Solved Generic Host Process for Win32 has encountered a problem

[Resolved] Generic Host Process for Win32 has encountered a problem

Lately, I keep getting this message, and within a minute or so after, my internet disconnects, and only begins working again once I've restarted the game/browser/msn etc.

Also, (not sure if this is related or not, but I figured I'd include it just in case)
lately I've noticed that both the Windows Audio and theme services (and probably others I haven't noticed) randomly get disabled and I need to start them again in order for them to work *sometimes in which, it doesn't and I need to restart the computer*

Also, I've had a fair few viruses lately, and switched programs from AVG Internet Security to Microsoft Security Essentials, which seems to be picking up the ones AVG skipped. But yeah, a fair few odd things have been going on with my pc lately, and I wouldn't mind getting them fixed up/sorting it out.

Thanks in advance.

EDIT: It won't let me post the last two logs, the DDS and Attach ones, every time I try I get this error:

This webpage is not available.

The webpage at http://www.windowsbbs.com/newreply.php?do=postreply&t=96260 might be temporarily down or it may have moved permanently to a new web address.

 

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5119

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

11/15/2010 9:24:04 PM
mbam-log-2010-11-15 (21-24-04).txt

Scan type: Quick scan
Objects scanned: 158503
Time elapsed: 7 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\winygg32.dll (Trojan.Nebuler) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{18f99dc8-aa16-bdb7-8c9d-b538c85de2c5} (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\winygg32.dll (Trojan.Nebuler) -> Delete on reboot.

 

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-11-15 21:39:33
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 ST3500418AS rev.CC38
Running: h7y29n0y.exe; Driver: C:\DOCUME~1\Hannah\LOCALS~1\Temp\pxtdrpob.sys


---- Kernel code sections - GMER 1.0.15 ----

? fphgvg.sys The system cannot find the file specified. !
init C:\WINDOWS\system32\drivers\Senfilt.sys entry point in "init" section [0xA1B5AA00]

---- User code sections - GMER 1.0.15 ----

.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[172] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[468] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
.text C:\WINDOWS\Explorer.EXE[872] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00A9000A
.text C:\WINDOWS\Explorer.EXE[872] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00BF000A
.text C:\WINDOWS\Explorer.EXE[872] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00A8000C
.text C:\WINDOWS\System32\svchost.exe[1132] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00A2000A
.text C:\WINDOWS\System32\svchost.exe[1132] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00A3000A
.text C:\WINDOWS\System32\svchost.exe[1132] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00A1000C
.text C:\WINDOWS\System32\svchost.exe[1132] ole32.dll!CoCreateInstance 77526009 5 Bytes JMP 00AF000A
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1548] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
.text C:\WINDOWS\system32\wuauclt.exe[3932] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 012B000A
.text C:\WINDOWS\system32\wuauclt.exe[3932] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 012C000A
.text C:\WINDOWS\system32\wuauclt.exe[3932] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 012A000C

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 89DE0292
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 89DE0292
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 89DE0292
Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3500418AS_____________________________CC38____#5&7935f70&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths@Directory C:\Documents and Settings\Hannah\Local Settings\Temporary Internet Files\Content.IE5
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1@CacheLimit 12800
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1@CachePath C:\Documents and Settings\Hannah\Local Settings\Temporary Internet Files\Content.IE5\Cache1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2@CacheLimit 12800
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2@CachePath C:\Documents and Settings\Hannah\Local Settings\Temporary Internet Files\Content.IE5\Cache2
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3@CacheLimit 12800
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3@CachePath C:\Documents and Settings\Hannah\Local Settings\Temporary Internet Files\Content.IE5\Cache3
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4@CacheLimit 12800
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4@CachePath C:\Documents and Settings\Hannah\Local Settings\Temporary Internet Files\Content.IE5\Cache4

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; TDL4 <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 32: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 976772912 (+255): rootkit-like behavior;

---- EOF - GMER 1.0.15 ----

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 120):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E2000 \WINDOWS\system32\hal.dll
0x89D65000 \WINDOWS\system32\KDCOM.DLL
0xBA4BC000 \WINDOWS\system32\BOOTVID.dll
0xBA0A8000 fphgvg.sys
0xB9F79000 ACPI.sys
0xBA5A8000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0B8000 isapnp.sys
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0C8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AA000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0D8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xBA338000 cercsr6.sys
0xB9EF3000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xBA0E8000 disk.sys
0xBA0F8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9ED3000 fltMgr.sys
0xB9EC1000 sr.sys
0xB9EAA000 KSecDD.sys
0xB9E93000 WudfPf.sys
0xB9E06000 Ntfs.sys
0xB9DD9000 NDIS.sys
0xB9DBE000 Mup.sys
0xBA2C8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB87AA000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xB8796000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA3E0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB8773000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3E8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB874B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB8720000 \SystemRoot\system32\DRIVERS\b57xp32.sys
0xB870C000 \SystemRoot\system32\DRIVERS\parport.sys
0xBA2D8000 \SystemRoot\system32\DRIVERS\serial.sys
0xB9D6D000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA2E8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA308000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB86E9000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA3F0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xBA7D4000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA318000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB9D65000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB86D2000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA118000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA128000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA3F8000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB86C1000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA138000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA400000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA408000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB8690000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA148000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA410000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA418000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5D4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB865C000 \SystemRoot\system32\DRIVERS\update.sys
0xB95D2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA1D8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA1E8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5FC000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA1B86000 \SystemRoot\system32\drivers\ADIHdAud.sys
0xA1B62000 \SystemRoot\system32\drivers\portcls.sys
0xA37FC000 \SystemRoot\system32\drivers\drmk.sys
0xA1B02000 \SystemRoot\system32\drivers\Senfilt.sys
0xA1ADF000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xBA5AC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA6BD000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5AE000 \SystemRoot\System32\Drivers\Beep.SYS
0xA3BA9000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xA3BA1000 \SystemRoot\System32\drivers\vga.sys
0xBA5B0000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5B2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xA3511000 \SystemRoot\System32\Drivers\Msfs.SYS
0xA3509000 \SystemRoot\System32\Drivers\Npfs.SYS
0xA4A35000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA1AAC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA1A54000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA1A2C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA396C000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xA1A0A000 \SystemRoot\Sy

 

DDS & Attach Logs

It's not letting me submit another reply when I try to post the other 2 logs, however it does let me edit this post and save. But when I try to edit and add logs and save instead I get:

This webpage is not available.

The webpage at http://www.windowsbbs.com/editpost.php?do=updatepost&postid=540177 might be temporarily down or it may have moved permanently to a new web address.

More information on this error

 

