Solved Frozen Windows - not sure of infection

[Resolved] Frozen Windows - not sure of infection

Hi guys,

I'm having some problems with my computer and dying for some help. I have a Windows XP computer, dual core processor. My little brother went surfing and downloaded a virus. Every time I boot my computer, I'm frozen in windows.

In safe mode, I've run Norton. No luck detecting anything. I've run Malware Bytes several times and was able to remove initial hits such that nothing comes up now. Trendmicro doesn't detect anything. Adware and Spybot S&D doesn't detect anything. I browsed the logs of hijack this and it looks normal to me. I'm a relatively experienced user, but when it comes to this freezing my computer

Please let me know where I need to start from here.

 

Here's the requested logs:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5026

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

11/4/2010 9:40:59 PM
mbam-log-2010-11-04 (09-40-59).txt

Scan type: Full scan (C:\|)
Objects scanned: 273566
Time elapsed: 3 hour(s), 37 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15507 - http://www.gmer.net
Rootkit scan 2010-11-04 16:15:59
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\00000071 ST3250820AS 3.ADG
Running: 3pnzh5ei.exe; Driver: C:\DOCUME~1\ASSWHO~1\LOCALS~1\Temp\axtoapod.sys


---- System - GMER 1.0.15 ----

SSDT spkh.sys ZwCreateKey [0xF74D90E0]
SSDT spkh.sys ZwEnumerateKey [0xF74F6CA2]
SSDT spkh.sys ZwEnumerateValueKey [0xF74F7030]
SSDT spkh.sys ZwOpenKey [0xF74D90C0]
SSDT spkh.sys ZwQueryKey [0xF74F7108]
SSDT spkh.sys ZwQueryValueKey [0xF74F6F88]
SSDT spkh.sys ZwSetValueKey [0xF74F719A]

INT 0x63 ? 8A667F00
INT 0x73 ? 8A6FBBF8
INT 0x83 ? 8A6FBBF8
INT 0xB4 ? 8A667F00

---- Kernel code sections - GMER 1.0.15 ----

? spkh.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload BA6D08AC 5 Bytes JMP 8A6674E0
? C:\DOCUME~1\ASSWHO~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1268] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9ACD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254656 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1272] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E538F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A6FA1F8
Device \FileSystem\Fastfat \FatCdrom 8A40D1F8
Device \Driver\usbohci \Device\USBPDO-0 8A6651F8
Device \Driver\usbehci \Device\USBPDO-1 8A632500
Device \Driver\nvata \Device\00000071 8A6FB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A76E1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A76E1F8
Device \Driver\Cdrom \Device\CdRom0 8A63C500
Device \Driver\nvata \Device\00000072 8A6FB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A76E1F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A43E500
Device \Driver\NetBT \Device\NetbiosSmb 8A43E500
Device \Driver\NetBT \Device\NetBT_Tcpip_{CE79A76F-F7A9-4C8D-AB31-E5690BEA1F4B} 8A43E500
Device \Driver\usbohci \Device\USBFDO-0 8A6651F8
Device \Driver\nvata \Device\NvAta0 8A6FB1F8
Device \Driver\usbehci \Device\USBFDO-1 8A632500
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A4321F8
Device \Driver\nvata \Device\NvAta1 8A6FB1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A4321F8
Device \Driver\Ftdisk \Device\FtControl 8A76E1F8
Device \FileSystem\Fastfat \Fat 8A40D1F8

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 8A4111F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xDE 0x08 0xD3 0x78 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xDE 0x08 0xD3 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xDE 0x08 0xD3 0x78 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xDE 0x08 0xD3 0x78 ...

---- EOF - GMER 1.0.15 ----
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000d

Kernel Drivers (total 103):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FF000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF74D8000 spxk.sys
0xF7989000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xF74C0000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xF7492000 ACPI.sys
0xF7481000 pci.sys
0xF75F7000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7607000 MountMgr.sys
0xF7868000 ftdisk.sys
0xF7617000 \WINDOWS\system32\drivers\CLASSPNP.SYS
0xF770F000 PartMgr.sys
0xF7627000 VolSnap.sys
0xF783A000 atapi.sys
0xF7953000 nvata.sys
0xF7637000 disk.sys
0xF7A2F000 fltmgr.sys
0xF7828000 sr.sys
0xF7A19000 DRVMCDB.SYS
0xF7647000 PxHelp20.sys
0xF7BC8000 KSecDD.sys
0xF7BB5000 WudfPf.sys
0xF7B28000 Ntfs.sys
0xF7AFB000 NDIS.sys
0xF7AE1000 Mup.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xBA6B8000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF77FF000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7461000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF792F000 \SystemRoot\System32\Drivers\cdrbsdrv.SYS
0xF798F000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
0xF7451000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7441000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA695000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA63A000 \SystemRoot\system32\DRIVERS\CBG54.sys
0xBA612000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF77AF000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7431000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA7D8000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA5FB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7421000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7411000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xBA5C2000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7401000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF77F7000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF780F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7887000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7817000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF781F000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7997000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA564000 \SystemRoot\system32\DRIVERS\update.sys
0xBA7C0000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA533000 \SystemRoot\system32\DRIVERS\TMPassthru.sys
0xBA780000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF799B000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xBA770000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF77EF000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF791B000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF79A5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A7C000 \SystemRoot\System32\Drivers\Null.SYS
0xF79A9000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7737000 \SystemRoot\System32\Drivers\DLARTL_N.SYS
0xF773F000 \SystemRoot\System32\drivers\vga.sys
0xBA408000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0xF79AD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7757000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7767000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7927000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xBA385000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xBA32C000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xBA306000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA2DE000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF7943000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xBA2BC000 \SystemRoot\System32\drivers\afd.sys
0xBA750000 \SystemRoot\system32\DRIVERS\netbios.sys
0xBA291000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xBA221000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA730000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBA5DF000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA720000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7747000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA3D8000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xBA5D3000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xBA7CC000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA1DF000 \SystemRoot\System32\Drivers\dump_nvata.sys
0xF79BB000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xBA798000 \SystemRoot\System32\drivers\Dxapi.sys
0xF77BF000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7A7B000 \SystemRoot\System32\drivers\dxgthk.sys
0xBFF50000 \SystemRoot\System32\framebuf.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB9C7B000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB9A17000 \SystemRoot\system32\DRIVERS\srv.sys
0xB9999000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB968C000 \SystemRoot\System32\DRIVERS\gmer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 19):
0 System Idle Process
4 System
728 C:\WINDOWS\system32\smss.exe
780 csrss.exe
804 C:\WINDOWS\system32\winlogon.exe
848 C:\WINDOWS\system32\services.exe
860 C:\WINDOWS\system32\lsass.exe
1016 C:\WINDOWS\system32\svchost.exe
1104 svchost.exe
1280 C:\WINDOWS\system32\svchost.exe
1292 svchost.exe
1352 svchost.exe
2000 C:\WINDOWS\explorer.exe
608 C:\Program Files\Internet Explorer\iexplore.exe
648 C:\Program Files\Internet Explorer\iexplore.exe
1216 C:\WINDOWS\system32\ctfmon.exe
180 C:\Program Files\Internet Explorer\iexplore.exe
360 wmiprvse.exe
1636 C:\Documents and Settings\Asswhooper McDaddy\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)

PhysicalDrive0 Model Number: ST3250820AS, Rev: 3.ADG

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Dell MBR code detected
SHA1: 57BDF501CE769EF2720C705B6C71C893DA31574E


Done!


DDS (Ver_10-11-03.01) - NTFSx86 NETWORK
Run by Sillychica at 12:52:14.26 on Thu 11/04/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1982.1663 [GMT -4:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Sillychica\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe
mRun: [vptray] c:\progra~1\symant~1\\vptray.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
Trusted Zone: ebay.com\www
Trusted Zone: fidelity.com
Trusted Zone: fidelity.com\www
Trusted Zone: half.com\www
Trusted Zone: intuit.com\ttlc
Trusted Zone: kaspersky.com\www
Trusted Zone: nysdmv.com
Trusted Zone: turbotax.com
DPF: vzTCPConfig - hxxp://www2.verizon.net/help/dsl_settings/include/vzTCPConfig.CAB
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/OnlineScanner.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1248663102328
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} - hxxps://www.goconcierge.net/secure/arview2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://optionvue.webex.com/client/T27LB/nbr/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: x-atng - {7e8717b0-d862-11d5-8c9e-00010304f989} - c:\program files\fidelity investments\fidelity active trader\system\atngprot.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;c:\windows\system32\drivers\CBG54.SYS [2005-11-1 372480]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\TMPassthru.sys [2010-11-2 206608]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
S1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
S1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
S2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
S2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
S2 PEVSystemStart;PEVSystemStart; "c:\combofix\pev.cfxxe" exec /i "c:\combofix\regt.cfxxe" /s "c:\combofix\cregb.dat" --> c:\combofix\PEV.cfxxe [?]
S2 RUBotted;Trend Micro RUBotted Service;c:\program files\trend micro\rubotted\TMRUBotted.exe [2010-11-2 582992]
S2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-9-27 1813232]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-28 102448]
S3 fd_dbus;FutureDial USB Composite Device driver (WDM);c:\windows\system32\drivers\fd_dbus.sys [2008-1-26 44816]
S3 fd_dmdfl;FutureDial USB Modem Filter;c:\windows\system32\drivers\fd_dmdfl.sys [2008-1-26 6000]
S3 fd_dmdm;FutureDial USB Modem Drivers;c:\windows\system32\drivers\fd_dmdm.sys [2008-1-26 72912]
S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2007-5-20 40840]
S3 IkSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2007-5-20 66952]
S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2007-5-20 81288]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);c:\windows\system32\drivers\lgatserd.sys [2008-1-26 60816]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20101101.002\naveng.sys [2010-11-2 86064]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20101101.002\navex15.sys [2010-11-2 1371184]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-6-29 356920]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-6-29 1079176]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\drivers\TMPassthru.sys [2010-11-2 206608]

=============== Created Last 30 ================

2010-11-03 15:48:57 -------- d-----w- C:\MGtools
2010-11-03 14:37:02 -------- d-sha-r- C:\cmdcons
2010-11-03 14:34:31 98816 ----a-w- c:\windows\sed.exe
2010-11-03 14:34:31 88064 ----a-w- c:\windows\MBR.exe
2010-11-03 14:34:31 256512 ----a-w- c:\windows\PEV.exe
2010-11-03 14:34:31 161792 ----a-w- c:\windows\SWREG.exe
2010-11-03 14:34:27 -------- d-----w- C:\ComboFix
2010-11-03 09:58:35 -------- d-----w- c:\docume~1\asswho~1\applic~1\SUPERAntiSpyware.com
2010-11-03 05:15:20 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-11-03 05:14:21 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-11-03 05:10:55 2400464 ----a-w- C:\MGtools.exe
2010-11-03 01:57:43 206608 ----a-w- c:\windows\system32\drivers\TMPassthru.sys
2010-11-03 01:56:35 -------- d-----w- c:\documents and settings\Sillychica\log
2010-11-02 20:04:26 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-11-02 18:46:29 -------- d-----w- c:\program files\ESET
2010-10-13 18:02:01 954368 ------w- c:\windows\system32\dllcache\mfc40.dll
2010-10-13 18:02:00 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 18:02:00 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-13 18:01:53 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2010-10-09 02:41:49 1409 ----a-w- c:\windows\QTFont.for

