]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql12160]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql1240]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql1280]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasAcd]
"ImagePath "= "System32\DRIVERS\rasacd.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasAuto]
"ServiceDll "= "%SystemRoot%\System32\rasauto.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Rasl2tp]
"ImagePath "= "System32\DRIVERS\rasl2tp.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasMan]
"ServiceDll "= "%SystemRoot%\System32\rasmans.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasPppoe]
"ImagePath "= "System32\DRIVERS\raspppoe.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Raspti]
"ImagePath "= "System32\DRIVERS\raspti.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Rdbss]
"ImagePath "= "System32\DRIVERS\rdbss.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPCDD]
"ImagePath "= "System32\DRIVERS\RDPCDD.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPDD]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPNP]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPWD]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDSessMgr]
"ImagePath "= "c:\windows\system32\sessmgr.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\redbook]
"ImagePath "= "System32\DRIVERS\redbook.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RemoteAccess]
"ServiceDll "= "%SystemRoot%\System32\mprdim.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RpcLocator]
"ImagePath "= "%SystemRoot%\System32\locator.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RpcSs]
"ServiceDll "= "%SystemRoot%\System32\rpcss.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RPPKT]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RPSKT]
"ImagePath "= "system32\DRIVERS\rp_skt32.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RSVP]
"ImagePath "= "%SystemRoot%\System32\rsvp.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rtl8139]
"ImagePath "= "System32\DRIVERS\R8139n51.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SamSs]
"ImagePath "= "%SystemRoot%\system32\lsass.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SASDIFSV]
"ImagePath "= "\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SASKUTIL]
"ImagePath "= "\??\c:\program files\SUPERAntiSpyware\SASKUTIL.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SCardSvr]
"ImagePath "= "%SystemRoot%\System32\SCardSvr.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Schedule]
"ServiceDll "= "%SystemRoot%\system32\schedsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ScsiPort]
"ImagePath "= "%SystemRoot%\system32\drivers\scsiport.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Secdrv]
"ImagePath "= "System32\DRIVERS\secdrv.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\seclogon]
"ServiceDll "= "%SystemRoot%\System32\seclogon.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SENS]
"ServiceDll "= "%SystemRoot%\system32\sens.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\serenum]
"ImagePath "= "System32\DRIVERS\serenum.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Serial]
"ImagePath "= "System32\DRIVERS\serial.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Sfloppy]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SharedAccess]
"ServiceDll "= "%SystemRoot%\System32\ipnathlp.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ShellHWDetection]
"ServiceDll "= "%SystemRoot%\System32\shsvcs.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Simbad]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SiS315]
"ImagePath "= "System32\DRIVERS\sisgrp.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SISAGP]
"ImagePath "= "System32\DRIVERS\SISAGPX.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SiSkp]
"ImagePath "= "System32\DRIVERS\srvkp.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Sparrow]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\splitter]
"ImagePath "= "system32\drivers\splitter.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Spooler]
"ImagePath "= "%SystemRoot%\system32\spoolsv.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sr]
"ImagePath "= "System32\DRIVERS\sr.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\srservice]
"ServiceDll "= "%SystemRoot%\system32\srsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Srv]
"ImagePath "= "System32\DRIVERS\srv.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SSDPSRV]
"ServiceDll "= "%SystemRoot%\System32\ssdpsrv.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\stisvc]
"ServiceDll "= "%SystemRoot%\system32\wiaservc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\swenum]
"ImagePath "= "System32\DRIVERS\swenum.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\swmidi]
"ImagePath "= "system32\drivers\swmidi.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SwPrv]
"ImagePath "= "c:\windows\System32\dllhost.exe /Processid:{7D0947CE-D99C-4491-920A-D45CCE12CDA0} "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\swwd]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\symc810]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\symc8xx]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sym_hi]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sym_u3]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sysaudio]
"ImagePath "= "system32\drivers\sysaudio.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SysmonLog]
"ImagePath "= "%SystemRoot%\system32\smlogsvc.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TapiSrv]
"ServiceDll "= "%SystemRoot%\System32\tapisrv.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip]
"ImagePath "= "System32\DRIVERS\tcpip.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TDPIPE]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TDTCP]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TermDD]
"ImagePath "= "System32\DRIVERS\termdd.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TermService]
"ServiceDll "= "%SystemRoot%\System32\termsrv.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Themes]
"ServiceDll "= "%SystemRoot%\System32\shsvcs.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TlntSvr]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TosIde]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TrkWks]
"ServiceDll "= "%SystemRoot%\system32\trkwks.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TSDDD]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Udfs]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ultra]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\UMWdf]
"ImagePath "= "c:\windows\system32\wdfmgr.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Update]
"ImagePath "= "System32\DRIVERS\update.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\upnphost]
"ServiceDll "= "%SystemRoot%\System32\upnphost.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\UPS]
"ImagePath "= "%SystemRoot%\System32\ups.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usb]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\USBAAPL]
"ImagePath "= "System32\Drivers\usbaapl.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbccgp]
"ImagePath "= "System32\DRIVERS\usbccgp.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbehci]
"ImagePath "= "System32\DRIVERS\usbehci.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbhub]
"ImagePath "= "System32\DRIVERS\usbhub.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbohci]
"ImagePath "= "System32\DRIVERS\usbohci.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbprint]
"ImagePath "= "System32\DRIVERS\usbprint.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbscan]
"ImagePath "= "System32\DRIVERS\usbscan.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\USBSTOR]
"ImagePath "= "System32\DRIVERS\USBSTOR.SYS "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbuhci]
"ImagePath "= "System32\DRIVERS\usbuhci.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VgaSave]
"ImagePath "= "\SystemRoot\System32\drivers\vga.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\viaagp1]
"ImagePath "= "System32\DRIVERS\viaagp1.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\viagfx]
"ImagePath "= "System32\DRIVERS\vtmini.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ViaIde]
"ImagePath "= "System32\DRIVERS\viaide.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VolSnap]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VSS]
"ImagePath "= "%SystemRoot%\System32\vssvc.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VxD]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\W32Time]
"ServiceDll "= "%systemroot%\system32\w32time.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\W3SVC]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Wanarp]
"ImagePath "= "System32\DRIVERS\wanarp.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wanatw]
"ImagePath "= "system32\DRIVERS\wanatw4.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WANMiniportService]
"ImagePath "= "\ "c:\windows\wanmpsvc.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Wdf01000]
"ImagePath "= "system32\DRIVERS\Wdf01000.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WDICA]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wdmaud]
"ImagePath "= "system32\drivers\wdmaud.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WebClient]
"ServiceDll "= "%SystemRoot%\System32\webclnt.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\winmgmt]
"ServiceDll "= "%SystemRoot%\system32\wbem\WMIsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Winsock]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WinSock2]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WinTrust]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WmdmPmSN]
"ServiceDll "= "c:\windows\system32\mspmsnsv.dll "
--