TDSSKiller Log

2010/11/16 12:04:42.0906 TDSS rootkit removing tool 2.4.7.0 Nov 8 2010 10:52:22
2010/11/16 12:04:42.0906 ================================================================================
2010/11/16 12:04:42.0906 SystemInfo:
2010/11/16 12:04:42.0906
2010/11/16 12:04:42.0906 OS Version: 5.1.2600 ServicePack: 2.0
2010/11/16 12:04:42.0906 Product type: Workstation
2010/11/16 12:04:42.0906 ComputerName: IPOD
2010/11/16 12:04:42.0906 UserName: Hannah
2010/11/16 12:04:42.0906 Windows directory: C:\WINDOWS
2010/11/16 12:04:42.0906 System windows directory: C:\WINDOWS
2010/11/16 12:04:42.0906 Processor architecture: Intel x86
2010/11/16 12:04:42.0906 Number of processors: 2
2010/11/16 12:04:42.0906 Page size: 0x1000
2010/11/16 12:04:42.0906 Boot type: Normal boot
2010/11/16 12:04:42.0906 ================================================================================
2010/11/16 12:04:43.0453 Initialize success
2010/11/16 12:04:51.0187 ================================================================================
2010/11/16 12:04:51.0187 Scan started
2010/11/16 12:04:51.0187 Mode: Manual;
2010/11/16 12:04:51.0187 ================================================================================
2010/11/16 12:04:52.0031 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/11/16 12:04:52.0062 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/11/16 12:04:52.0078 adfs (6d7f09cd92a9fef3a8efce66231fdd79) C:\WINDOWS\system32\drivers\adfs.sys
2010/11/16 12:04:52.0109 ADIHdAudAddService (62afc64108bbdb8d3ca32aad559e5af1) C:\WINDOWS\system32\drivers\ADIHdAud.sys
2010/11/16 12:04:52.0156 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
2010/11/16 12:04:52.0187 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
2010/11/16 12:04:52.0328 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/11/16 12:04:52.0343 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/11/16 12:04:52.0453 ati2mtag (7e682d97868cefae5d2bbd23ebbf7207) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2010/11/16 12:04:52.0531 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/11/16 12:04:52.0562 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/11/16 12:04:52.0578 b57w2k (d0692f7b8217e3b82d2bfac535816117) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2010/11/16 12:04:52.0593 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/11/16 12:04:52.0625 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/11/16 12:04:52.0625 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/11/16 12:04:52.0671 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/11/16 12:04:52.0703 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/11/16 12:04:52.0703 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/11/16 12:04:52.0734 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys
2010/11/16 12:04:52.0843 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/11/16 12:04:52.0890 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
2010/11/16 12:04:52.0906 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\DRIVERS\dmio.sys
2010/11/16 12:04:52.0921 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/11/16 12:04:52.0984 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2010/11/16 12:04:53.0015 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/11/16 12:04:53.0078 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/11/16 12:04:53.0109 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/11/16 12:04:53.0125 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
2010/11/16 12:04:53.0140 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/11/16 12:04:53.0171 FltMgr (54fd90f0038f07920cb9fb6591bde82f) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/11/16 12:04:53.0187 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/11/16 12:04:53.0203 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/11/16 12:04:53.0234 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2010/11/16 12:04:53.0250 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/11/16 12:04:53.0265 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/11/16 12:04:53.0281 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/11/16 12:04:53.0328 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/11/16 12:04:53.0453 ialm (bd9462e346229f37fd5b95fbcb6d3d34) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2010/11/16 12:04:53.0578 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/11/16 12:04:53.0625 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/11/16 12:04:53.0640 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/11/16 12:04:53.0687 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/11/16 12:04:53.0703 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/11/16 12:04:53.0718 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/11/16 12:04:53.0734 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/11/16 12:04:53.0765 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/11/16 12:04:53.0796 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/11/16 12:04:53.0812 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/11/16 12:04:53.0828 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/11/16 12:04:53.0859 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
2010/11/16 12:04:53.0875 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/11/16 12:04:53.0906 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/11/16 12:04:53.0937 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
2010/11/16 12:04:53.0953 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/11/16 12:04:53.0968 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/11/16 12:04:53.0984 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/11/16 12:04:54.0000 MpFilter (c98301ad8173a2235a9ab828955c32bb) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
2010/11/16 12:04:54.0031 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/11/16 12:04:54.0046 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/11/16 12:04:54.0062 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2010/11/16 12:04:54.0093 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/11/16 12:04:54.0109 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/11/16 12:04:54.0140 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/11/16 12:04:54.0171 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/11/16 12:04:54.0187 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/11/16 12:04:54.0203 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2010/11/16 12:04:54.0234 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/11/16 12:04:54.0265 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2010/11/16 12:04:54.0296 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/11/16 12:04:54.0312 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/11/16 12:04:54.0328 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/11/16 12:04:54.0359 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/11/16 12:04:54.0375 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/11/16 12:04:54.0390 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/11/16 12:04:54.0406 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/11/16 12:04:54.0484 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
2010/11/16 12:04:54.0515 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2010/11/16 12:04:54.0515 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2010/11/16 12:04:54.0546 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/11/16 12:04:54.0578 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/11/16 12:04:54.0609 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/11/16 12:04:54.0625 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/11/16 12:04:54.0671 ovt519 (4cdadec3dc1300ee1d313ea5494e6472) C:\WINDOWS\system32\Drivers\ov519vid.sys
2010/11/16 12:04:54.0703 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/11/16 12:04:54.0703 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/11/16 12:04:54.0718 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/11/16 12:04:54.0750 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2010/11/16 12:04:54.0765 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/11/16 12:04:54.0796 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/11/16 12:04:54.0828 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/11/16 12:04:54.0921 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/11/16 12:04:54.0937 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/11/16 12:04:54.0968 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/11/16 12:04:55.0062 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/11/16 12:04:55.0062 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/11/16 12:04:55.0078 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/11/16 12:04:55.0093 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/11/16 12:04:55.0125 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/11/16 12:04:55.0140 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/11/16 12:04:55.0171 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/11/16 12:04:55.0234 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/11/16 12:04:55.0265 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/11/16 12:04:55.0328 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/11/16 12:04:55.0343 SenFiltService (b6a6b409fda9d9ebd3aadb838d3d7173) C:\WINDOWS\system32\drivers\Senfilt.sys
2010/11/16 12:04:55.0375 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/11/16 12:04:55.0375 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/11/16 12:04:55.0406 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/11/16 12:04:55.0437 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/11/16 12:04:55.0468 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
2010/11/16 12:04:55.0500 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/11/16 12:04:55.0546 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/11/16 12:04:55.0578 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/11/16 12:04:55.0609 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/11/16 12:04:55.0625 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2010/11/16 12:04:55.0687 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/11/16 12:04:55.0703 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/11/16 12:04:55.0734 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/11/16 12:04:55.0750 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/11/16 12:04:55.0781 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/11/16 12:04:55.0843 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2010/11/16 12:04:55.0890 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
2010/11/16 12:04:55.0937 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2010/11/16 12:04:55.0968 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/11/16 12:04:56.0000 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
2010/11/16 12:04:56.0031 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/11/16 12:04:56.0046 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/11/16 12:04:56.0078 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/11/16 12:04:56.0093 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/11/16 12:04:56.0140 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\DRIVERS\usbser.sys
2010/11/16 12:04:56.0156 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/11/16 12:04:56.0187 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/11/16 12:04:56.0203 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2010/11/16 12:04:56.0218 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/11/16 12:04:56.0250 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/11/16 12:04:56.0281 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2010/11/16 12:04:56.0328 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/11/16 12:04:56.0359 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2010/11/16 12:04:56.0406 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/11/16 12:04:56.0421 WudfPf (eaa6324f51214d2f6718977ec9ce0def) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/11/16 12:04:56.0437 WudfRd (f91ff1e51fca30b3c3981db7d5924252) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/11/16 12:04:56.0468 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/11/16 12:04:56.0468 ================================================================================
2010/11/16 12:04:56.0468 Scan finished
2010/11/16 12:04:56.0468 ================================================================================
2010/11/16 12:04:56.0484 Detected object count: 1
2010/11/16 12:05:13.0312 \HardDisk0 - will be cured after reboot
2010/11/16 12:05:13.0312 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2010/11/16 12:05:18.0734 Deinitialize success

 

MBR Check Log & DDS

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 118):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E2000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0B8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0C8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xBA338000 cercsr6.sys
0xB9EF3000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9ED3000 fltMgr.sys
0xB9EC1000 sr.sys
0xB9EAA000 KSecDD.sys
0xB9E93000 WudfPf.sys
0xB9E06000 Ntfs.sys
0xB9DD9000 NDIS.sys
0xB9DBE000 Mup.sys
0xBA2E8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB97AA000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xB9796000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA3E0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB9773000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3E8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB974B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB9720000 \SystemRoot\system32\DRIVERS\b57xp32.sys
0xB970C000 \SystemRoot\system32\DRIVERS\parport.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA568000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA308000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA318000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA108000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB96E9000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA3F0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xBA7C0000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA118000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA570000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB96D2000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA128000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA138000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA3F8000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB96C1000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA148000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA400000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA408000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB9690000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA158000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA410000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA418000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5C6000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB9634000 \SystemRoot\system32\DRIVERS\update.sys
0xBA590000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA198000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA1A8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5C8000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA8679000 \SystemRoot\system32\drivers\ADIHdAud.sys
0xA8655000 \SystemRoot\system32\drivers\portcls.sys
0xBA1B8000 \SystemRoot\system32\drivers\drmk.sys
0xA8555000 \SystemRoot\system32\drivers\Senfilt.sys
0xA850A000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xBA564000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA1D8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA428000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA5F2000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA6CA000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5F4000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA438000 \SystemRoot\System32\drivers\vga.sys
0xBA5F6000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5F8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA440000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA448000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB9688000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA84D7000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA847F000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA8457000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB9680000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xA840D000 \SystemRoot\System32\drivers\afd.sys
0xBA1E8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA83EC000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xA83C0000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA8351000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA1F8000 \SystemRoot\System32\Drivers\Fips.SYS
0xBA208000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xBA5A0000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xA8549000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA238000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA8339000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA5FE000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xBA460000 \SystemRoot\System32\watchdog.sys
0xA852D000 \SystemRoot\System32\drivers\Dxapi.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA771000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
0xBF25B000 \SystemRoot\System32\igxpdx32.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xA8119000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA7D6C000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA5B4000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xA7D33000 \SystemRoot\System32\Drivers\adfs.SYS
0xA7BC8000 \SystemRoot\system32\DRIVERS\srv.sys
0xA7983000 \SystemRoot\system32\drivers\wdmaud.sys
0xA7A20000 \SystemRoot\system32\drivers\sysaudio.sys
0xA75D4000 \SystemRoot\System32\Drivers\HTTP.sys
0xA4D51000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 38):
0 System Idle Process
4 System
592 C:\WINDOWS\system32\smss.exe
640 csrss.exe
664 C:\WINDOWS\system32\winlogon.exe
708 C:\WINDOWS\system32\services.exe
728 C:\WINDOWS\system32\lsass.exe
904 C:\WINDOWS\system32\ati2evxx.exe
924 C:\WINDOWS\system32\svchost.exe
996 svchost.exe
1092 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
1132 C:\WINDOWS\system32\svchost.exe
1172 C:\WINDOWS\system32\svchost.exe
1288 svchost.exe
1384 svchost.exe
1512 C:\WINDOWS\system32\ati2evxx.exe
1596 C:\WINDOWS\system32\spoolsv.exe
360 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
732 C:\Program Files\Bonjour\mDNSResponder.exe
1492 C:\WINDOWS\system32\svchost.exe
508 alg.exe
1316 C:\WINDOWS\explorer.exe
2120 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
2244 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
2328 C:\WINDOWS\system32\hkcmd.exe
2336 C:\WINDOWS\system32\igfxpers.exe
2388 C:\Program Files\Analog Devices\Core\smax4pnp.exe
2396 C:\Program Files\iTunes\iTunesHelper.exe
2404 C:\Program Files\Microsoft Security Essentials\msseces.exe
2420 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
2480 C:\WINDOWS\system32\ctfmon.exe
2496 C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
2528 C:\WINDOWS\system32\igfxsrvc.exe
2660 C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
3004 C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
3056 E:\Program Files\Safari.exe
3112 C:\Program Files\iPod\bin\iPodService.exe
2836 C:\Documents and Settings\Hannah\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000018`6a631a00 (NTFS)