==================== Find3M ====================

2010-11-04 16:43:41 4748 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-09-18 16:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58:06 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58:06 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02:29 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57:43 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12:04 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-08-12 04:07:46 133616 ------w- c:\windows\system32\pxafs.dll
2010-08-12 04:07:46 126448 ------w- c:\windows\system32\pxinsi64.exe
2010-08-12 04:07:46 123888 ------w- c:\windows\system32\pxcpyi64.exe
1999-03-25 18:30:40 2336256 ----a-w- c:\program files\DATA1.MSI
1999-03-01 22:00:24 165376 ----a-w- c:\program files\MSOWC.MSI

============= FINISH: 12:53:17.45 ===============

 

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-03.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 5/5/2007 3:50:43 PM
System Uptime: 11/4/2010 12:39:05 PM (0 hours ago)

Motherboard: Dell Inc | | 0UW457
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4400+ | Socket M2 | 2304/1000mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 230 GiB total, 4.627 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Broadcom 440x 10/100 Integrated Controller
Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01ED1028&REV_02\4&DC268A3&0&3880
Manufacturer: Broadcom
Name: Broadcom 440x 10/100 Integrated Controller
PNP Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01ED1028&REV_02\4&DC268A3&0&3880
Service: bcm4sbxp

==== System Restore Points ===================

RP82: 4/21/2009 1:21:14 PM - System Checkpoint
RP83: 4/23/2009 8:37:27 AM - System Checkpoint
RP84: 4/25/2009 6:31:02 PM - System Checkpoint
RP85: 4/28/2009 3:32:40 PM - System Checkpoint
RP86: 5/2/2009 2:34:22 PM - System Checkpoint
RP87: 5/8/2009 9:35:35 AM - System Checkpoint
RP88: 5/9/2009 10:52:39 AM - System Checkpoint
RP89: 5/13/2009 12:39:49 PM - Software Distribution Service 3.0
RP90: 5/15/2009 12:33:20 PM - System Checkpoint
RP91: 5/16/2009 9:34:42 PM - System Checkpoint
RP92: 5/19/2009 10:44:09 AM - System Checkpoint
RP93: 5/20/2009 11:56:43 AM - System Checkpoint
RP94: 5/21/2009 12:47:35 PM - System Checkpoint
RP95: 5/23/2009 12:28:51 PM - System Checkpoint
RP96: 5/24/2009 2:10:45 PM - System Checkpoint
RP97: 5/25/2009 2:31:29 PM - System Checkpoint
RP98: 5/27/2009 6:58:59 AM - Software Distribution Service 3.0
RP99: 5/28/2009 6:27:10 PM - System Checkpoint
RP100: 5/30/2009 10:58:22 AM - System Checkpoint
RP101: 6/1/2009 2:24:13 AM - System Checkpoint
RP102: 6/5/2009 2:05:16 PM - System Checkpoint
RP103: 6/10/2009 12:55:15 PM - System Checkpoint
RP104: 6/11/2009 4:05:30 PM - Software Distribution Service 3.0
RP105: 6/11/2009 4:05:36 PM - Installed Windows XP KB968537.
RP106: 6/11/2009 4:05:44 PM - Installed Windows XP KB970238.
RP107: 6/11/2009 4:07:08 PM - Installed Windows XP KB969898.
RP108: 6/11/2009 4:07:13 PM - Installed Windows XP KB969897.
RP109: 6/11/2009 4:07:20 PM - Installed Windows XP KB961501.
RP110: 6/12/2009 4:50:01 PM - System Checkpoint
RP111: 6/17/2009 12:16:24 PM - System Checkpoint
RP112: 6/20/2009 1:39:17 PM - System Checkpoint
RP113: 6/21/2009 3:38:06 AM - Installed DirectX
RP114: 6/23/2009 2:35:37 AM - System Checkpoint
RP115: 6/25/2009 11:31:43 AM - System Checkpoint
RP116: 6/26/2009 11:44:54 AM - System Checkpoint
RP117: 6/27/2009 1:44:55 PM - System Checkpoint
RP118: 6/30/2009 10:35:31 AM - System Checkpoint
RP119: 7/1/2009 10:20:39 AM - Software Distribution Service 3.0
RP120: 7/3/2009 10:42:51 AM - System Checkpoint
RP121: 7/4/2009 12:51:00 PM - System Checkpoint
RP122: 7/5/2009 3:13:36 PM - System Checkpoint
RP123: 7/8/2009 12:54:47 AM - System Checkpoint
RP124: 7/11/2009 9:29:55 AM - System Checkpoint
RP125: 7/12/2009 1:24:46 PM - System Checkpoint
RP126: 7/15/2009 7:19:19 AM - Software Distribution Service 3.0
RP127: 7/15/2009 7:19:26 AM - Installed Windows XP KB961371.
RP128: 7/15/2009 7:21:19 AM - Installed Windows XP KB971633.
RP129: 7/15/2009 7:21:25 AM - Installed Windows XP KB973346.
RP130: 7/17/2009 10:56:56 AM - System Checkpoint
RP131: 7/18/2009 11:04:26 AM - System Checkpoint
RP132: 7/20/2009 2:10:53 PM - System Checkpoint
RP133: 7/22/2009 12:14:59 PM - System Checkpoint
RP134: 7/24/2009 9:07:13 AM - System Checkpoint
RP135: 7/26/2009 9:00:09 PM - Installed Microsoft Office Enterprise 2007
RP136: 7/26/2009 9:19:21 PM - Installed Microsoft Office Enterprise 2007
RP137: 7/26/2009 10:34:05 PM - Installed Microsoft Office Enterprise 2007
RP138: 7/26/2009 10:42:08 PM - Printer Driver Send To Microsoft OneNote Driver Installed
RP139: 7/27/2009 7:21:36 AM - Software Distribution Service 3.0
RP140: 7/29/2009 7:29:54 AM - Software Distribution Service 3.0
RP141: 7/29/2009 7:30:00 AM - Installed Windows XP KB972260.
RP142: 8/1/2009 4:21:14 PM - Removed Microsoft Office 2000 Premium
RP143: 8/2/2009 6:23:09 PM - System Checkpoint
RP144: 8/4/2009 1:34:33 PM - System Checkpoint
RP145: 8/5/2009 1:56:45 PM - System Checkpoint
RP146: 8/6/2009 2:18:29 PM - System Checkpoint
RP147: 8/12/2009 1:18:40 PM - System Checkpoint
RP148: 8/13/2009 1:31:06 PM - System Checkpoint
RP149: 8/13/2009 1:43:04 PM - Software Distribution Service 3.0
RP150: 8/13/2009 1:43:10 PM - Installed Windows XP KB973815.
RP151: 8/13/2009 1:44:52 PM - Installed Windows Media Player KB973540.
RP152: 8/13/2009 1:44:58 PM - Installed Windows XP KB973354.
RP153: 8/13/2009 1:45:03 PM - Installed Windows XP KB973507.
RP154: 8/13/2009 1:45:29 PM - Installed Windows XP KB973869.
RP155: 8/13/2009 1:45:35 PM - Installed Windows XP KB956744.
RP156: 8/13/2009 1:45:39 PM - Installed Windows XP KB971557.
RP157: 8/13/2009 1:45:44 PM - Installed Windows XP KB971657.
RP158: 8/13/2009 1:45:49 PM - Installed Windows XP KB960859.
RP159: 8/16/2009 4:23:33 PM - System Checkpoint
RP160: 8/18/2009 6:19:14 PM - System Checkpoint
RP161: 8/20/2009 1:07:25 AM - System Checkpoint
RP162: 8/21/2009 1:43:29 PM - System Checkpoint
RP163: 8/22/2009 10:17:53 PM - System Checkpoint
RP164: 8/24/2009 3:44:29 PM - System Checkpoint
RP165: 8/26/2009 11:49:53 AM - Software Distribution Service 3.0
RP166: 8/26/2009 11:49:58 AM - Installed Windows XP KB970653-v3.
RP167: 8/28/2009 10:34:47 AM - Installed Fidelity Active Trader Pro®.
RP168: 8/28/2009 11:00:46 AM - Removed Fidelity Active Trader Pro®.
RP169: 8/28/2009 11:09:42 AM - Installed Fidelity Active Trader Pro®.
RP170: 8/28/2009 11:11:27 AM - Removed Fidelity Active Trader Pro®.
RP171: 8/28/2009 11:18:13 AM - Installed Fidelity Active Trader Pro®.
RP172: 8/28/2009 1:18:36 PM - Removed Fidelity Active Trader Pro®.
RP173: 8/28/2009 1:23:36 PM - Installed Fidelity Active Trader Pro®.
RP174: 8/28/2009 1:36:24 PM - Removed Fidelity Active Trader Pro®.
RP175: 8/28/2009 2:03:06 PM - Software Distribution Service 3.0
RP176: 8/28/2009 2:10:26 PM - Printer Driver Send To Microsoft OneNote Driver Installed
RP177: 8/28/2009 2:12:33 PM - Installed Windows XP KB968389.
RP178: 8/28/2009 2:47:32 PM - Software Distribution Service 3.0
RP179: 8/28/2009 2:47:39 PM - Installed Windows XP KB972260.
RP180: 8/28/2009 2:58:46 PM - Software Distribution Service 3.0
RP181: 8/29/2009 6:06:42 PM - System Checkpoint
RP182: 9/2/2009 12:28:01 PM - System Checkpoint
RP183: 9/3/2009 12:33:37 PM - System Checkpoint
RP184: 9/9/2009 12:30:07 PM - System Checkpoint
RP185: 9/10/2009 7:49:54 AM - Software Distribution Service 3.0
RP186: 9/10/2009 7:50:11 AM - Installed Windows XP KB971961.
RP187: 9/10/2009 7:51:18 AM - Installed Windows XP KB956844.
RP188: 9/10/2009 7:51:21 AM - Installed Windows Media Player KB968816.
RP189: 9/16/2009 9:06:02 AM - System Checkpoint
RP190: 9/17/2009 9:12:20 AM - System Checkpoint
RP191: 9/18/2009 2:13:32 PM - System Checkpoint
RP192: 9/19/2009 3:39:03 PM - System Checkpoint
RP193: 9/20/2009 5:55:18 PM - System Checkpoint
RP194: 9/24/2009 12:47:50 PM - System Checkpoint
RP195: 9/26/2009 1:32:49 PM - System Checkpoint
RP196: 9/30/2009 12:37:13 PM - System Checkpoint
RP197: 10/1/2009 4:35:11 PM - System Checkpoint
RP198: 10/3/2009 3:08:09 PM - System Checkpoint
RP199: 10/5/2009 2:12:32 AM - System Checkpoint
RP200: 10/6/2009 1:18:44 PM - System Checkpoint
RP201: 10/8/2009 2:02:09 PM - System Checkpoint
RP202: 10/10/2009 4:29:41 PM - System Checkpoint