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Wmi]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WmiApRpl]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WmiApSrv]
"ImagePath "= "c:\windows\System32\wbem\wmiapsrv.exe "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WpdUsb]
"ImagePath "= "System32\Drivers\wpdusb.sys "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wscsvc]
"ServiceDll "= "%SYSTEMROOT%\system32\wscsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wuauserv]
"ServiceDll "= "c:\windows\system32\wuauserv.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WZCSVC]
"ServiceDll "= "%SystemRoot%\System32\wzcsvc.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\xmlprov]
"ServiceDll "= "%SystemRoot%\System32\xmlprov.dll "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\YahooAUService]
"ImagePath "= "\ "c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe\" "

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{584C0006-5094-4B15-BACD-97D1B6FABCAD}]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{89567005-2745-4293-9725-CCC747FC7F3C}]

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{AD002166-C4CA-44BD-B7A4-3913E4D88727}]
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\program files\Citrix\GoToAssist\508\G2AWinLogon.dll
.
Completion time: 2010-09-22 17:46:57
ComboFix-quarantined-files.txt 2010-09-22 21:46
ComboFix2.txt 2010-09-22 12:35
ComboFix3.txt 2010-09-22 01:53
ComboFix4.txt 2010-09-19 13:31
ComboFix5.txt 2010-09-22 20:17

Pre-Run: 141,458,460,672 bytes free
Post-Run: 141,443,727,360 bytes free

- - End Of File - - 48C4414661B8A86EAC49EF164DEF7017

BillB · 2010/09/22

Had some trouble with the log post, hope it all came thru ok.

broni · 2010/09/22

Finally, it looks clean

For some reason, I can't post OTL instructions....
Let me retry...

broni · 2010/09/22

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Log in or Sign up

Solved Need help with XP machine that won't run in normal mode

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Need help with XP machine that won't run in normal mode

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

BillB Well-Known Member Thread Starter

BillB Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Useful Searches