PhysicalDrive0 Model Number: ST3500418AS, Rev: CC38

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

DDS.txt:​

DDS (Ver_10-11-10.01) - NTFSx86
Run by Hannah at 12:21:26.12 on Tue 11/16/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_19
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1420 [GMT -8:00]

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
E:\Program Files\Safari.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Hannah\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.com/
mURLSearchHooks: H - No File
BHO: MediaBar: {0974ba1e-64ec-11de-b2a5-e43756d89593} - c:\progra~1\bearsh~1\mediabar\toolbar\BearshareMediabarDx.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: UrlHelper Class: {74322bf9-df26-493f-b0da-6d2fc5e6429e} - c:\progra~1\bearsh~1\mediabar\datamngr\IEBHO.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: MediaBar: {0974ba1e-64ec-11de-b2a5-e43756d89593} - c:\progra~1\bearsh~1\mediabar\toolbar\BearshareMediabarDx.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe "
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [<NO NAME>]
uRun: [Google Update] "c:\documents and settings\hannah\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [AdobeBridge]
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe "
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [DATAMNGR] c:\progra~1\bearsh~1\mediabar\datamngr\DATAMN~1.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
IE: Google Sidewiki... -
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Trusted Zone: microsoft.com\update
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264470923921
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxdev.dll
Notify: winygg32 - winygg32.dll
AppInit_DLLs: c:\progra~1\bearsh~1\mediabar\datamngr\datamngr.dll c:\progra~1\bearsh~1\mediabar\datamngr\IEBHO.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\hannah\applic~1\mozilla\firefox\profiles\cjse2fui.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com/
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - component: c:\program files\nokia\nokia ovi suite\connectors\bookmarks connector\firefoxextension\components\FirefoxExtension.dll
FF - plugin: c:\documents and settings\hannah\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\documents and settings\hannah\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: e:\program files\mozilla plugins\npitunes.dll
FF - plugin: e:\program\plugins\npdsplay.dll
FF - plugin: e:\program\plugins\npqtplugin.dll
FF - plugin: e:\program\plugins\npqtplugin2.dll
FF - plugin: e:\program\plugins\npqtplugin3.dll
FF - plugin: e:\program\plugins\npqtplugin4.dll
FF - plugin: e:\program\plugins\npqtplugin5.dll
FF - plugin: e:\program\plugins\npqtplugin6.dll
FF - plugin: e:\program\plugins\npqtplugin7.dll
FF - plugin: e:\program\plugins\npwmsdrm.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);

============= SERVICES / DRIVERS ===============

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]
S0 cerc6;cerc6; [x]
S1 mqkncfkh;mqkncfkh;\??\c:\windows\system32\drivers\mqkncfkh.sys --> c:\windows\system32\drivers\mqkncfkh.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-18 136176]

=============== Created Last 30 ================

2010-11-16 05:12:58 -------- d-----w- c:\docume~1\hannah\applic~1\Malwarebytes
2010-11-16 05:12:51 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-16 05:12:50 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-11-16 05:12:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-16 05:12:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-15 22:44:57 6146896 ------w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{3af23a3c-107f-473c-9b08-767902e98e21}\mpengine.dll
2010-11-15 21:57:30 -------- d-----w- c:\program files\GameSpy Arcade
2010-11-15 21:56:48 -------- d-----w- c:\program files\Microsoft Games
2010-11-12 22:11:07 6146896 ------w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2010-11-11 21:16:30 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-11-11 21:00:54 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-11-09 01:57:59 36927 -c--a-w- c:\windows\system32\dllcache\padrs411.dll
2010-11-09 01:56:58 45568 -c--a-w- c:\windows\system32\dllcache\browscap.dll
2010-11-09 01:54:51 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2010-11-09 01:54:51 16384 ----a-w- c:\program files\internet explorer\connection wizard\isignup.exe
2010-11-09 01:53:01 44544 -c--a-w- c:\windows\system32\dllcache\tscupgrd.exe
2010-11-09 01:53:01 44544 ----a-w- c:\windows\system32\tscupgrd.exe
2010-11-09 01:40:45 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-11-09 01:40:45 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-11-09 01:40:45 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-11-09 01:40:45 13312 ----a-w- c:\windows\system32\irclass.dll
2010-11-09 01:40:25 13753 ----a-r- c:\windows\SETDA.tmp
2010-11-09 01:40:22 1086058 ----a-r- c:\windows\SETCE.tmp
2010-11-09 01:40:20 1042903 ----a-r- c:\windows\SETCD.tmp
2010-11-02 23:28:19 -------- d-----w- c:\docume~1\hannah\applic~1\bearsharemediabartb
2010-11-02 23:28:09 -------- d-----w- c:\docume~1\hannah\locals~1\applic~1\BearShare
2010-11-02 23:27:40 -------- d-----w- c:\program files\BearShare Applications
2010-11-02 23:27:40 -------- d-----w- c:\docume~1\alluse~1\applic~1\BearShare
2010-11-02 23:26:08 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{E44BF2E3-2CC0-45E3-9CBD-0BD2C4F69F55}
2010-11-02 23:26:00 -------- d-----w- c:\docume~1\hannah\locals~1\applic~1\PackageAware
2010-11-02 15:37:59 15256 ----a-w- c:\docume~1\hannah\applic~1\microsoft\identitycrl\production\ppcrlconfig.dll
2010-11-02 15:26:04 -------- d-----w- c:\windows\setup.pss
2010-11-02 15:23:28 -------- d-----w- c:\program files\Magical Jelly Bean
2010-11-01 21:58:39 282928 ----a-w- c:\windows\system32\HMIPCore.dll
2010-10-22 02:49:43 -------- d-----w- c:\docume~1\hannah\applic~1\InstantAction
2010-10-21 01:12:29 -------- d-----w- c:\windows\system32\Adobe

==================== Find3M ====================

2010-09-08 18:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 18:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll

============= FINISH: 12:22:05.53 ===============

 

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-10.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/8/2010 5:58:35 PM
System Uptime: 11/16/2010 12:06:46 PM (0 hours ago)

Motherboard: Dell Inc. | | 0WF810
Processor: Intel(R) Pentium(R) D CPU 3.40GHz | Microprocessor | 3389/800mhz
Processor: Intel(R) Pentium(R) D CPU 3.40GHz | Microprocessor | 3389/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 98 GiB total, 56.195 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 368 GiB total, 367.09 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia Windows Portable Device Driver
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 6230
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd

==== System Restore Points ===================

RP1: 11/8/2010 6:04:02 PM - System Checkpoint
RP2: 11/10/2010 6:29:36 PM - Installed Windows XP Wdf01009.
RP3: 11/10/2010 6:33:43 PM - Avg Update
RP4: 11/10/2010 6:34:05 PM - Avg Update
RP5: 11/11/2010 12:56:17 PM - Removed AVG 9.0
RP6: 11/11/2010 1:00:45 PM - Installed Windows XP KB914882.
RP7: 11/14/2010 8:12:05 PM - System Checkpoint