RP203: 10/11/2009 7:01:46 PM - System Checkpoint
RP204: 10/13/2009 12:41:30 PM - System Checkpoint
RP205: 10/14/2009 1:41:28 PM - System Checkpoint
RP206: 10/14/2009 3:51:00 PM - Software Distribution Service 3.0
RP207: 10/14/2009 3:51:05 PM - Installed Windows XP KB975467.
RP208: 10/14/2009 3:51:55 PM - Installed Windows XP KB973525.
RP209: 10/14/2009 3:52:03 PM - Installed Windows XP KB971486.
RP210: 10/14/2009 3:55:28 PM - Installed Windows XP KB974571.
RP211: 10/14/2009 3:55:33 PM - Installed Windows XP KB975025.
RP212: 10/14/2009 3:55:39 PM - Installed Windows XP KB974112.
RP213: 10/14/2009 3:55:42 PM - Installed Windows Media Player KB954155.
RP214: 10/14/2009 3:55:47 PM - Installed Windows XP KB969059.
RP215: 10/14/2009 3:57:56 PM - Installed Windows XP KB958869.
RP216: 10/14/2009 3:58:03 PM - Installed Windows XP KB974455.
RP217: 10/16/2009 11:11:05 AM - System Checkpoint
RP218: 10/17/2009 2:40:11 PM - System Checkpoint
RP219: 10/19/2009 10:38:20 AM - System Checkpoint
RP220: 10/20/2009 1:32:28 PM - System Checkpoint
RP221: 10/22/2009 3:14:28 PM - System Checkpoint
RP222: 10/24/2009 8:43:45 PM - System Checkpoint
RP223: 10/26/2009 1:53:51 PM - System Checkpoint
RP224: 10/28/2009 10:41:54 AM - System Checkpoint
RP225: 10/29/2009 11:44:34 AM - System Checkpoint
RP226: 10/30/2009 2:23:27 PM - System Checkpoint
RP227: 11/1/2009 9:32:54 PM - System Checkpoint
RP228: 11/3/2009 1:15:11 PM - System Checkpoint
RP229: 11/4/2009 9:49:18 AM - Software Distribution Service 3.0
RP230: 11/4/2009 9:49:25 AM - Installed Windows XP KB976749.
RP231: 11/5/2009 3:46:17 PM - System Checkpoint
RP232: 11/7/2009 5:01:13 PM - System Checkpoint
RP233: 11/11/2009 9:10:44 AM - Software Distribution Service 3.0
RP234: 11/11/2009 9:10:50 AM - Installed Windows XP KB969947.
RP235: 11/13/2009 11:14:11 AM - System Checkpoint
RP236: 11/15/2009 5:21:50 PM - System Checkpoint
RP237: 11/16/2009 8:33:03 PM - System Checkpoint
RP238: 11/18/2009 5:08:24 PM - System Checkpoint
RP239: 11/19/2009 6:39:07 PM - System Checkpoint
RP240: 11/20/2009 7:46:59 PM - System Checkpoint
RP241: 11/23/2009 6:32:41 PM - System Checkpoint
RP242: 11/25/2009 10:31:54 AM - System Checkpoint
RP243: 11/25/2009 1:51:47 PM - Software Distribution Service 3.0
RP244: 11/25/2009 1:52:17 PM - Installed Windows XP KB973687.
RP245: 11/25/2009 1:52:25 PM - Installed Windows XP KB976098-v2.
RP246: 11/26/2009 2:52:37 PM - System Checkpoint
RP247: 11/27/2009 3:15:29 PM - System Checkpoint
RP248: 11/29/2009 8:22:38 PM - System Checkpoint
RP249: 11/30/2009 10:50:07 PM - System Checkpoint
RP250: 12/2/2009 1:10:55 PM - System Checkpoint
RP251: 12/4/2009 11:17:10 AM - System Checkpoint
RP252: 12/5/2009 1:24:41 PM - System Checkpoint
RP253: 12/8/2009 12:03:39 PM - System Checkpoint
RP254: 12/9/2009 3:14:58 PM - Software Distribution Service 3.0
RP255: 12/9/2009 3:17:14 PM - Installed Windows XP KB971737.
RP256: 12/9/2009 3:18:01 PM - Installed Windows XP KB974392.
RP257: 12/9/2009 3:18:42 PM - Installed Windows XP KB973904.
RP258: 12/9/2009 3:18:52 PM - Installed Windows XP KB976325.
RP259: 12/9/2009 3:19:38 PM - Installed Windows XP KB974318.
RP260: 12/9/2009 3:19:44 PM - Installed Windows XP KB970430.
RP261: 12/11/2009 8:42:59 AM - System Checkpoint
RP262: 12/12/2009 1:46:51 PM - System Checkpoint
RP263: 12/16/2009 9:32:44 AM - System Checkpoint
RP264: 12/18/2009 12:55:33 AM - System Checkpoint
RP265: 12/19/2009 10:41:18 AM - Software Distribution Service 3.0
RP266: 12/20/2009 11:36:46 PM - System Checkpoint
RP267: 12/22/2009 3:03:44 PM - System Checkpoint
RP268: 12/23/2009 6:11:08 PM - System Checkpoint
RP269: 12/26/2009 2:48:19 PM - System Checkpoint
RP270: 12/28/2009 8:11:11 AM - System Checkpoint
RP271: 12/30/2009 2:19:32 PM - System Checkpoint
RP272: 12/31/2009 6:56:57 PM - System Checkpoint
RP273: 1/5/2010 2:24:43 AM - System Checkpoint
RP274: 1/6/2010 7:39:26 AM - System Checkpoint
RP275: 1/7/2010 11:34:39 AM - System Checkpoint
RP276: 1/8/2010 12:56:41 PM - System Checkpoint
RP277: 1/11/2010 12:33:46 AM - System Checkpoint
RP278: 1/14/2010 10:09:20 AM - Software Distribution Service 3.0
RP279: 1/14/2010 10:12:04 AM - Installed Windows XP KB972270.
RP280: 1/14/2010 10:12:15 AM - Installed Windows XP KB955759.
RP281: 1/15/2010 2:55:35 PM - System Checkpoint
RP282: 1/17/2010 7:48:25 PM - System Checkpoint
RP283: 1/18/2010 12:00:40 PM - Software Distribution Service 3.0
RP284: 1/19/2010 3:56:25 PM - Software Distribution Service 3.0
RP285: 1/19/2010 3:59:13 PM - Installed Windows Internet Explorer 8.
RP286: 1/19/2010 3:59:58 PM - Installed Windows XP KB975364.
RP287: 1/19/2010 4:00:12 PM - Installed Windows XP KB976325.
RP288: 1/19/2010 4:00:33 PM - Installed Windows XP Update for Microsoft Windows (KB971513).
RP289: 1/20/2010 9:51:45 AM - Software Distribution Service 3.0
RP290: 1/20/2010 9:52:07 AM - Installed Windows XP KB971961.
RP291: 1/22/2010 6:44:10 AM - Software Distribution Service 3.0
RP292: 1/22/2010 6:44:39 AM - Installed Windows XP KB978207.
RP293: 1/23/2010 1:09:50 PM - System Checkpoint
RP294: 1/24/2010 2:26:10 PM - System Checkpoint
RP295: 1/28/2010 9:18:44 AM - System Checkpoint
RP296: 1/29/2010 10:23:32 AM - System Checkpoint
RP297: 1/30/2010 3:53:06 PM - System Checkpoint
RP298: 1/31/2010 5:11:09 PM - Printer Driver doPDF 7 Printer Driver Installed
RP299: 2/2/2010 1:31:28 PM - System Checkpoint
RP300: 2/4/2010 9:34:37 PM - System Checkpoint
RP301: 2/4/2010 10:02:30 PM - Removed Broadcom Management Programs
RP302: 2/6/2010 1:26:29 PM - System Checkpoint
RP303: 2/7/2010 5:22:06 PM - System Checkpoint
RP304: 2/9/2010 9:08:35 PM - System Checkpoint
RP305: 2/10/2010 9:14:52 AM - Software Distribution Service 3.0
RP306: 2/10/2010 9:15:02 AM - Installed Windows XP KB977165.
RP307: 2/10/2010 9:15:20 AM - Installed Windows XP KB978706.
RP308: 2/10/2010 9:15:27 AM - Installed Windows XP KB977914.
RP309: 2/10/2010 9:16:17 AM - Installed Windows XP KB975560.
RP310: 2/10/2010 9:16:23 AM - Installed Windows XP KB978251.
RP311: 2/10/2010 9:16:28 AM - Installed Windows XP KB975713.
RP312: 2/10/2010 9:16:34 AM - Installed Windows XP KB978037.
RP313: 2/10/2010 9:18:52 AM - Installed Windows XP KB971468.
RP314: 2/10/2010 9:19:00 AM - Installed Windows XP KB978262.
RP315: 2/11/2010 10:42:33 AM - System Checkpoint
RP316: 2/14/2010 3:19:37 PM - System Checkpoint
RP317: 2/15/2010 11:43:07 PM - Installed Fidelity Active Trader Pro®.
RP318: 2/18/2010 1:41:54 PM - System Checkpoint
RP319: 2/20/2010 1:47:05 PM - System Checkpoint
RP320: 2/21/2010 7:00:14 PM - System Checkpoint
RP321: 2/23/2010 11:13:38 AM - System Checkpoint
RP322: 2/24/2010 9:26:43 AM - Software Distribution Service 3.0
RP323: 2/24/2010 9:26:47 AM - Installed Windows XP KB979306.
RP324: 2/24/2010 9:27:13 AM - Installed Windows XP KB976662.
RP325: 2/25/2010 2:06:09 PM - System Checkpoint
RP326: 2/26/2010 3:22:18 PM - System Checkpoint
RP327: 2/28/2010 6:58:26 PM - System Checkpoint
RP328: 3/2/2010 12:22:09 PM - System Checkpoint
RP329: 3/3/2010 12:23:39 PM - System Checkpoint
RP330: 3/4/2010 5:22:10 PM - System Checkpoint
RP331: 3/8/2010 2:01:23 PM - System Checkpoint
RP332: 3/9/2010 2:05:08 PM - System Checkpoint
RP333: 3/10/2010 11:42:31 PM - System Checkpoint
RP334: 3/11/2010 1:38:07 AM - Software Distribution Service 3.0
RP335: 3/11/2010 1:41:43 AM - Installed Windows XP KB975561.
RP336: 3/13/2010 6:30:23 PM - System Checkpoint
RP337: 3/15/2010 3:33:13 PM - System Checkpoint
RP338: 3/16/2010 7:24:16 PM - System Checkpoint
RP339: 3/19/2010 10:22:43 AM - System Checkpoint
RP340: 3/23/2010 5:57:35 PM - System Checkpoint
RP341: 3/24/2010 11:34:20 PM - System Checkpoint
RP342: 3/26/2010 2:31:20 PM - System Checkpoint
RP343: 3/27/2010 3:12:23 PM - System Checkpoint
RP344: 3/28/2010 10:13:58 PM - System Checkpoint
RP345: 3/30/2010 3:37:34 PM - System Checkpoint
RP346: 3/31/2010 9:40:25 AM - Software Distribution Service 3.0
RP347: 3/31/2010 9:40:54 AM - Installed Windows XP KB980182.
RP348: 4/1/2010 10:29:38 AM - Installed TurboTax 2009 wrapper
RP349: 4/1/2010 10:30:01 AM - Installed TurboTax 2009 WinPerReleaseEngine
RP350: 4/1/2010 10:30:31 AM - Installed TurboTax 2009 WinPerFedFormset
RP351: 4/1/2010 10:30:49 AM - Installed TurboTax 2009 WinPerTaxSupport
RP352: 4/1/2010 10:49:18 AM - Installed TurboTax 2009 wnyiper
RP353: 4/2/2010 11:59:21 AM - Installed StreetSmart Pro
RP354: 4/3/2010 2:43:57 PM - System Checkpoint
RP355: 4/4/2010 10:54:03 PM - System Checkpoint
RP356: 4/6/2010 6:38:18 AM - System Checkpoint
RP357: 4/7/2010 10:33:13 AM - System Checkpoint
RP358: 4/8/2010 4:45:32 PM - System Checkpoint
RP359: 4/10/2010 2:15:27 PM - System Checkpoint
RP360: 4/11/2010 3:51:04 PM - System Checkpoint
RP361: 4/12/2010 9:20:56 PM - System Checkpoint
RP362: 4/14/2010 4:45:00 AM - Software Distribution Service 3.0
RP363: 4/14/2010 4:45:50 AM - Installed Windows XP KB979309.
RP364: 4/14/2010 4:46:19 AM - Installed Windows XP KB981332.
RP365: 4/14/2010 4:46:25 AM - Installed Windows XP KB978601.
RP366: 4/14/2010 4:46:30 AM - Installed Windows XP KB977816.
RP367: 4/14/2010 4:46:36 AM - Installed Windows XP KB978338.
RP368: 4/14/2010 4:46:59 AM - Printer Driver Send To Microsoft OneNote Driver Installed
RP369: 4/14/2010 4:49:24 AM - Installed Windows XP KB980232.
RP370: 4/14/2010 4:49:32 AM - Installed Windows XP KB979683.
RP371: 4/15/2010 8:30:27 AM - System Checkpoint
RP372: 4/17/2010 12:31:58 PM - System Checkpoint
RP373: 4/19/2010 10:12:01 AM - System Checkpoint
RP374: 4/20/2010 7:17:47 PM - System Checkpoint
RP375: 4/22/2010 10:00:42 AM - System Checkpoint
RP376: 4/24/2010 11:45:05 AM - System Checkpoint
RP377: 4/25/2010 1:46:16 PM - System Checkpoint
RP378: 4/27/2010 1:18:50 PM - System Checkpoint
RP379: 4/29/2010 8:08:49 AM - System Checkpoint
RP380: 5/1/2010 9:31:22 AM - System Checkpoint
RP381: 5/4/2010 11:05:28 AM - System Checkpoint
RP382: 5/9/2010 1:17:55 PM - System Checkpoint
RP383: 5/11/2010 3:01:13 PM - System Checkpoint
RP384: 5/12/2010 7:16:31 AM - Software Distribution Service 3.0
RP385: 5/12/2010 7:17:24 AM - Installed Windows XP KB978542.
RP386: 5/13/2010 10:45:17 AM - System Checkpoint
RP387: 5/15/2010 10:50:38 AM - System Checkpoint
RP388: 5/17/2010 8:27:10 AM - System Checkpoint
RP389: 5/18/2010 10:33:30 AM - System Checkpoint
RP390: 5/20/2010 10:11:26 AM - System Checkpoint
RP391: 5/22/2010 12:18:02 PM - System Checkpoint
RP392: 5/24/2010 10:00:03 AM - System Checkpoint
RP393: 5/25/2010 11:55:44 AM - System Checkpoint
RP394: 5/25/2010 4:39:37 PM - Software Distribution Service 3.0
RP395: 5/25/2010 4:39:42 PM - Installed Windows XP KB981793.
RP396: 5/27/2010 9:49:22 AM - System Checkpoint
RP397: 6/1/2010 10:26:45 PM - System Checkpoint
RP398: 6/4/2010 7:04:34 AM - Software Distribution Service 3.0
RP399: 6/7/2010 9:45:09 AM - System Checkpoint
RP400: 6/9/2010 6:32:05 AM - System Checkpoint
RP401: 6/10/2010 10:15:51 AM - Software Distribution Service 3.0
RP402: 6/11/2010 8:26:14 AM - Software Distribution Service 3.0
RP403: 6/11/2010 8:31:00 AM - Installed Windows XP KB975562.
RP404: 6/11/2010 8:31:57 AM - Installed Windows XP KB979482.
RP405: 6/11/2010 8:32:30 AM - Installed Windows Media Player KB978695.
RP406: 6/11/2010 8:35:12 AM - Installed Windows XP KB982381.
RP407: 6/11/2010 8:35:35 AM - Installed Windows XP KB979559.
RP408: 6/11/2010 8:38:52 AM - Installed Windows XP KB980195.
RP409: 6/11/2010 8:39:16 AM - Installed Windows XP KB980218.
RP410: 6/12/2010 12:29:23 PM - System Checkpoint
RP411: 6/13/2010 2:34:19 PM - System Checkpoint
RP412: 6/15/2010 11:08:52 AM - System Checkpoint
RP413: 6/17/2010 9:23:31 PM - System Checkpoint
RP414: 6/20/2010 12:32:11 AM - System Checkpoint
RP415: 6/23/2010 7:54:12 PM - Software Distribution Service 3.0
RP416: 6/24/2010 8:28:47 PM - System Checkpoint
RP417: 6/27/2010 10:37:46 AM - System Checkpoint
RP418: 6/29/2010 12:06:22 PM - System Checkpoint
RP419: 6/30/2010 12:42:46 AM - Installed Ontrack EasyRecovery Professional
RP420: 7/1/2010 9:22:17 AM - System Checkpoint
RP421: 7/11/2010 9:37:07 AM - System Checkpoint
RP422: 7/14/2010 7:05:34 PM - Software Distribution Service 3.0
RP423: 7/14/2010 7:10:08 PM - Installed Windows XP KB2229593.
RP424: 7/27/2010 6:57:59 AM - System Checkpoint
RP425: 7/28/2010 2:58:51 PM - System Checkpoint
RP426: 7/30/2010 7:07:48 AM - System Checkpoint
RP427: 8/4/2010 3:29:10 PM - Software Distribution Service 3.0
RP428: 8/4/2010 3:29:18 PM - Installed Windows XP KB2286198.
RP429: 8/6/2010 2:37:25 PM - System Checkpoint
RP430: 8/10/2010 8:35:24 AM - System Checkpoint
RP431: 8/12/2010 5:11:35 PM - Software Distribution Service 3.0
RP432: 8/12/2010 5:12:20 PM - Installed Windows XP KB982665.
RP433: 8/12/2010 5:12:52 PM - Installed Windows XP KB981997.
RP434: 8/12/2010 5:15:37 PM - Installed Windows XP KB980436.
RP435: 8/12/2010 5:15:42 PM - Installed Windows XP KB2160329.
RP436: 8/12/2010 5:16:01 PM - Installed Windows XP KB2183461.
RP437: 8/12/2010 5:19:18 PM - Installed Windows XP KB2079403.
RP438: 8/12/2010 5:19:30 PM - Installed Windows XP KB981852.
RP439: 8/12/2010 5:19:44 PM - Installed Windows XP KB2115168.
RP440: 8/12/2010 5:19:50 PM - Installed Windows XP KB982214.
RP441: 8/14/2010 4:08:32 PM - System Checkpoint
RP442: 8/18/2010 9:13:58 AM - System Checkpoint
RP443: 8/19/2010 10:51:51 AM - System Checkpoint
RP444: 8/21/2010 3:02:41 PM - System Checkpoint
RP445: 8/23/2010 2:12:53 PM - System Checkpoint
RP446: 8/25/2010 11:30:54 AM - System Checkpoint
RP447: 8/26/2010 12:43:32 PM - System Checkpoint
RP448: 8/28/2010 9:51:54 AM - System Checkpoint
RP449: 8/29/2010 10:21:52 PM - System Checkpoint
RP450: 9/3/2010 3:27:00 PM - System Checkpoint
RP451: 9/5/2010 5:00:18 PM - Software Distribution Service 3.0
RP452: 9/6/2010 8:31:40 PM - System Checkpoint
RP453: 9/9/2010 1:06:55 AM - System Checkpoint
RP454: 9/10/2010 9:53:27 AM - System Checkpoint
RP455: 9/10/2010 5:43:36 PM - Installed DirectX
RP456: 9/11/2010 7:02:37 PM - System Checkpoint
RP457: 9/15/2010 3:41:38 AM - System Checkpoint
RP458: 9/15/2010 7:17:00 AM - Software Distribution Service 3.0
RP459: 9/15/2010 7:17:07 AM - Installed Windows XP KB2141007.
RP460: 9/15/2010 7:19:52 AM - Installed Windows XP KB981322.
RP461: 9/15/2010 7:19:59 AM - Installed Windows XP KB982802.
RP462: 9/15/2010 7:20:05 AM - Installed Windows XP KB2121546.
RP463: 9/15/2010 7:20:11 AM - Installed Windows XP KB2347290.
RP464: 9/15/2010 7:20:50 AM - Installed Windows Media Player KB975558.
RP465: 9/15/2010 7:20:56 AM - Installed Windows XP KB2259922.
RP466: 9/15/2010 7:41:30 AM - Software Distribution Service 3.0
RP467: 9/17/2010 2:12:38 PM - Installed StreetSmart Pro
RP468: 9/17/2010 3:38:35 PM - Installed Fidelity Active Trader Pro®.
RP469: 9/17/2010 3:39:26 PM - Removed Fidelity Active Trader Pro®.
RP470: 9/18/2010 5:35:56 PM - System Checkpoint
RP471: 9/20/2010 6:34:18 PM - System Checkpoint
RP472: 9/23/2010 1:02:24 PM - System Checkpoint
RP473: 9/25/2010 9:33:57 AM - System Checkpoint
RP474: 9/26/2010 10:41:11 AM - System Checkpoint
RP475: 9/27/2010 1:21:12 PM - System Checkpoint
RP476: 9/28/2010 4:10:53 PM - Software Distribution Service 3.0
RP477: 9/28/2010 4:10:57 PM - Installed Windows XP KB2158563.
RP478: 9/29/2010 9:09:13 PM - System Checkpoint
RP479: 9/30/2010 9:15:14 PM - System Checkpoint
RP480: 10/3/2010 8:36:10 PM - System Checkpoint
RP481: 10/5/2010 1:13:58 PM - System Checkpoint
RP482: 10/6/2010 6:23:53 PM - System Checkpoint
RP483: 10/7/2010 4:09:37 PM - Software Distribution Service 3.0
RP484: 10/7/2010 5:57:48 PM - Software Distribution Service 3.0
RP485: 10/10/2010 2:01:38 PM - System Checkpoint
RP486: 10/12/2010 11:42:27 AM - System Checkpoint
RP487: 10/13/2010 3:39:58 PM - Software Distribution Service 3.0
RP488: 10/13/2010 3:40:07 PM - Installed Windows XP KB2360937.
RP489: 10/13/2010 3:40:19 PM - Installed Windows XP KB981957.
RP490: 10/13/2010 3:44:31 PM - Installed Windows XP KB2360131.
RP491: 10/13/2010 3:45:33 PM - Installed Windows XP KB979687.
RP492: 10/13/2010 3:46:41 PM - Installed Windows XP KB982132.
RP493: 10/13/2010 3:47:21 PM - Installed Windows Media Player KB2378111.
RP494: 10/13/2010 3:47:50 PM - Installed Windows XP KB2296011.
RP495: 10/13/2010 3:47:57 PM - Installed Windows XP KB2345886.
RP496: 10/13/2010 3:48:07 PM - Installed Windows XP KB2279986.
RP497: 10/13/2010 3:48:15 PM - Installed Windows XP KB2387149.
RP498: 10/15/2010 12:43:32 PM - System Checkpoint
RP499: 10/21/2010 1:12:20 PM - System Checkpoint
RP500: 10/23/2010 8:14:06 PM - System Checkpoint
RP501: 10/26/2010 1:17:12 PM - System Checkpoint
RP502: 10/27/2010 2:22:32 PM - System Checkpoint
RP503: 10/30/2010 8:23:58 PM - System Checkpoint
RP504: 10/31/2010 10:21:41 PM - System Checkpoint
RP505: 11/2/2010 9:57:43 PM - System Checkpoint