==== Installed Programs ======================

Acrobat.com
Actual Booster 3.1
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color EU Recommended Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Extra Settings CS4
Adobe Color NA Recommended Settings
Adobe Color Video Profiles CS CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS3
Adobe Device Central CS4
Adobe Drive CS4
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash CS3
Adobe Flash CS3 Professional
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Reader 9.4.0
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Shockwave Player 11.5
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Display Driver
BearShare
Bonjour
Broadcom Gigabit Integrated Controller
CCleaner
Connect
D-Link VGA Webcam
DVD Suite
FrostWire 4.20.6
GameSpy Arcade
Google Chrome
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB942288-v3)
Intel(R) Graphics Media Accelerator Driver
iTunes
Java Auto Updater
Java(TM) 6 Update 19
Java(TM) 6 Update 7
kuler
Magical Jelly Bean KeyFinder
Malwarebytes' Anti-Malware
MediaBar
Messenger Plus! Live
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Halo Trial
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Security Essentials
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Windows Journal Viewer
MobileMe Control Panel
Mozilla Firefox (3.6.8)
MSVC80_x86_v2
MSVC90_x86
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Nero 7 Essentials
neroxml
Nokia Connectivity Cable Driver
Nokia Ovi Suite
Nokia Ovi Suite Software Updater
Nokia PC Suite
OpenOffice.org 3.2
Opera 10.63
Ovi Desktop Sync Engine
OviMPlatform
Pando Media Booster
PC Connectivity Solution
PDF Settings CS4
Photoshop Camera Raw
PowerDVD
PowerProducer
QuickTime
RealPlayer
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows XP (KB923789)
Segoe UI
ShortKeys Lite
Skype Toolbars
Skypeâ„¢ 4.2
SoundMAX
Suite Shared Configuration CS4
Unity Web Player
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB914882)
WebFldrs XP
Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.4)
Windows Driver Package - Nokia Modem (10/05/2009 4.2)
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Format Runtime
Windows Media Player 11
WinSCP 4.0.4
WinZip 14.5
XP Repair Pro 4.0
Zune Desktop Theme

==== Event Viewer Messages From Past Week ========

11/9/2010 8:10:28 AM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -64730 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.4:123->207.46.232.182:123) is working properly.
11/9/2010 7:12:48 PM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68326 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/16/2010 8:03:35 AM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68315 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/15/2010 9:34:12 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer H-AM6SXIQQZAOQV that believes that it is the master browser for the domain on transport NetBT_Tcpip_{02E0B1B1-E3F. The master browser is stopping or an election is being forced.
11/15/2010 9:33:34 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
11/15/2010 9:06:53 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
11/15/2010 7:35:17 AM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
11/15/2010 7:23:28 AM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68317 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/15/2010 3:09:33 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1896.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 3:07:05 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1896.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 3:03:50 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1896.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 2:50:20 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1896.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 2:49:58 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1896.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 2:49:39 PM, error: Service Control Manager [7017] - Detected circular dependencies demand starting Remote Access Connection Manager.
11/15/2010 2:45:49 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1896.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 2:45:17 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Update Type: User: IPOD\Hannah Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8050a003 Error description: This package does not contain up-to-date definition files for this program. For more information, see Help and Support.
11/15/2010 2:44:59 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 2:37:29 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 2:37:25 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 2:18:14 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/15/2010 12:31:26 PM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68316 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/14/2010 8:31:05 AM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68319 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/14/2010 2:06:26 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/13/2010 9:02:23 AM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68321 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/13/2010 5:23:30 PM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68320 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/13/2010 5:21:01 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 6:57:10 PM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
11/12/2010 6:57:10 PM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
11/12/2010 6:57:10 PM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s).
11/12/2010 6:57:10 PM, error: Service Control Manager [7031] - The Remote Registry service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
11/12/2010 5:00:54 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/Zbot.gen!Y&threatid=2147632168 User: IPOD\Hannah Name: PWS:Win32/Zbot.gen!Y ID: 2147632168 Severity: Severe Category: Password Stealer Path: Action: Quarantine Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.93.1712.0, AS: 1.93.1712.0 Engine Version: 1.1.6301.0
11/12/2010 4:34:48 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
11/12/2010 2:27:06 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 2:26:50 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 2:26:46 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 2:11:36 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1712.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:02:00 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:01:37 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:01:31 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:01:12 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:01:09 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:01:05 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:01:02 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 12:00:49 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 11:58:34 AM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68323 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/12/2010 1:55:09 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 1:55:06 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 1:55:03 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 1:55:00 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 1:46:03 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 1:45:59 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/12/2010 1:43:54 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.93.1647.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/11/2010 5:50:37 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
11/11/2010 5:46:01 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/11/2010 1:16:30 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Update Type: User: IPOD\Hannah Current Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8050a003 Error description: This package does not contain up-to-date definition files for this program. For more information, see Help and Support.
11/11/2010 1:02:53 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/11/2010 1:02:40 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/11/2010 1:02:31 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x8024400a Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/11/2010 1:02:21 PM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68324 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.
11/10/2010 9:21:46 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
11/10/2010 7:27:53 AM, error: BITS [16391] - The BITS job list is not in a recognized format. It may have been created by a different version of BITS. The job list has been cleared.
11/10/2010 10:26:54 PM, error: W32Time [34] - The time service has detected that the system time needs to be changed by -68325 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working properly.

==== End Of File ===========================

 

ComboFix Log

ComboFix 10-11-15.05 - Hannah 11/16/2010 12:45:37.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1522 [GMT -8:00]
Running from: c:\documents and settings\Hannah\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\install.exe

.
((((((((((((((((((((((((( Files Created from 2010-10-16 to 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 05:12 . 2010-11-16 05:12 -------- d-----w- c:\documents and settings\Hannah\Application Data\Malwarebytes
2010-11-16 05:12 . 2010-04-29 23:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-16 05:12 . 2010-11-16 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-16 05:12 . 2010-11-16 05:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-16 05:12 . 2010-04-29 23:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-15 22:44 . 2010-10-18 16:41 6146896 ------w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3AF23A3C-107F-473C-9B08-767902E98E21}\mpengine.dll
2010-11-15 21:57 . 2010-11-15 21:57 -------- d-----w- c:\program files\GameSpy Arcade
2010-11-15 21:56 . 2010-11-15 21:56 -------- d-----w- c:\program files\Microsoft Games
2010-11-13 18:50 . 2010-11-13 18:50 -------- d-----w- c:\documents and settings\Hannah\Application Data\CyberLink
2010-11-13 01:00 . 2010-11-13 01:00 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-11-12 22:11 . 2010-10-18 16:41 6146896 ------w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-11 21:16 . 2010-10-19 18:41 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-11-11 21:00 . 2010-11-11 21:01 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-11-11 20:38 . 2010-11-11 20:38 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Identities
2010-11-09 01:57 . 2004-08-04 12:00 36927 -c--a-w- c:\windows\system32\dllcache\padrs411.dll
2010-11-09 01:56 . 2004-08-04 12:00 45568 -c--a-w- c:\windows\system32\dllcache\browscap.dll
2010-11-09 01:54 . 2004-08-04 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2010-11-09 01:54 . 2004-08-04 12:00 16384 ----a-w- c:\program files\Internet Explorer\Connection Wizard\isignup.exe
2010-11-09 01:53 . 2004-08-04 12:00 44544 -c--a-w- c:\windows\system32\dllcache\tscupgrd.exe
2010-11-09 01:53 . 2004-08-04 12:00 44544 ----a-w- c:\windows\system32\tscupgrd.exe
2010-11-09 01:40 . 2004-08-04 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-11-09 01:40 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-11-09 01:40 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-11-09 01:40 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-11-09 01:40 . 2004-08-04 12:00 13753 ----a-r- c:\windows\SETDA.tmp
2010-11-09 01:40 . 2004-08-04 12:00 1086058 ----a-r- c:\windows\SETCE.tmp
2010-11-09 01:40 . 2004-08-04 12:00 1042903 ----a-r- c:\windows\SETCD.tmp
2010-11-03 05:01 . 2010-11-03 05:01 -------- d-----w- c:\program files\Apple Software Update
2010-11-02 23:28 . 2010-11-09 21:18 -------- d-----w- c:\documents and settings\Hannah\Application Data\bearsharemediabartb
2010-11-02 23:28 . 2010-11-03 15:21 -------- d-----w- c:\documents and settings\Hannah\Local Settings\Application Data\BearShare
2010-11-02 23:27 . 2010-11-02 23:28 -------- d-----w- c:\program files\BearShare Applications
2010-11-02 23:27 . 2010-11-02 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\BearShare
2010-11-02 23:26 . 2010-11-02 23:28 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{E44BF2E3-2CC0-45E3-9CBD-0BD2C4F69F55}
2010-11-02 23:26 . 2010-11-02 23:26 -------- d-----w- c:\documents and settings\Hannah\Local Settings\Application Data\PackageAware
2010-11-02 15:23 . 2010-11-02 15:23 -------- d-----w- c:\program files\Magical Jelly Bean
2010-11-02 02:36 . 2010-11-02 02:36 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-01 21:58 . 2010-06-16 01:27 282928 ----a-w- c:\windows\system32\HMIPCore.dll
2010-10-27 16:53 . 2010-10-27 16:53 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-10-22 02:49 . 2010-10-22 02:49 -------- d-----w- c:\documents and settings\Hannah\Application Data\InstantAction
2010-10-21 01:12 . 2010-10-21 01:20 -------- d-----w- c:\windows\system32\Adobe
2010-10-20 15:14 . 2010-10-20 15:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-08 18:17 . 2010-09-08 18:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 18:17 . 2010-09-08 18:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-08-26 12:52 . 2010-01-26 02:01 5120 ----a-w- c:\windows\system32\xpsp4res.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
2009-12-20 09:51 87480 ----a-w- c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2010-10-19 12:53 585136 ----a-w- c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0974BA1E-64EC-11DE-B2A5-E43756D89593} "= "c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480]

[HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"Google Update "= "c:\documents and settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-20 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LanguageShortcut "= "c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-01-26 198160]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2008-05-30 150040]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2008-05-30 170520]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2008-05-30 141848]
"SoundMAXPnP "= "c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 06:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 11:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 14:58 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-09-22 07:28 47904 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-05-30 03:00 170520 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 09:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 23:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 21:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-09-02 17:26 672632 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2010-04-05 22:08 2938552 ----a-w- c:\program files\Pando Networks\Media Booster\PMB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-11-11 17:57 1451520 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 18:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-15 04:01 71216 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2006-05-01 17:07 843776 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 18:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc "=3 (0x3)
"UnsignedThemes "=2 (0x2)
"RichVideo "=2 (0x2)
"JavaQuickStarterService "=2 (0x2)
"iPod Service "=3 (0x3)
"gupdate "=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe "=
"c:\\Program Files\\FrostWire\\FrostWire.exe "=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Opera\\opera.exe "=
"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe "=
"c:\\Program Files\\Microsoft Games\\Halo Trial\\halo.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP "= 5353:TCP:Adobe CSI CS4
"57586:TCP "= 57586:TCPando Media Booster
"57586:UDP "= 57586:UDPando Media Booster

S0 cerc6;cerc6; [x]
S1 mqkncfkh;mqkncfkh;\??\c:\windows\system32\drivers\mqkncfkh.sys --> c:\windows\system32\drivers\mqkncfkh.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/18/2010 10:43 AM 136176]
.
Contents of the 'Scheduled Tasks' folder

2010-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-18 03:37]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-18 03:37]

2010-11-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003Core.job
- c:\documents and settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-11 15:15]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003UA.job
- c:\documents and settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-11 15:15]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-19 03:18]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-19 03:18]

2010-11-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 05:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
IE: Google Sidewiki... -
Trusted Zone: microsoft.com\update
FF - ProfilePath - c:\documents and settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com/
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - plugin: c:\documents and settings\Hannah\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: e:\program\plugins\npqtplugin.dll
FF - plugin: e:\program\plugins\npqtplugin2.dll
FF - plugin: e:\program\plugins\npqtplugin3.dll
FF - plugin: e:\program\plugins\npqtplugin4.dll
FF - plugin: e:\program\plugins\npqtplugin5.dll
FF - plugin: e:\program\plugins\npqtplugin6.dll
FF - plugin: e:\program\plugins\npqtplugin7.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-AdobeBridge - (no file)
Notify-winygg32 - winygg32.dll
SafeBoot-WudfPf
SafeBoot-WudfRd



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3120)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\savedump.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Completion time: 2010-11-16 12:52:22 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-16 20:52

Pre-Run: 63,809,388,544 bytes free
Post-Run: 64,021,831,680 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F8176A1D2360431EE6F985CCE11A08B9

 

So I don't post the "log.txt" that popped up automatically once the scan was complete? I found Combofix.txt in the C:\ though, so I assume that's what you wanted, if not, I'll post the log.txt also if you request it.


ComboFix 10-11-15.05 - Hannah 11/16/2010 13:06:27.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1531 [GMT -8:00]
Running from: c:\documents and settings\Hannah\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Hannah\Desktop\CFScript.txt
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FILE ::
"c:\windows\SETCD.tmp "
"c:\windows\SETCE.tmp "
"c:\windows\SETDA.tmp "
"c:\windows\system32\drivers\mqkncfkh.sys "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SETCD.tmp
c:\windows\SETCE.tmp
c:\windows\SETDA.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_cerc6
-------\Service_mqkncfkh


((((((((((((((((((((((((( Files Created from 2010-10-16 to 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 20:52 . 2010-10-18 16:41 6146896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4A8906A5-CC36-48EE-AE3A-BA7F14E91084}\mpengine.dll
2010-11-16 05:12 . 2010-11-16 05:12 -------- d-----w- c:\documents and settings\Hannah\Application Data\Malwarebytes
2010-11-16 05:12 . 2010-04-29 23:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-16 05:12 . 2010-11-16 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-16 05:12 . 2010-11-16 05:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-16 05:12 . 2010-04-29 23:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-15 21:57 . 2010-11-15 21:57 -------- d-----w- c:\program files\GameSpy Arcade
2010-11-15 21:56 . 2010-11-15 21:56 -------- d-----w- c:\program files\Microsoft Games
2010-11-13 18:50 . 2010-11-13 18:50 -------- d-----w- c:\documents and settings\Hannah\Application Data\CyberLink
2010-11-13 01:00 . 2010-11-13 01:00 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-11-12 22:11 . 2010-10-18 16:41 6146896 ------w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-11 21:16 . 2010-10-19 18:41 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-11-11 21:00 . 2010-11-11 21:01 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-11-11 20:38 . 2010-11-11 20:38 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Identities
2010-11-09 01:57 . 2004-08-04 12:00 36927 -c--a-w- c:\windows\system32\dllcache\padrs411.dll
2010-11-09 01:56 . 2004-08-04 12:00 45568 -c--a-w- c:\windows\system32\dllcache\browscap.dll
2010-11-09 01:54 . 2004-08-04 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2010-11-09 01:54 . 2004-08-04 12:00 16384 ----a-w- c:\program files\Internet Explorer\Connection Wizard\isignup.exe
2010-11-09 01:53 . 2004-08-04 12:00 44544 -c--a-w- c:\windows\system32\dllcache\tscupgrd.exe
2010-11-09 01:53 . 2004-08-04 12:00 44544 ----a-w- c:\windows\system32\tscupgrd.exe
2010-11-09 01:40 . 2004-08-04 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-11-09 01:40 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-11-09 01:40 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-11-09 01:40 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-11-03 05:01 . 2010-11-03 05:01 -------- d-----w- c:\program files\Apple Software Update
2010-11-02 23:28 . 2010-11-09 21:18 -------- d-----w- c:\documents and settings\Hannah\Application Data\bearsharemediabartb
2010-11-02 23:28 . 2010-11-03 15:21 -------- d-----w- c:\documents and settings\Hannah\Local Settings\Application Data\BearShare
2010-11-02 23:27 . 2010-11-02 23:28 -------- d-----w- c:\program files\BearShare Applications
2010-11-02 23:27 . 2010-11-02 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\BearShare
2010-11-02 23:26 . 2010-11-02 23:28 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{E44BF2E3-2CC0-45E3-9CBD-0BD2C4F69F55}
2010-11-02 23:26 . 2010-11-02 23:26 -------- d-----w- c:\documents and settings\Hannah\Local Settings\Application Data\PackageAware
2010-11-02 15:23 . 2010-11-02 15:23 -------- d-----w- c:\program files\Magical Jelly Bean
2010-11-02 02:36 . 2010-11-02 02:36 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-01 21:58 . 2010-06-16 01:27 282928 ----a-w- c:\windows\system32\HMIPCore.dll
2010-10-27 16:53 . 2010-10-27 16:53 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-10-22 02:49 . 2010-10-22 02:49 -------- d-----w- c:\documents and settings\Hannah\Application Data\InstantAction
2010-10-21 01:12 . 2010-10-21 01:20 -------- d-----w- c:\windows\system32\Adobe
2010-10-20 15:14 . 2010-10-20 15:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-08 18:17 . 2010-09-08 18:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 18:17 . 2010-09-08 18:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-08-26 12:52 . 2010-01-26 02:01 5120 ----a-w- c:\windows\system32\xpsp4res.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-11-16_20.50.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-16 00:47 . 2009-08-07 03:24 35552 c:\windows\system32\wups.dll
+ 2009-09-16 00:47 . 2009-08-07 03:24 53472 c:\windows\system32\wuauclt.exe
+ 2009-09-16 00:47 . 2009-08-07 03:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2009-09-16 00:47 . 2009-08-07 03:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2004-08-04 12:00 . 2009-08-07 03:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2004-08-04 12:00 . 2009-08-07 03:24 96480 c:\windows\system32\cdm.dll
+ 2009-09-16 00:47 . 2009-08-07 03:24 327896 c:\windows\system32\wucltui.dll
+ 2009-09-16 00:47 . 2009-08-07 03:23 575704 c:\windows\system32\wuapi.dll
+ 2009-09-16 00:47 . 2009-08-07 03:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2009-09-16 00:47 . 2009-08-07 03:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2009-09-16 00:47 . 2009-08-07 03:23 1929952 c:\windows\system32\wuaueng.dll
+ 2009-09-16 00:47 . 2009-08-07 03:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
2009-12-20 09:51 87480 ----a-w- c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2010-10-19 12:53 585136 ----a-w- c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0974BA1E-64EC-11DE-B2A5-E43756D89593} "= "c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480]

[HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"Google Update "= "c:\documents and settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-20 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LanguageShortcut "= "c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-01-26 198160]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2008-05-30 150040]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2008-05-30 170520]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2008-05-30 141848]
"SoundMAXPnP "= "c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 06:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 11:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 14:58 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-09-22 07:28 47904 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-05-30 03:00 170520 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 09:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 23:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 21:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-09-02 17:26 672632 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2010-04-05 22:08 2938552 ----a-w- c:\program files\Pando Networks\Media Booster\PMB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-11-11 17:57 1451520 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 18:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-15 04:01 71216 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2006-05-01 17:07 843776 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 18:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc "=3 (0x3)
"UnsignedThemes "=2 (0x2)
"RichVideo "=2 (0x2)
"JavaQuickStarterService "=2 (0x2)
"iPod Service "=3 (0x3)
"gupdate "=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe "=
"c:\\Program Files\\FrostWire\\FrostWire.exe "=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Opera\\opera.exe "=
"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe "=
"c:\\Program Files\\Microsoft Games\\Halo Trial\\halo.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP "= 5353:TCP:Adobe CSI CS4
"57586:TCP "= 57586:TCPando Media Booster
"57586:UDP "= 57586:UDPando Media Booster

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/18/2010 10:43 AM 136176]
.
Contents of the 'Scheduled Tasks' folder

2010-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-18 03:37]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-18 03:37]

2010-11-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003Core.job
- c:\documents and settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-11 15:15]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003UA.job
- c:\documents and settings\Hannah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-11 15:15]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-19 03:18]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-19 03:18]

2010-11-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 05:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
IE: Google Sidewiki... -
Trusted Zone: microsoft.com\update
FF - ProfilePath - c:\documents and settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com/
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 13:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1804)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\savedump.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-11-16 13:13:33 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-16 21:13
ComboFix2.txt 2010-11-16 20:52

Pre-Run: 64,003,268,608 bytes free
Post-Run: 63,994,949,632 bytes free

- - End Of File - - 9D82465FAE8A99C455A9B93B1298EDC9

 

OTL.txt

There's been no more errors since I've done as you said, though knowing my luck there may be sooner or later, if so I'll let you know obviously.

OTL logfile created on: 11/16/2010 1:24:53 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Hannah\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97.66 Gb Total Space | 59.62 Gb Free Space | 61.04% Space Free | Partition Type: NTFS
Drive E: | 368.10 Gb Total Space | 367.09 Gb Free Space | 99.73% Space Free | Partition Type: NTFS

Computer Name: IPOD | User Name: Hannah | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/16 13:22:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hannah\Desktop\OTL.exe
PRC - [2010/10/19 04:53:48 | 000,983,480 | ---- | M] (MusicLab, LLC) -- C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe
PRC - [2010/09/15 04:34:02 | 001,094,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/08/13 11:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2010/01/25 17:53:58 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2007/06/27 17:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/06/27 17:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/05/01 09:07:44 | 000,843,776 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2004/08/04 04:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2010/11/16 13:22:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hannah\Desktop\OTL.exe
MOD - [2010/08/23 08:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2008/04/02 14:49:24 | 000,106,496 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\hccutils.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/08/13 11:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/06/14 14:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/03/22 16:34:53 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2010/02/26 13:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010/02/26 13:32:44 | 000,022,528 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010/02/26 13:32:44 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/08/26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/08/14 06:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\adfs.sys -- (adfs)
DRV - [2008/07/31 22:38:20 | 003,266,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/04/14 04:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/04/02 15:15:26 | 006,008,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2007/06/06 11:51:04 | 000,161,792 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2006/07/05 15:08:28 | 000,241,152 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2006/03/17 17:18:58 | 000,392,960 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)
DRV - [2004/08/03 23:07:56 | 000,059,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2003/10/15 16:52:50 | 000,174,530 | R--- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ov519vid.sys -- (ovt519)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: avg@igeared:4.906.030.003
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..browser.startup.homepage: "http://search.bearshare.com/ "
FF - prefs.js..browser.search.selectedEngine: "BearShare Web Search "
FF - prefs.js..browser.search.defaultenginename: "BearShare Web Search "
FF - prefs.js..browser.search.order.1: "BearShare Web Search "
FF - prefs.js..keyword.URL: "http://search.bearshare.com/web?src=ffb&systemid=2&q= "

FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/09/25 07:43:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/30 19:46:13 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/06 09:14:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/09/25 07:43:27 | 000,000,000 | ---D | M]

[2010/11/02 15:28:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Mozilla\Extensions
[2010/11/02 15:28:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\extensions
[2010/10/21 01:41:45 | 000,000,000 | ---D | M] (mediaget Community Toolbar) -- C:\Documents and Settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\extensions\{176959a6-e658-4c21-8b6c-95afae524d97}
[2010/08/17 08:37:20 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/02 15:28:26 | 000,000,000 | ---D | M] (MediaBar) -- C:\Documents and Settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
[2010/10/21 01:41:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\extensions\engine@conduit.com
[2010/09/14 04:41:12 | 000,002,506 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\Mozilla\Firefox\Profiles\cjse2fui.default\searchplugins\BearShareWebSearch.xml
[2010/11/02 15:28:19 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/03 13:10:52 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/14 04:41:12 | 000,002,506 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml

O1 HOSTS File: ([2010/11/16 13:11:22 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll ()
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264470923921 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Hannah\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Hannah\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/07/08 11:46:21 | 000,000,088 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619756233228288)