==== Installed Programs ======================


a-squared HiJackFree 3.1
AC3Filter (remove only)
Ad-Aware SE Personal
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Media Player
Adobe Reader 8.2.5
Adobe Shockwave Player 11.5
AIM 7
AnswerWorks 4.0 Runtime - English
AnswerWorks 5.0 English Runtime
AOLIcon
Audit Support Center 1.0
Bloomberg Keyboard v10.4
Bloomberg SFD Data Dictionary
CCleaner (remove only)
Chessmaster 7000
Compatibility Pack for the 2007 Office system
Conexant D850 56K V.9x DFVc Modem
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
Dell CinePlayer
Dell Support 3.2.1
Dell System Restore
Digital Line Detect
DivX Converter
DivX Plus DirectShow Filters
DivX Setup
DivX Version Checker
Documentation & Support Launcher
doPDF 7.1 printer
Download Updater (AOL LLC)
ESET Online Scanner
ESET Online Scanner v3
Express Burn
Fidelity Active Trader Pro®
FLV Player 2.0 (build 25)
Free Easy Burner V 4.1
Free FLV Converter V 6.7.5
Free Mp3 Wma Converter V 1.9
Free Video Joiner 1.1
Free YouTube to Mp3 Wma Converter 3.5.1.1 Build 76
Games, Music, & Photos Launcher
GMATPrep(TM)
GPL MPEG-1/2 DirectShow Decoder Filter
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
ImageMixer VCD/DVD2 for OLYMPUS
Internet Service Offers Launcher
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
K-Lite Codec Pack 3.4.0 Full
Learn2 Player (Uninstall Only)
LG USB Modem driver
LiveUpdate 3.1 (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Converter Pack
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Office Word Viewer 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Modem Diagnostic Tool
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
NetWaiting
NetZeroInstallers
NVIDIA Drivers
OLYMPUS Master
Ontrack EasyRecovery Professional
Ordix Mpack Professional 4.72
Peck's Power Join
Pixillion Image Converter
QuickLink Mobile
QuickTime
RealPlayer
RealUpgrade 1.0
Rhapsody Player Engine
Roxio DLA
Roxio MyDVD LE
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
SearchAssist
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB2288953)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Sonic Activation Module
Sonic Update Manager
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
Spyware Doctor 6.0
SpywareBlaster 4.2
StreetSmart Pro
SUPERAntiSpyware
Symantec AntiVirus
The Options Toolbox v5.0
Torrent WMV Joiner 1.11
Trend Micro RUBotted
Turbo Tax Audit Support Center 2.0
TurboTax 2008
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wnyiper
TurboTax 2008 wrapper
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wnyiper
TurboTax 2009 wrapper
Unlocker 1.8.7
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Windows (KB971513)
Update for Outlook 2007 Junk Email Filter (kb2410711)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
VC80CRTRedist - 8.0.50727.4053
WavePad Sound Editor
WebFldrs XP
Winamp
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Presentation Foundation
Windows XP Service Pack 3
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

11/3/2010 5:59:34 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdPPM ASPI32 eeCtrl Fips nvatabus nvraid SASDIFSV SASKUTIL SAVRT SAVRTPEL SPBBCDrv SYMTDI
11/3/2010 12:59:52 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
11/2/2010 4:02:23 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service LiveUpdate with arguments " " in order to run the server: {03E0E6C2-363B-11D3-B536-00902771A435}
11/2/2010 2:12:46 AM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).
11/2/2010 12:11:52 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdPPM ASPI32 eeCtrl Fips IPSec MRxSmb NetBIOS NetBT nvatabus nvraid RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
11/2/2010 12:11:52 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
11/2/2010 12:11:52 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/2/2010 12:11:52 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/2/2010 12:11:52 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
11/2/2010 10:30:58 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
11/2/2010 10:30:25 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/2/2010 10:29:55 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdPPM ASPI32 eeCtrl Fips nvatabus nvraid SAVRT SAVRTPEL SPBBCDrv SYMTDI
10/31/2010 11:24:06 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
10/29/2010 7:51:20 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: nvatabus nvraid SYMTDI

==== End Of File ===========================

 

MBAM rescanned and Combofix enclosed:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5026

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

11/5/2010 1:27:50 PM
mbam-log-2010-11-05 (13-27-50).txt

Scan type: Quick scan
Objects scanned: 1
Time elapsed: 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


ComboFix 10-11-02.06 - sillychica 11/05/2010 13:47:43.1.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1982.1667 [GMT -4:00]
Running from: c:\documents and settings\sillychica\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((( Files Created from 2010-10-05 to 2010-11-05 )))))))))))))))))))))))))))))))
.

2010-11-03 15:48 . 2010-11-05 15:50 -------- d-----w- C:\MGtools
2010-11-03 13:44 . 2010-11-03 13:44 -------- d-----w- c:\windows\LastGood
2010-11-03 09:58 . 2010-11-03 09:58 -------- d-----w- c:\documents and settings\sillychica\Application Data\SUPERAntiSpyware.com
2010-11-03 05:15 . 2010-11-03 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-11-03 05:14 . 2010-11-03 05:15 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-11-03 04:31 . 2010-11-03 05:02 -------- d-----w- c:\documents and settings\Administrator
2010-11-03 01:57 . 2008-03-02 07:28 206608 ----a-w- c:\windows\system32\drivers\TMPassthru.sys
2010-11-03 01:57 . 2010-11-03 01:57 -------- d-----w- c:\documents and settings\sillychica\Application Data\InstallShield
2010-11-03 01:56 . 2010-11-03 01:56 -------- d-----w- c:\documents and settings\sillychica\log
2010-11-02 20:04 . 2010-09-06 09:26 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-11-02 18:46 . 2010-11-02 18:46 -------- d-----w- c:\program files\ESET
2010-10-13 18:02 . 2010-09-18 06:53 954368 ------w- c:\windows\system32\dllcache\mfc40.dll
2010-10-13 18:02 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 18:02 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-13 18:01 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2010-10-09 02:41 . 2010-10-09 02:41 1409 ----a-w- c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-05 17:45 . 2008-06-29 06:57 4748 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-11-05 15:50 . 2010-11-03 15:48 133230 ----a-w- C:\MGlogs.zip
2010-09-18 16:23 . 2004-08-10 16:51 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-10 16:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-10 16:51 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-10 16:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58 . 2004-08-10 16:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2004-08-10 16:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2004-08-10 16:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2004-08-10 16:50 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2004-08-10 16:51 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-10 16:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-10 16:51 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2004-08-10 16:51 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-16 00:03 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2004-08-10 16:50 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-10 16:51 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-10 16:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-08-12 04:07 . 2007-09-21 04:05 126448 ------w- c:\windows\system32\pxinsi64.exe
2010-08-12 04:07 . 2007-09-21 04:05 123888 ------w- c:\windows\system32\pxcpyi64.exe
2010-08-12 04:07 . 2007-05-07 02:32 133616 ------w- c:\windows\system32\pxafs.dll
2010-08-12 04:07 . 2005-01-26 06:03 45648 ------w- c:\windows\system32\drivers\pxhelp20.sys
1999-03-25 18:30 . 2007-05-13 17:11 2336256 ----a-w- c:\program files\DATA1.MSI
1999-03-01 22:00 . 2007-05-13 17:11 165376 ----a-w- c:\program files\MSOWC.MSI
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-08-23 7630848]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-08-23 86016]
"DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"DMXLauncher "= "c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"vptray "= "c:\progra~1\SYMANT~1\\vptray.exe" [2006-09-28 125168]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Malwarebytes Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\Schwab\\SSPro\\SSPro.exe "=
"c:\\Program Files\\AIM\\aim.exe "=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/8/2008 6:54 PM 715248]
R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;c:\windows\system32\drivers\CBG54.SYS [11/1/2005 4:13 AM 372480]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\TMPassthru.sys [11/2/2010 9:57 PM 206608]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
S2 RUBotted;Trend Micro RUBotted Service;c:\program files\trend micro\RUBotted\TMRUBotted.exe [11/2/2010 9:57 PM 582992]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/28/2010 8:05 PM 102448]
S3 fd_dbus;FutureDial USB Composite Device driver (WDM);c:\windows\system32\drivers\fd_dbus.sys [1/26/2008 10:13 PM 44816]
S3 fd_dmdfl;FutureDial USB Modem Filter;c:\windows\system32\drivers\fd_dmdfl.sys [1/26/2008 10:14 PM 6000]
S3 fd_dmdm;FutureDial USB Modem Drivers;c:\windows\system32\drivers\fd_dmdm.sys [1/26/2008 10:14 PM 72912]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);c:\windows\system32\drivers\lgatserd.sys [1/26/2008 10:15 PM 60816]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/29/2008 10:46 PM 356920]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\drivers\TMPassthru.sys [11/2/2010 9:57 PM 206608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-10-12 c:\windows\Tasks\pixillionShakeIcon.job
- c:\program files\NCH Software\Pixillion\pixillion.exe [2010-09-30 14:44]

2010-11-03 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-4264511125-2958481334-217148112-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]

2010-11-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-4264511125-2958481334-217148112-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
Trusted Zone: ebay.com\www
Trusted Zone: fidelity.com
Trusted Zone: fidelity.com\www
Trusted Zone: half.com\www
Trusted Zone: intuit.com\ttlc
Trusted Zone: kaspersky.com\www
Trusted Zone: nysdmv.com
Trusted Zone: turbotax.com
DPF: vzTCPConfig - hxxp://www2.verizon.net/help/dsl_settings/include/vzTCPConfig.CAB
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(812)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\L3codeca.acm
c:\windows\system32\divxa32.acm
c:\windows\system32\ac3acm.acm
c:\windows\system32\lameACM.acm
c:\windows\system32\IEFRAME.dll

- - - - - - - > 'explorer.exe'(256)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
.
Completion time: 2010-11-05 13:55:07
ComboFix-quarantined-files.txt 2010-11-05 17:55
ComboFix2.txt 2010-11-03 14:41
ComboFix3.txt 2009-01-17 22:06

Pre-Run: 5,109,907,456 bytes free
Post-Run: 5,085,331,456 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 1ADB161030051F5BDBD262DF2970B898


Thank you so much for taking a look at this!!!!!!!!!!!!!!!!!!!!!!!!

 

Hehe I got antsy and yes I ran combofix. It seems that what all the techies are recommending with these nasty infections. But usually their recommendations come with some fancy script which I'm dying to know how you guys figure it all out. Just a mess of code to me

Here's the requested log:
ComboFix 10-11-02.06 - sillychica 11/03/2010 10:37:46.1.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1982.1501 [GMT -4:00]
Running from: c:\documents and settings\sillychica\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\sillychica\Application Data\Desktopicon
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\BSTIEPrintCtl1.dll
c:\windows\system32\ftpecab.dll
c:\windows\system32\zip32.dll

.
((((((((((((((((((((((((( Files Created from 2010-10-03 to 2010-11-03 )))))))))))))))))))))))))))))))
.

2010-11-03 13:44 . 2010-11-03 13:44 -------- d-----w- c:\windows\LastGood
2010-11-03 09:58 . 2010-11-03 09:58 -------- d-----w- c:\documents and settings\sillychica\Application Data\SUPERAntiSpyware.com
2010-11-03 05:15 . 2010-11-03 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-11-03 05:14 . 2010-11-03 05:15 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-11-03 05:10 . 2010-11-03 05:10 2400464 ----a-w- C:\MGtools.exe
2010-11-03 04:31 . 2010-11-03 05:02 -------- d-----w- c:\documents and settings\Administrator
2010-11-03 01:57 . 2008-03-02 07:28 206608 ----a-w- c:\windows\system32\drivers\TMPassthru.sys
2010-11-03 01:57 . 2010-11-03 01:57 -------- d-----w- c:\documents and settings\sillychica\Application Data\InstallShield
2010-11-03 01:56 . 2010-11-03 01:56 -------- d-----w- c:\documents and settings\sillychica\log
2010-11-02 20:04 . 2010-09-06 09:26 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-11-02 18:46 . 2010-11-02 18:46 -------- d-----w- c:\program files\ESET
2010-10-13 18:02 . 2010-09-18 06:53 954368 ------w- c:\windows\system32\dllcache\mfc40.dll
2010-10-13 18:02 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 18:02 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-13 18:01 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2010-10-09 02:41 . 2010-10-09 02:41 1409 ----a-w- c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-03 10:02 . 2008-06-29 06:57 4748 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-09-18 16:23 . 2004-08-10 16:51 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-10 16:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-10 16:51 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-10 16:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58 . 2004-08-10 16:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2004-08-10 16:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2004-08-10 16:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2004-08-10 16:50 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2004-08-10 16:51 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-10 16:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-10 16:51 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2004-08-10 16:51 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-16 00:03 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2004-08-10 16:50 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-10 16:51 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-10 16:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-08-12 04:07 . 2007-09-21 04:05 126448 ------w- c:\windows\system32\pxinsi64.exe
2010-08-12 04:07 . 2007-09-21 04:05 123888 ------w- c:\windows\system32\pxcpyi64.exe
2010-08-12 04:07 . 2007-05-07 02:32 133616 ------w- c:\windows\system32\pxafs.dll
2010-08-12 04:07 . 2005-01-26 06:03 45648 ------w- c:\windows\system32\drivers\pxhelp20.sys
1999-03-25 18:30 . 2007-05-13 17:11 2336256 ----a-w- c:\program files\DATA1.MSI
1999-03-01 22:00 . 2007-05-13 17:11 165376 ----a-w- c:\program files\MSOWC.MSI
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-08-23 7630848]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-08-23 86016]
"DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"DMXLauncher "= "c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"vptray "= "c:\progra~1\SYMANT~1\\vptray.exe" [2006-09-28 125168]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2007-05-03 98304]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-30 202256]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"c:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\Schwab\\SSPro\\SSPro.exe "=
"c:\\Program Files\\AIM\\aim.exe "=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/8/2008 6:54 PM 715248]
R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;c:\windows\system32\drivers\CBG54.SYS [11/1/2005 4:13 AM 372480]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\TMPassthru.sys [11/2/2010 9:57 PM 206608]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
S2 RUBotted;Trend Micro RUBotted Service;c:\program files\trend micro\RUBotted\TMRUBotted.exe [11/2/2010 9:57 PM 582992]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/28/2010 8:05 PM 102448]
S3 fd_dbus;FutureDial USB Composite Device driver (WDM);c:\windows\system32\drivers\fd_dbus.sys [1/26/2008 10:13 PM 44816]
S3 fd_dmdfl;FutureDial USB Modem Filter;c:\windows\system32\drivers\fd_dmdfl.sys [1/26/2008 10:14 PM 6000]
S3 fd_dmdm;FutureDial USB Modem Drivers;c:\windows\system32\drivers\fd_dmdm.sys [1/26/2008 10:14 PM 72912]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);c:\windows\system32\drivers\lgatserd.sys [1/26/2008 10:15 PM 60816]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/29/2008 10:46 PM 356920]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\drivers\TMPassthru.sys [11/2/2010 9:57 PM 206608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-10-12 c:\windows\Tasks\pixillionShakeIcon.job
- c:\program files\NCH Software\Pixillion\pixillion.exe [2010-09-30 14:44]

2010-11-03 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-4264511125-2958481334-217148112-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]

2010-11-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-4264511125-2958481334-217148112-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
Trusted Zone: ebay.com\www
Trusted Zone: fidelity.com
Trusted Zone: fidelity.com\www
Trusted Zone: half.com\www
Trusted Zone: intuit.com\ttlc
Trusted Zone: kaspersky.com\www
Trusted Zone: nysdmv.com
Trusted Zone: turbotax.com
DPF: vzTCPConfig - hxxp://www2.verizon.net/help/dsl_settings/include/vzTCPConfig.CAB
.
- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - c:\documents and settings\sillychica\Desktop\HijackThis.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(804)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\L3codeca.acm
c:\windows\system32\divxa32.acm
c:\windows\system32\ac3acm.acm
c:\windows\system32\lameACM.acm
c:\windows\system32\IEFRAME.dll
.
Completion time: 2010-11-03 10:41:44
ComboFix-quarantined-files.txt 2010-11-03 14:41
ComboFix2.txt 2009-01-17 22:06

Pre-Run: 5,019,889,664 bytes free
Post-Run: 5,150,433,280 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - C9D4C7130366C97E2E79761B09004878

 

HEY!!!!!!!!!!!! I think I'm back in. I can actually load a program in windows. Woohoo!!!!

Alright now, I just want to make sure sure everything is kosher and super clean. What do I do from here? Rescan in safe mode, rescan normal mode.....just want to make sure there isn't any surprises.

THANK YOU SOOOOOOOOOOOOOOOO MUCH! XOXOXO

 

MBAM and OTL logs enclosed. Just so you know. I ran a scan with SAS, and it found some infections that keep reappearing after it quarantines, deletes, after reboot. It's stuck in the system volume info restore area. I've attached the SAS log as well.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5063

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

11/6/2010 7:14:59 PM
mbam-log-2010-11-06 (19-14-59).txt

Scan type: Full scan (C:\|)
Objects scanned: 277824
Time elapsed: 53 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/07/2010 at 00:33 AM

Application Version : 4.45.1000

Core Rules Database Version : 5821
Trace Rules Database Version: 3633

Scan type : Complete Scan
Total Scan Time : 00:57:08

Memory items scanned : 279
Memory threats detected : 0
Registry items scanned : 8655
Registry threats detected : 0
File items scanned : 45946
File threats detected : 4

Trojan.Agent/Gen
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP505\A0066974.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP505\A0066975.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP505\A0068031.EXE
C:\WINDOWS\MBR.EXE

 

OTL logfile created on: 11/7/2010 12:44:30 PM - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\sillychica\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 229.77 Gb Total Space | 4.18 Gb Free Space | 1.82% Space Free | Partition Type: NTFS

Computer Name: DGVXJXC1 | User Name: sillychica | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/07 00:07:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sillychica\Desktop\OTL.exe
PRC - [2010/09/24 04:15:10 | 000,040,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
PRC - [2009/09/29 08:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/11/06 10:33:54 | 000,582,992 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\trend micro\RUBotted\TMRUBotted.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/09/27 19:33:44 | 000,125,168 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\VPTray.exe
PRC - [2006/09/27 19:33:32 | 001,813,232 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe
PRC - [2006/09/27 19:33:22 | 000,031,472 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe
PRC - [2006/07/19 18:26:12 | 000,169,632 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
PRC - [2006/07/19 18:26:06 | 000,192,160 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
PRC - [2006/07/19 18:26:04 | 000,052,896 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2006/04/11 16:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
PRC - [2005/10/05 02:12:00 | 000,094,208 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
PRC - [2005/09/08 04:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE
PRC - [2004/07/27 15:50:18 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/11/07 00:07:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sillychica\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/02/19 19:30:16 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/09/29 08:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2008/11/06 10:33:54 | 000,582,992 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe -- (RUBotted)
SRV - [2008/11/05 01:09:58 | 001,079,176 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2008/09/21 10:27:32 | 000,356,920 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2006/11/03 18:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2006/09/27 19:33:38 | 000,116,464 | ---- | M] (symantec) [On_Demand | Stopped] -- C:\Program Files\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/09/27 19:33:32 | 001,813,232 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/09/27 19:33:22 | 000,031,472 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/09/02 15:36:33 | 002,528,960 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE -- (LiveUpdate)
SRV - [2006/07/19 18:26:12 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/07/19 18:26:06 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/04/11 16:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\ASSWHO~1\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/11/02 00:00:00 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101106.003\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/11/02 00:00:00 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101106.003\NAVENG.SYS -- (NAVENG)
DRV - [2010/06/17 03:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/28 03:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/05/10 13:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 13:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2008/09/21 10:27:36 | 000,081,288 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\iksyssec.sys -- (IKSysSec)
DRV - [2008/09/21 10:27:36 | 000,066,952 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\iksysflt.sys -- (IkSysFlt)
DRV - [2008/09/21 10:27:35 | 000,040,840 | ---- | M] (PCTools Research Pty Ltd.) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ikfilesec.sys -- (IKFileSec)
DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/03/02 02:28:00 | 000,206,608 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TMPassthru.sys -- (TMPassthruMP)
DRV - [2008/03/02 02:28:00 | 000,206,608 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TMPassthru.sys -- (TMPassthru)
DRV - [2008/01/26 14:33:28 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2007/04/16 20:46:00 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2007/02/25 20:25:12 | 000,105,472 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)
DRV - [2006/09/18 16:55:28 | 000,109,744 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2006/09/06 13:41:20 | 000,337,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Symantec AntiVirus\savrt.sys -- (SAVRT)
DRV - [2006/09/06 13:41:20 | 000,054,968 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)
DRV - [2006/08/23 11:12:38 | 003,959,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2006/08/15 02:00:18 | 001,171,464 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2006/08/14 05:29:44 | 000,044,544 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/08/05 06:00:48 | 000,089,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\nvraid.sys -- (nvraid) NVIDIA nForce(tm)
DRV - [2006/08/05 06:00:40 | 000,105,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2006/04/11 16:13:34 | 000,389,776 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2006/01/10 10:07:58 | 000,004,864 | ---- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2005/11/01 03:13:48 | 000,372,480 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CBG54.SYS -- (CBBCM43)
DRV - [2005/09/12 02:30:00 | 000,089,264 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)
DRV - [2005/09/08 04:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005/09/08 04:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005/09/08 04:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005/09/08 04:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005/09/08 04:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005/09/08 04:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005/09/08 04:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005/08/25 11:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005/08/25 11:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2005/08/12 04:20:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM)
DRV - [2005/01/17 20:46:56 | 000,072,912 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fd_dmdm.sys -- (fd_dmdm)
DRV - [2005/01/17 20:46:56 | 000,006,000 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fd_dmdfl.sys -- (fd_dmdfl)
DRV - [2005/01/17 20:46:55 | 000,044,816 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fd_dbus.sys -- (fd_dbus) FutureDial USB Composite Device driver (WDM)
DRV - [2005/01/17 20:46:44 | 000,060,816 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgatserd.sys -- (lgatserd) LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM)
DRV - [2004/03/08 11:55:50 | 000,013,567 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS -- (cdrbsdrv)
DRV - [2003/11/17 13:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 13:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 13:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2001/08/17 13:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 13:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 13:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 13:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 13:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 12:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 12:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 12:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 12:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 12:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 12:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 12:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 12:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 12:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 12:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [1999/09/10 12:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6070503
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6070503