========== Files/Folders - Created Within 30 Days ==========

[2010/11/16 13:22:11 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hannah\Desktop\OTL.exe
[2010/11/16 13:13:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/11/16 13:05:46 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/11/16 12:45:00 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/11/16 12:43:10 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/11/16 12:43:10 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/11/16 12:43:10 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/11/16 12:43:10 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/11/16 12:43:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/11/16 12:42:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/11/16 12:26:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\Desktop\Logs
[2010/11/15 21:12:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\Application Data\Malwarebytes
[2010/11/15 21:12:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/15 21:12:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/15 21:12:49 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/15 21:12:49 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/15 13:58:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\My Documents\My Games
[2010/11/15 13:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\GameSpy Arcade
[2010/11/15 13:56:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Games
[2010/11/13 10:50:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\Application Data\CyberLink
[2010/11/13 10:50:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\My Documents\CyberLink
[2010/11/12 17:00:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2010/11/12 16:59:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2010/11/11 15:46:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\My Documents\My Saved Games
[2010/11/11 13:00:54 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
[2010/11/11 12:38:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Identities
[2010/11/11 12:38:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Identities
[2010/11/08 18:00:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2010/11/08 17:58:07 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2010/11/08 17:58:06 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2010/11/08 17:58:06 | 000,026,624 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2010/11/08 17:57:05 | 000,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2010/11/08 15:36:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Real
[2010/11/03 18:29:50 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Hannah\Recent
[2010/11/02 21:01:16 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010/11/02 15:28:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\Application Data\bearsharemediabartb
[2010/11/02 15:28:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\My Documents\BearShare
[2010/11/02 15:28:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\Local Settings\Application Data\BearShare
[2010/11/02 15:27:40 | 000,000,000 | ---D | C] -- C:\Program Files\BearShare Applications
[2010/11/02 15:27:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\BearShare
[2010/11/02 15:26:08 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{E44BF2E3-2CC0-45E3-9CBD-0BD2C4F69F55}
[2010/11/02 15:26:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\Local Settings\Application Data\PackageAware
[2010/11/02 07:26:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\setup.pss
[2010/11/02 07:23:28 | 000,000,000 | ---D | C] -- C:\Program Files\Magical Jelly Bean
[2010/11/02 03:34:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/11/02 03:07:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/11/01 18:35:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/11/01 18:35:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/11/01 14:51:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\My Documents\MediaGet
[2010/11/01 13:58:39 | 000,282,928 | ---- | C] (My Privacy Tools, Inc.) -- C:\WINDOWS\System32\HMIPCore.dll
[2010/10/21 18:52:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010/10/21 18:49:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hannah\Application Data\InstantAction
[2010/10/20 17:12:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2010/10/20 07:14:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/16 13:22:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hannah\Desktop\OTL.exe
[2010/11/16 13:20:02 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/16 13:16:11 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/11/16 13:11:22 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/11/16 13:11:17 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/16 13:11:16 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/16 13:11:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/16 12:45:04 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/11/16 12:38:19 | 003,910,070 | R--- | M] () -- C:\Documents and Settings\Hannah\Desktop\ComboFix.exe
[2010/11/16 12:34:00 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-500UA.job
[2010/11/16 12:10:48 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\winscp.rnd
[2010/11/16 10:48:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003UA.job
[2010/11/15 19:34:00 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-500Core.job
[2010/11/15 19:24:35 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/11/15 19:03:52 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/11/15 14:01:00 | 2136,600,576 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2010/11/15 12:48:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003Core.job
[2010/11/13 10:50:24 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/11/13 10:50:15 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/11/12 17:06:23 | 000,000,312 | ---- | M] () -- C:\Documents and Settings\Hannah\My Documents\acc names.rtf
[2010/11/11 12:51:37 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/11/11 12:46:09 | 000,002,293 | ---- | M] () -- C:\Documents and Settings\Hannah\Desktop\Google Chrome.lnk
[2010/11/11 12:46:09 | 000,002,271 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/11/10 18:31:03 | 000,432,686 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/10 18:31:03 | 000,067,516 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/08 18:02:30 | 002,071,240 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/08 17:59:51 | 000,000,587 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2010/11/08 17:56:11 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/11/08 17:56:10 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/11/08 17:56:10 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/11/08 17:55:59 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2010/11/08 17:53:30 | 000,022,720 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/11/08 17:52:08 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/11/08 17:03:02 | 000,005,434 | ---- | M] () -- C:\WINDOWS\setupapi.old
[2010/11/08 16:54:35 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\Hannah\Local Settings\Application Data\PUTTY.RND
[2010/11/08 01:20:24 | 000,089,088 | ---- | M] () -- C:\WINDOWS\MBR.exe
[2010/11/03 19:09:50 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet (2).lnk
[2010/11/02 21:01:19 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/11/02 15:27:50 | 000,000,863 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\BearShare.lnk
[2010/11/01 21:07:30 | 000,000,624 | ---- | M] () -- C:\Documents and Settings\Hannah\My Documents\songs.rtf
[2010/11/01 21:06:58 | 001,722,880 | ---- | M] () -- C:\Documents and Settings\Hannah\My Documents\ZuneDesktopTheme.msi
[2010/10/23 12:57:39 | 000,000,034 | ---- | M] () -- C:\WINDOWS\System32\BD2140.DAT
[2010/10/20 16:05:38 | 000,000,061 | ---- | M] () -- C:\Documents and Settings\Hannah\My Documents\wut.flp
[2010/10/18 19:42:32 | 000,198,637 | ---- | M] () -- C:\Documents and Settings\Hannah\My Documents\Info on Disability Pension Form.pdf
[2010/10/18 19:42:17 | 000,179,859 | ---- | M] () -- C:\Documents and Settings\Hannah\My Documents\Disability Pension Form.pdf
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/16 12:45:04 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/11/16 12:45:01 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/11/16 12:43:10 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/11/16 12:43:10 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/11/16 12:43:10 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/11/16 12:43:10 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/11/16 12:43:10 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/11/15 17:38:54 | 003,910,070 | R--- | C] () -- C:\Documents and Settings\Hannah\Desktop\ComboFix.exe
[2010/11/11 13:06:52 | 000,000,408 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/11/11 12:46:09 | 000,002,293 | ---- | C] () -- C:\Documents and Settings\Hannah\Desktop\Google Chrome.lnk
[2010/11/11 12:46:09 | 000,002,271 | ---- | C] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/11/11 12:43:21 | 000,000,982 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003UA.job
[2010/11/11 12:43:21 | 000,000,930 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1229272821-1417001333-1003Core.job
[2010/11/08 17:58:01 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2010/11/08 17:57:42 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2010/11/08 17:57:35 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2010/11/08 17:57:34 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2010/11/08 17:57:32 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2010/11/08 17:57:25 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2010/11/08 17:57:21 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2010/11/08 17:57:17 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2010/11/08 17:57:07 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2010/11/08 17:40:30 | 000,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2010/11/08 17:40:30 | 000,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2010/11/08 17:40:30 | 000,141,702 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2010/11/08 17:40:30 | 000,110,116 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2010/11/08 17:40:30 | 000,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2010/11/08 17:40:30 | 000,031,965 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2010/11/08 17:40:30 | 000,031,281 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2010/11/08 17:40:30 | 000,024,209 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2010/11/08 17:40:30 | 000,013,753 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2010/11/08 17:40:30 | 000,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2010/11/08 17:40:30 | 000,011,651 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2010/11/08 17:40:30 | 000,009,581 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2010/11/08 17:40:30 | 000,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2010/11/08 17:40:30 | 000,007,710 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2010/11/08 17:40:30 | 000,007,245 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2010/11/08 17:40:29 | 002,012,670 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2010/11/08 17:40:29 | 001,042,903 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP2.CAT
[2010/11/08 17:40:29 | 000,502,724 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2010/11/08 16:59:32 | 000,001,393 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/11/08 16:53:40 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Hannah\Local Settings\Application Data\PUTTY.RND
[2010/11/08 16:20:15 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Hannah\Application Data\winscp.rnd
[2010/11/08 09:31:06 | 2136,600,576 | ---- | C] () -- C:\WINDOWS\MEMORY.DMP
[2010/11/06 16:24:38 | 000,000,312 | ---- | C] () -- C:\Documents and Settings\Hannah\My Documents\acc names.rtf
[2010/11/04 17:42:07 | 000,005,434 | ---- | C] () -- C:\WINDOWS\setupapi.old
[2010/11/03 19:09:50 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet (2).lnk
[2010/11/02 21:03:06 | 000,002,155 | ---- | C] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/11/02 15:27:50 | 000,000,863 | ---- | C] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\BearShare.lnk
[2010/11/01 21:06:47 | 001,722,880 | ---- | C] () -- C:\Documents and Settings\Hannah\My Documents\ZuneDesktopTheme.msi
[2010/11/01 18:36:04 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/31 21:05:01 | 000,000,624 | ---- | C] () -- C:\Documents and Settings\Hannah\My Documents\songs.rtf
[2010/10/23 12:57:39 | 000,000,034 | ---- | C] () -- C:\WINDOWS\System32\BD2140.DAT
[2010/10/20 16:05:38 | 000,000,061 | ---- | C] () -- C:\Documents and Settings\Hannah\My Documents\wut.flp
[2010/10/18 19:42:32 | 000,198,637 | ---- | C] () -- C:\Documents and Settings\Hannah\My Documents\Info on Disability Pension Form.pdf
[2010/10/18 19:42:17 | 000,179,859 | ---- | C] () -- C:\Documents and Settings\Hannah\My Documents\Disability Pension Form.pdf
[2010/07/08 11:46:21 | 000,000,327 | ---- | C] () -- C:\WINDOWS\System32\olsyr.dll
[2010/06/08 18:41:02 | 000,000,426 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010/04/13 16:50:28 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2010/02/26 15:59:44 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4943.dll
[2009/09/17 12:43:52 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/09/15 09:36:08 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/04 04:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004/08/04 04:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

========== LOP Check ==========

[2010/11/02 15:27:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BearShare
[2010/03/28 22:11:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Insight Software
[2010/03/28 22:11:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Insight Software Solutions
[2010/03/21 11:45:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
[2010/10/03 11:27:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2010/09/25 07:36:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NokiaInstallerCache
[2010/04/16 21:08:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
[2010/04/05 14:11:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/06/18 18:07:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/04/01 19:45:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/21 11:47:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/11/02 15:28:25 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{E44BF2E3-2CC0-45E3-9CBD-0BD2C4F69F55}
[2010/11/09 13:18:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\bearsharemediabartb
[2010/11/14 21:23:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Faef
[2010/11/01 14:46:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\FrostWire
[2010/11/01 18:19:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\GetRightToGo
[2010/11/15 14:49:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Haboz
[2010/10/21 18:49:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\InstantAction
[2010/09/26 11:21:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Nokia
[2010/03/21 11:30:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\OpenOffice.org
[2010/04/08 09:41:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Opera
[2010/08/17 12:08:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\PC Suite
[2010/03/30 22:26:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\SecondLife
[2010/09/19 20:34:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Sony Online Entertainment
[2010/06/10 19:20:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hannah\Application Data\Unity
[2010/11/16 13:16:11 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/11/08 16:18:43 | 000,032,206 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/07/08 11:46:21 | 000,000,088 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/01/25 17:59:57 | 080,328,144 | ---- | M] (AVG Technologies) -- C:\avg_free_stf_en_90_730a1834.exe
[2010/11/08 17:52:08 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/11/16 12:45:04 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/11/16 13:13:33 | 000,019,356 | ---- | M] () -- C:\ComboFix.txt
[2009/09/15 16:49:18 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/09/15 16:49:18 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/09/15 16:49:18 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 04:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 04:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/11/16 13:11:01 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2010/01/25 17:53:04 | 000,793,624 | ---- | M] (RealNetworks, Inc.) -- C:\RealPlayerSPGold.exe
[2010/11/16 12:05:18 | 000,036,164 | ---- | M] () -- C:\TDSSKiller.2.4.7.0_16.11.2010_12.04.42_log.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/11/08 17:55:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 04:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 02:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2010/11/08 17:01:47 | 000,001,738 | -H-- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/11/08 09:38:07 | 000,786,432 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010/11/08 17:29:55 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav
[2010/11/08 09:38:07 | 031,719,424 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010/11/08 09:38:07 | 006,029,312 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/11/08 17:56:13 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/20 08:36:39 | 000,000,060 | -HS- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/03/20 08:36:39 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Hannah\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/11/16 12:38:19 | 003,910,070 | R--- | M] () -- C:\Documents and Settings\Hannah\Desktop\ComboFix.exe
[2010/11/16 13:22:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hannah\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2010/11/08 16:17:08 | 002,869,264 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Hannah\My Documents\dotNetFx35setup.exe
[2010/07/08 13:37:41 | 000,469,248 | ---- | M] (Perfect World Entertainment) -- C:\Documents and Settings\Hannah\My Documents\PWIRisingTide_v350.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/03/20 08:36:39 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Hannah\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/11/16 13:23:25 | 000,032,768 | -HS- | M] () -- C:\Documents and Settings\Hannah\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/04 04:00:00 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 04:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2008/04/14 04:00:00 | 000,004,821 | R--- | M] () -- C:\Program Files\Messenger\logowin.gif
[2007/04/02 22:37:24 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 06:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 22:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 04:42:30 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2008/04/14 04:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2008/04/14 04:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2008/04/14 04:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2007/04/02 22:37:28 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2007/04/02 22:34:02 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >

 

Extras.txt

OTL Extras logfile created on: 11/16/2010 1:24:53 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Hannah\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97.66 Gb Total Space | 59.62 Gb Free Space | 61.04% Space Free | Partition Type: NTFS
Drive E: | 368.10 Gb Total Space | 367.09 Gb Free Space | 99.73% Space Free | Partition Type: NTFS

Computer Name: IPOD | User Name: Hannah | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML.Hannah] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002
"57586:TCP" = 57586:TCP:*:Enabledando Media Booster
"57586:UDP" = 57586:UDP:*:Enabledando Media Booster
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"57586:TCP" = 57586:TCP:*:Enabledando Media Booster
"57586:UDP" = 57586:UDP:*:Enabledando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabledando Media Booster -- ()
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe" = C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare -- (MusicLab, LLC)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 -- (Adobe Systems Incorporated)
"C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire -- (FrostWire Group)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabledando Media Booster -- ()
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe" = C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare -- (MusicLab, LLC)
"C:\Program Files\Microsoft Games\Halo Trial\halo.exe" = C:\Program Files\Microsoft Games\Halo Trial\halo.exe:*isabled:Halo -- (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}" = Safari
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{43DCF766-6838-4F9A-8C91-D92DA586DFA8}" = Microsoft Windows Journal Viewer
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45DF6D99-666D-41FA-8D62-0E183B6240F3}" = PC Connectivity Solution
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5F624839-947D-46EA-BD63-FD847C1AC6F1}" = BearShare
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{749A1EDD-16C2-4C63-B013-D38F0F953973}" = OviMPlatform
"{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{8112C6B3-91E1-4560-8AB9-876DADFA37C5}" = Ovi Desktop Sync Engine
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87CC8013-56D1-43E1-A0A5-AD406B4EBA95}" = Opera 10.63
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}" = Nokia PC Suite
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{AEBBFC67-7A03-4DF3-9E71-BA5C9EB4FBEF}" = MobileMe Control Panel
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B8B4446F-87E1-4423-A47A-16832C24A199}" = Nokia Ovi Suite
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BD49141C-188C-4B75-9F46-C2C42F2D1033}" = Nero 7 Essentials
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skypeâ„¢ 4.2
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE5B5B24-EEFC-4C8B-BF8B-256D705BAD89}" = Nokia Ovi Suite Software Updater
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F1FDAA01-988C-423F-AC12-0D8F333943FD}" = Nokia Connectivity Cable Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FC57FC53-104C-415C-98D7-B05E659461A9}" = Broadcom Gigabit Integrated Controller
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FE74C184-4939-4FFA-B8C9-8E0CD6A6AA57}" = XP Repair Pro 4.0
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFC1ADE3-944B-4231-894E-3903C37271D2}" = Adobe Setup
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows Driver Package - Nokia Modem (10/05/2009 4.2)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.4)
"Actual Booster" = Actual Booster 3.1
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Adobe_c3c7fe8b09d497ab2b3fd91c9353390" = Adobe Flash CS3 Professional
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"ATI Display Driver" = ATI Display Driver
"BearShare" = BearShare
"BearShare MediaBar" = MediaBar
"CCleaner" = CCleaner
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"D-Link VGA Webcam" = D-Link VGA Webcam
"FrostWire" = FrostWire 4.20.6
"GameSpy Arcade" = GameSpy Arcade
"Halo Trial" = Microsoft Halo Trial
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"KeyFinder_is1" = Magical Jelly Bean KeyFinder
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Nokia Ovi Suite" = Nokia Ovi Suite
"Nokia PC Suite" = Nokia PC Suite
"RealPlayer 12.0" = RealPlayer
"ShortKeys Lite" = ShortKeys Lite
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"winscp3_is1" = WinSCP 4.0.4
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/16/2010 1:24:33 AM | Computer Name = IPOD | Source = Bonjour Service | ID = 100
Description = 412: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 11/16/2010 1:24:33 AM | Computer Name = IPOD | Source = Bonjour Service | ID = 100
Description = 408: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 11/16/2010 2:20:10 AM | Computer Name = IPOD | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.2180, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00021260.

Error - 11/16/2010 12:17:12 PM | Computer Name = IPOD | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.2180, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00021260.

Error - 11/16/2010 2:06:25 PM | Computer Name = IPOD | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 11/16/2010 2:06:26 PM | Computer Name = IPOD | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 11/16/2010 4:04:38 PM | Computer Name = IPOD | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 11/16/2010 4:04:38 PM | Computer Name = IPOD | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 11/16/2010 4:26:35 PM | Computer Name = IPOD | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024400a, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

Error - 11/16/2010 4:26:37 PM | Computer Name = IPOD | Source = MSSecurityEssentials | ID = 5000
Description =

[ System Events ]
Error - 11/16/2010 1:25:24 AM | Computer Name = IPOD | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 11/16/2010 1:33:34 AM | Computer Name = IPOD | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort0, did not respond within the timeout
period.

Error - 11/16/2010 1:34:12 AM | Computer Name = IPOD | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
H-AM6SXIQQZAOQV that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{02E0B1B1-E3F. The master browser is stopping or an election is being
forced.

Error - 11/16/2010 1:34:31 AM | Computer Name = IPOD | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort0, did not respond within the timeout
period.

Error - 11/16/2010 1:37:00 AM | Computer Name = IPOD | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort0, did not respond within the timeout
period.

Error - 11/16/2010 12:03:35 PM | Computer Name = IPOD | Source = W32Time | ID = 39452706
Description = The time service has detected that the system time needs to be changed
by -68315 seconds. The time service will not change the system time by more than
-54000 seconds. Verify that your time and time zone are correct, and that the time
source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working
properly.

Error - 11/16/2010 4:07:35 PM | Computer Name = IPOD | Source = W32Time | ID = 39452706
Description = The time service has detected that the system time needs to be changed
by -68315 seconds. The time service will not change the system time by more than
-54000 seconds. Verify that your time and time zone are correct, and that the time
source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working
properly.

Error - 11/16/2010 4:26:34 PM | Computer Name = IPOD | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.93.1896.0 Update Source: %%859 Update Stage:
%%852 Source Path: Default URL Signature Type: %%800 Update Type: %%803 User: NT AUTHORITY\SYSTEM

Current
Engine Version: Previous Engine Version: 1.1.6301.0 Error code: 0x8024400a Error
description: An unexpected problem occurred while checking for updates. For information
on installing or troubleshooting updates, see Help and Support.

Error - 11/16/2010 4:50:37 PM | Computer Name = IPOD | Source = W32Time | ID = 39452706
Description = The time service has detected that the system time needs to be changed
by -68314 seconds. The time service will not change the system time by more than
-54000 seconds. Verify that your time and time zone are correct, and that the time
source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working
properly.

Error - 11/16/2010 5:11:32 PM | Computer Name = IPOD | Source = W32Time | ID = 39452706
Description = The time service has detected that the system time needs to be changed
by -68314 seconds. The time service will not change the system time by more than
-54000 seconds. Verify that your time and time zone are correct, and that the time
source time.windows.com (ntp.m|0x1|10.1.1.9:123->207.46.232.182:123) is working
properly.


< End of report >

 

OTL Log and Checkup.exe

I haven't done Temp File Cleaner or the ESET Online Scanner yet, as warned, it may restart the computer so I figure I'll post these first just in case it does and I can't find them.

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 33222520 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 42054 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Hannah
->Temp folder emptied: 1796025 bytes
->Temporary Internet Files folder emptied: 107928 bytes
->Java cache emptied: 38684 bytes
->FireFox cache emptied: 38498361 bytes
->Google Chrome cache emptied: 206524814 bytes
->Apple Safari cache emptied: 31006720 bytes
->Opera cache emptied: 277222 bytes
->Flash cache emptied: 62368 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 409667 bytes
->Java cache emptied: 4349 bytes
->Flash cache emptied: 6703 bytes

User: NetworkService
->Temp folder emptied: 2604 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 8478 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1674 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 298.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: Hannah
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 11162010_135852

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 22
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player 10.1.85.3
Adobe Reader 9.4.0
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````