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========



FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users\Application Data\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007/09/20 23:05:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/30 14:24:34 | 000,000,000 | ---D | M]

[2009/11/27 10:49:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Mozilla\Extensions
[2007/09/20 23:05:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Mozilla\Firefox\Profiles\vjdprwgb.default\extensions
[2007/09/20 23:06:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\sillychica\Application Data\Mozilla\Firefox\Profiles\vjdprwgb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2007/09/20 23:06:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Mozilla\Firefox\Profiles\vjdprwgb.default\extensions\staged-xpis

O1 HOSTS File: ([2010/11/03 09:40:33 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: ebay.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: fidelity.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: fidelity.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: half.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: kaspersky.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: nysdmv.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1248663102328 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} https://www.goconcierge.net/secure/arview2.cab (ActiveReports Viewer2)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} http://ax.emsisoft.com/asquared.cab (a-squared Scanner)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://optionvue.webex.com/client/T27LB/nbr/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: vzTCPConfig http://www2.verizon.net/help/dsl_settings/include/vzTCPConfig.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O18 - Protocol\Handler\x-atng {7e8717b0-d862-11d5-8c9e-00010304f989} - C:\Program Files\Fidelity Investments\Fidelity Active Trader\System\atngprot.dll (Fidelity Investments)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\sillychica\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\sillychica\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.divxa32 - C:\WINDOWS\System32\divxa32.acm (Kristal StudioD
FileDescription)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIV3 - C:\WINDOWS\System32\DivXc32.dll (Hacked with Joy !)
Drivers32: vidc.DIV4 - C:\WINDOWS\System32\DivXc32f.dll (Hacked with Joy !)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.i263 - C:\WINDOWS\System32\I263_32.drv (Intel Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\Pvmjpg21.dll (Pegasus Imaging Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Error starting restore point: 126
Error closing restore point: The sequence number is invalid.

========== Files/Folders - Created Within 30 Days ==========

[2010/11/07 12:33:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/11/07 00:07:18 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\sillychica\Desktop\OTL.exe
[2010/11/05 21:57:28 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/11/05 15:57:00 | 001,329,752 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\sillychica\Desktop\tdsskiller.exe
[2010/11/05 12:55:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/11/05 12:46:46 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/11/04 11:49:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sillychica\Desktop\v2
[2010/11/04 11:44:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sillychica\Desktop\v1
[2010/11/03 10:48:57 | 000,000,000 | ---D | C] -- C:\MGtools
[2010/11/03 09:45:36 | 000,472,064 | ---- | C] ( ) -- C:\Documents and Settings\sillychica\Desktop\RootRepeal.exe
[2010/11/03 09:37:02 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/11/03 09:34:31 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/11/03 09:34:31 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/11/03 09:34:31 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/11/03 09:34:31 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/11/03 09:34:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/11/03 05:51:42 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\sillychica\Recent
[2010/11/03 04:58:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sillychica\Application Data\SUPERAntiSpyware.com
[2010/11/03 00:15:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/11/03 00:14:21 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/11/02 20:57:43 | 000,206,608 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\TMPassthru.sys
[2010/11/02 20:57:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sillychica\Application Data\InstallShield
[2010/11/02 20:56:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sillychica\log
[2010/11/02 15:04:26 | 000,189,520 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2010/11/02 13:46:29 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2008/03/13 07:22:10 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\Implode.dll
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Documents and Settings\sillychica\My Documents\*.tmp files -> C:\Documents and Settings\sillychica\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/07 12:44:30 | 000,000,312 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-4264511125-2958481334-217148112-1006.job
[2010/11/07 12:44:30 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-4264511125-2958481334-217148112-1006.job
[2010/11/07 12:39:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/07 12:39:01 | 2078,789,632 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/07 00:07:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sillychica\Desktop\OTL.exe
[2010/11/06 23:54:54 | 000,163,312 | ---- | M] () -- C:\MGlogs.zip
[2010/11/06 23:53:35 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/05 15:57:01 | 001,329,752 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\sillychica\Desktop\tdsskiller.exe
[2010/11/04 20:44:49 | 000,000,250 | ---- | M] () -- C:\WINDOWS\gmer.ini
[2010/11/04 11:58:31 | 000,295,424 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\3pnzh5ei.exe
[2010/11/03 17:36:29 | 000,088,064 | ---- | M] () -- C:\WINDOWS\MBR.exe
[2010/11/03 11:23:39 | 000,628,736 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\dds.scr
[2010/11/03 09:45:44 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\settings.dat
[2010/11/03 09:40:33 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/11/03 09:37:07 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/11/03 09:33:34 | 003,901,988 | R--- | M] () -- C:\Documents and Settings\sillychica\Desktop\ComboFix.exe
[2010/11/03 00:14:26 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/11/03 00:10:58 | 002,400,464 | ---- | M] () -- C:\MGtools.exe
[2010/11/02 13:46:16 | 002,672,312 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\esetsmartinstaller_enu.exe
[2010/10/31 23:51:46 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2010/10/30 10:31:05 | 000,006,656 | ---- | M] () -- C:\Documents and Settings\sillychica\Application Data\dvd.bmk
[2010/10/21 13:09:38 | 000,035,429 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\Portfolio Review 2010.xlsx
[2010/10/20 14:09:53 | 000,015,694 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\Charles Schwab - Review 2010.xlsx
[2010/10/18 13:03:21 | 000,011,530 | ---- | M] () -- C:\Documents and Settings\sillychica\My Documents\Angela Lui - letter.docx
[2010/10/14 14:49:05 | 000,011,527 | ---- | M] () -- C:\Documents and Settings\sillychica\My Documents\The Grepolis Exploration - Essay.docx
[2010/10/13 14:51:21 | 000,301,232 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/13 13:53:31 | 000,240,185 | ---- | M] () -- C:\Documents and Settings\sillychica\My Documents\Christopher Lui - Essay 3.pdf
[2010/10/12 14:45:00 | 000,000,310 | ---- | M] () -- C:\WINDOWS\tasks\pixillionShakeIcon.job
[2010/10/08 21:41:49 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Documents and Settings\sillychica\My Documents\*.tmp files -> C:\Documents and Settings\sillychica\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/07 12:25:36 | 2078,789,632 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/04 11:58:31 | 000,295,424 | ---- | C] () -- C:\Documents and Settings\sillychica\Desktop\3pnzh5ei.exe
[2010/11/03 11:23:39 | 000,628,736 | ---- | C] () -- C:\Documents and Settings\sillychica\Desktop\dds.scr
[2010/11/03 11:20:09 | 000,811,008 | ---- | C] () -- C:\Documents and Settings\sillychica\Desktop\gmer.exe
[2010/11/03 10:48:59 | 000,163,312 | ---- | C] () -- C:\MGlogs.zip
[2010/11/03 09:45:44 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\sillychica\Desktop\settings.dat
[2010/11/03 09:37:07 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/11/03 09:37:03 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/11/03 09:34:31 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/11/03 09:34:31 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/11/03 09:34:31 | 000,088,064 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/11/03 09:34:31 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/11/03 09:34:31 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/11/03 09:33:26 | 003,901,988 | R--- | C] () -- C:\Documents and Settings\sillychica\Desktop\ComboFix.exe
[2010/11/03 00:14:26 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/11/03 00:10:55 | 002,400,464 | ---- | C] () -- C:\MGtools.exe
[2010/11/02 13:46:12 | 002,672,312 | ---- | C] () -- C:\Documents and Settings\sillychica\Desktop\esetsmartinstaller_enu.exe
[2010/10/27 22:43:47 | 000,000,304 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-4264511125-2958481334-217148112-1006.job
[2010/10/17 23:11:32 | 000,011,530 | ---- | C] () -- C:\Documents and Settings\sillychica\My Documents\Angela Lui - letter.docx
[2010/10/14 14:49:05 | 000,011,527 | ---- | C] () -- C:\Documents and Settings\sillychica\My Documents\The Grepolis Exploration - Essay.docx
[2010/10/13 13:53:30 | 000,240,185 | ---- | C] () -- C:\Documents and Settings\sillychica\My Documents\Christopher Lui - Essay 3.pdf
[2010/10/08 21:41:49 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2010/10/08 21:41:49 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2010/09/28 22:07:29 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\GIF89.DLL
[2010/09/17 13:15:44 | 001,122,753 | ---- | C] () -- C:\Documents and Settings\sillychica\Application Data\luitsang.zip
[2010/04/02 11:41:54 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2010/01/18 00:28:40 | 000,004,984 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\epzgivyr.ebb
[2009/12/16 04:06:22 | 003,190,784 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2009/12/16 04:06:22 | 000,741,376 | ---- | C] () -- C:\WINDOWS\System32\audxlib.dll
[2009/12/16 04:06:22 | 000,662,016 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/12/16 04:06:22 | 000,511,488 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2009/12/16 04:06:22 | 000,405,504 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2009/12/16 04:06:22 | 000,245,760 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
[2009/12/16 04:06:22 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
[2009/12/16 04:06:22 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2009/12/16 04:06:22 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
[2009/12/16 04:06:22 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2009/12/16 04:06:22 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
[2009/12/16 04:06:22 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
[2009/12/16 04:06:22 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2009/12/16 04:06:22 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\ff_realaac.dll
[2009/12/16 04:06:22 | 000,079,872 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll
[2009/12/16 04:06:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
[2009/12/16 04:06:22 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
[2009/12/16 04:06:22 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2009/12/16 04:06:22 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/10/15 00:14:21 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\sillychica\Local Settings\Application Data\housecall.guid.cache
[2009/08/17 00:36:54 | 000,000,063 | ---- | C] () -- C:\WINDOWS\GSP.INI
[2009/01/16 15:49:15 | 000,000,250 | ---- | C] () -- C:\WINDOWS\gmer.ini
[2009/01/16 15:49:14 | 000,884,736 | ---- | C] () -- C:\WINDOWS\gmer.dll
[2008/03/13 07:22:10 | 000,748,160 | ---- | C] () -- C:\WINDOWS\System32\Co2c40en.dll
[2008/03/13 07:22:10 | 000,054,272 | ---- | C] () -- C:\WINDOWS\System32\P2irdao.dll
[2008/03/13 07:22:10 | 000,050,176 | ---- | C] () -- C:\WINDOWS\System32\P2ctdao.dll
[2007/11/10 22:10:03 | 000,006,656 | ---- | C] () -- C:\Documents and Settings\sillychica\Application Data\dvd.bmk
[2007/11/03 12:54:55 | 000,000,141 | ---- | C] () -- C:\Documents and Settings\sillychica\Local Settings\Application Data\fusioncache.dat
[2007/10/28 22:04:36 | 000,037,376 | ---- | C] () -- C:\WINDOWS\System32\VbVfw.dll
[2007/09/24 20:07:10 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2007/09/24 20:07:09 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/08/08 11:26:08 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\img_utils.dll
[2007/08/08 11:25:10 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\imgscaler.dll
[2007/08/06 13:17:40 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\OnlineScannerLang.dll
[2007/08/02 18:11:28 | 000,253,952 | ---- | C] () -- C:\WINDOWS\System32\OnlineScannerDLLA.dll
[2007/08/02 18:11:14 | 000,241,664 | ---- | C] () -- C:\WINDOWS\System32\OnlineScannerDLLW.dll
[2007/07/27 15:49:02 | 000,225,355 | ---- | C] () -- C:\WINDOWS\System32\lnod32apiW.dll
[2007/07/27 15:49:02 | 000,196,683 | ---- | C] () -- C:\WINDOWS\System32\lnod32apiA.dll
[2007/06/24 21:21:45 | 000,000,016 | ---- | C] () -- C:\WINDOWS\encore_launcher.ini
[2007/05/26 15:32:15 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A5W.INI
[2007/05/20 19:51:01 | 000,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2007/05/13 12:25:48 | 000,044,032 | ---- | C] () -- C:\Documents and Settings\sillychica\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/13 12:15:05 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/05/13 12:12:00 | 000,011,776 | ---- | C] () -- C:\Program Files\README.DOC
[2007/05/13 12:12:00 | 000,002,626 | ---- | C] () -- C:\Program Files\SETUP.INI
[2007/05/13 12:11:50 | 047,633,547 | ---- | C] () -- C:\Program Files\OFFICE1.CAB
[2007/05/13 12:11:50 | 002,336,256 | ---- | C] () -- C:\Program Files\DATA1.MSI
[2007/05/13 12:11:50 | 000,165,376 | ---- | C] () -- C:\Program Files\MSOWC.MSI
[2007/05/13 12:11:50 | 000,087,676 | ---- | C] () -- C:\Program Files\MSOWC.CAB
[2007/05/13 12:11:50 | 000,020,596 | ---- | C] () -- C:\Program Files\LICENSE.TXT
[2007/05/05 16:04:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2007/05/05 15:44:05 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2007/05/03 10:21:50 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2007/05/03 10:15:36 | 000,000,273 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2007/05/03 09:55:41 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007/05/03 09:55:41 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007/05/03 09:55:41 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007/05/03 09:55:40 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007/05/03 09:55:40 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2007/05/03 09:55:40 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/05/03 09:55:38 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2007/05/03 09:54:29 | 000,000,394 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2007/02/26 15:13:34 | 002,392,064 | ---- | C] () -- C:\WINDOWS\System32\videotrans.dll
[2007/02/26 15:13:34 | 000,215,040 | ---- | C] () -- C:\WINDOWS\System32\videoformat.dll
[2006/12/06 13:39:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/12/05 20:25:22 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\lnod32umc.dll
[2005/12/05 13:37:10 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\lnod32upd.dll
[2004/08/10 12:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 11:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/07/12 23:49:02 | 000,003,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\BFAIFILT.SYS
[2004/05/27 21:43:42 | 000,003,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\AIFILT.SYS
[1999/01/22 12:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2010/06/16 05:50:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
[2009/08/28 12:23:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fidelity Investments
[2009/08/05 22:02:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/02/22 20:18:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2010/11/02 15:33:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/11/03 00:01:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/06/30 07:53:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\.oit
[2010/01/09 02:11:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\AbsolutePoker
[2007/05/06 21:53:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\acccore
[2010/03/19 12:24:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\E-centives
[2010/01/14 17:06:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Free YouTube to Mp3 Wma Converter
[2010/04/02 11:41:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\FreeAudioPack
[2010/09/28 22:09:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\FreeBurner
[2010/07/25 21:24:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\FreeFLVConverter
[2008/11/28 23:25:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\gtk-2.0
[2007/05/06 21:33:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\MusicIP
[2009/08/05 21:47:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\NCH Swift Sound
[2008/03/13 21:37:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Nitro PDF
[2008/06/18 21:57:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\NwDocx
[2007/05/13 12:51:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\OLYMPUS
[2008/07/02 19:04:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Simply Super Software
[2010/01/31 17:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Softland
[2007/05/20 02:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sillychica\Application Data\Viewpoint
[2010/10/12 14:45:00 | 000,000,310 | ---- | M] () -- C:\WINDOWS\Tasks\pixillionShakeIcon.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/08/10 12:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/08/17 16:37:18 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/11/03 09:37:07 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 22:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/11/05 12:55:07 | 000,012,333 | ---- | M] () -- C:\ComboFix.txt
[2004/08/10 12:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2007/05/03 09:58:14 | 000,006,823 | RH-- | M] () -- C:\dell.sdr
[2010/11/07 12:39:01 | 2078,789,632 | -HS- | M] () -- C:\hiberfil.sys
[2007/05/06 20:57:36 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2004/08/10 12:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2010/09/22 14:39:35 | 000,002,588 | -H-- | M] () -- C:\IPH.PH
[2010/11/07 12:37:12 | 000,009,411 | ---- | M] () -- C:\JavaRa.log
[2010/05/24 09:38:24 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2010/11/06 23:54:54 | 000,163,312 | ---- | M] () -- C:\MGlogs.zip
[2010/11/03 00:10:58 | 002,400,464 | ---- | M] () -- C:\MGtools.exe
[2004/08/10 12:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2004/08/04 04:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/08/31 18:53:12 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/11/07 12:38:59 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2007/05/03 10:19:22 | 000,000,070 | ---- | M] () -- C:\SystemInfo.ini
[2010/11/05 21:51:39 | 000,106,230 | ---- | M] () -- C:\TDSSKiller.2.4.6.0_05.11.2010_17.00.52_log.txt
[2010/11/05 21:54:55 | 000,052,790 | ---- | M] () -- C:\TDSSKiller.2.4.6.0_05.11.2010_22.54.06_log.txt
[2009/01/17 06:49:23 | 000,000,618 | ---- | M] () -- C:\VundoFix.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 12:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

 

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[1999/03/25 13:30:40 | 002,336,256 | ---- | M] () -- C:\Program Files\DATA1.MSI
[1999/02/24 14:35:22 | 000,020,596 | ---- | M] () -- C:\Program Files\LICENSE.TXT
[1999/01/20 20:15:34 | 000,087,676 | ---- | M] () -- C:\Program Files\MSOWC.CAB
[1999/03/01 17:00:24 | 000,165,376 | ---- | M] () -- C:\Program Files\MSOWC.MSI
[1999/03/25 13:26:12 | 047,633,547 | ---- | M] () -- C:\Program Files\OFFICE1.CAB
[1999/03/19 14:48:56 | 000,011,776 | ---- | M] () -- C:\Program Files\README.DOC
[1998/12/10 14:25:06 | 000,017,610 | ---- | M] () -- C:\Program Files\SETUP.HLP
[1999/03/23 08:43:30 | 000,002,626 | ---- | M] () -- C:\Program Files\SETUP.INI

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 11:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 11:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 11:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/08/31 18:56:12 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/28 15:23:34 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\sillychica\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/10 12:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\sillychica\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/11/04 11:58:31 | 000,295,424 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\3pnzh5ei.exe
[2009/01/15 21:02:54 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\sillychica\Desktop\ATF-Cleaner.exe
[2008/06/29 00:59:12 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\sillychica\Desktop\cheese.exe
[2010/11/03 09:33:34 | 003,901,988 | R--- | M] () -- C:\Documents and Settings\sillychica\Desktop\ComboFix.exe
[2004/12/25 22:35:02 | 000,464,632 | ---- | M] (InterMute, Inc.) -- C:\Documents and Settings\sillychica\Desktop\CWShredder.exe
[2010/11/02 13:46:16 | 002,672,312 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\esetsmartinstaller_enu.exe
[2008/04/17 20:13:02 | 000,811,008 | ---- | M] () -- C:\Documents and Settings\sillychica\Desktop\gmer.exe
[2010/11/07 00:07:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sillychica\Desktop\OTL.exe
[2009/08/13 10:14:18 | 000,472,064 | ---- | M] ( ) -- C:\Documents and Settings\sillychica\Desktop\RootRepeal.exe
[2010/11/05 15:57:01 | 001,329,752 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\sillychica\Desktop\tdsskiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/08/31 19:12:58 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\sillychica\Favorites\Desktop.ini
[2009/08/05 21:47:13 | 000,000,220 | ---- | M] () -- C:\Documents and Settings\sillychica\Favorites\NCH Audio and Telephony Software.lnk
[2010/09/30 09:44:16 | 000,000,256 | ---- | M] () -- C:\Documents and Settings\sillychica\Favorites\NCH Software Download.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/11/07 12:44:29 | 000,049,152 | -HS- | M] () -- C:\Documents and Settings\sillychica\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 00:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 00:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 19:12:28 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 00:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 00:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 00:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2009/02/28 14:45:58 | 000,005,120 | -HS- | M] () -- C:\Program Files\Messenger\Thumbs.db
[2004/08/04 00:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 00:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1999/09/10 12:06:00 | 000,004,672 | ---- | M] (Adaptec) -- C:\WINDOWS\system\WOWPOST.EXE

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMPFC5A2B2
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B7BEAFF

< End of report >

 

Good it really be true? A clean scan? =) ESET did not detect anything. Security check log enclosed. Is there anything else I need to do to make absolutely sure it's clean?

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
ESET Online Scanner v3
ESET Online Scanner
Symantec AntiVirus
a-squared HiJackFree 3.1
Trend Micro RUBotted
```````````````````````````````
Anti-malware/Other Utilities Check:
Out of date Spybot installed!
Ad-Aware
Malwarebytes' Anti-Malware
CCleaner (remove only)
Java(TM) 6 Update 22
Out of date Java installed!
Adobe Flash Player
Adobe Reader 8.2.5
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Symantec AntiVirus DefWatch.exe
Symantec AntiVirus Rtvscan.exe
Trend Micro RUBotted TMRUBotted.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

 

Hi there! I think we're getting really close. I'm literally on the edge of my seat. Updated the Adobe, ran the OTL, MBAM, TFC.....computer seems to be running smoothly. ESET was clean. Happy about that. I'm going to run another scan using Microsoft's One Care.

One setback though. I scanned using SAS, and I still see trojans coming up here:
Trojan.Agent/Gen
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP0\A0000011.EXE

I think something is still stuck in the system restore? Before the .exe file was named something else. I know viruses tend to generate some random file in the restore point. I suspect there might be remnants.

So close.....what do I do now? Thanks for everything thus far.