Solved blue screen of death

bigger trouble

Was on the computer for quite awhile last eve and all was going well. Then tried to sign in to facebook and BOOM....blue screen. Turned it off and went to bed. Just tried to turn it back on, it was trying to start up and got most of the way there, then AVAST said it blocked a rootkit thing and......blue screen. So I'm not even going to be able to get on long enough to download that. (I'm back on son's computer).

Gosh this is a nasty thing.

 

maybe

Should I put that OTL disk back in that I made the other day and get online that way?

 

is this right?

I rebooted using the OTL disk. Then download what you told me to and I guess I ran the bootkit thing

.\debug.cpp(238) : Debug log started at 12.12.2010 - 15:24:25
.\boot_cleaner.cpp(527) : Bootkit Remover
.\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
.\boot_cleaner.cpp(529) : www.esagelab.com
.\boot_cleaner.cpp(533) : Program version: 1.2.0.0
.\boot_cleaner.cpp(540) : OS Version: Microsoft Windows XP Professional (build 2600)
.\debug.cpp(248) : **********************************************
.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
.\debug.cpp(250) : **********************************************
.\debug.cpp(256) : 0x80400000 0x00214780 "\i386\system32\ntoskrnl.exe "
.\debug.cpp(256) : 0x80615000 0x00020380 "\i386\system32\halaacpi.dll "
.\debug.cpp(256) : 0xf7a0d000 0x00002000 "\i386\system32\KDCOM.DLL "
.\debug.cpp(256) : 0xf791d000 0x00003000 "\i386\system32\BOOTVID.dll "
.\debug.cpp(256) : 0xf7472000 0x0007a000 "setupdd.sys "
.\debug.cpp(256) : 0xf7ad5000 0x00001000 "\i386\system32\drivers\SPDDLANG.SYS "
.\debug.cpp(256) : 0xf7461000 0x00011000 "pci.sys "
.\debug.cpp(256) : 0xf7433000 0x0002e000 "acpi.sys "
.\debug.cpp(256) : 0xf7a0f000 0x00002000 "\i386\system32\drivers\WMILIB.SYS "
.\debug.cpp(256) : 0xf750d000 0x00009000 "isapnp.sys "
.\debug.cpp(256) : 0xf7ad6000 0x00001000 "\i386\system32\drivers\OPRGHDLR.SYS "
.\debug.cpp(256) : 0xf778d000 0x00007000 "\i386\system32\drivers\PCIIDEX.SYS "
.\debug.cpp(256) : 0xf753d000 0x0000b000 "mountmgr.sys "
.\debug.cpp(256) : 0xf73f6000 0x0001f000 "ftdisk.sys "
.\debug.cpp(256) : 0xf779d000 0x00005000 "partmgr.sys "
.\debug.cpp(256) : 0xf7a19000 0x00002000 "dmload.sys "
.\debug.cpp(256) : 0xf73d0000 0x00026000 "dmio.sys "
.\debug.cpp(256) : 0xf756d000 0x0000d000 "\i386\system32\drivers\CLASSPNP.SYS "
.\debug.cpp(256) : 0xf77ad000 0x00007000 "usbehci.sys "
.\debug.cpp(256) : 0xf7376000 0x00023000 "\i386\system32\drivers\USBPORT.SYS "
.\debug.cpp(256) : 0xf77b5000 0x00005000 "usbohci.sys "
.\debug.cpp(256) : 0xf758d000 0x0000f000 "usbhub.sys "
.\debug.cpp(256) : 0xf7a1d000 0x00002000 "\i386\system32\drivers\USBD.SYS "
.\debug.cpp(256) : 0xf77c5000 0x00008000 "usbccgp.sys "
.\debug.cpp(256) : 0xf7925000 0x00003000 "hidusb.sys "
.\debug.cpp(256) : 0xf77cd000 0x00007000 "\i386\system32\drivers\HIDPARSE.SYS "
.\debug.cpp(256) : 0xf759d000 0x00009000 "\i386\system32\drivers\HIDCLASS.SYS "
.\debug.cpp(256) : 0xf77d5000 0x00007000 "usbstor.sys "
.\debug.cpp(256) : 0xf792d000 0x00004000 "kbdhid.sys "
.\debug.cpp(256) : 0xf77dd000 0x00006000 "kbdclass.sys "
.\debug.cpp(256) : 0xf77e5000 0x00006000 "mouclass.sys "
.\debug.cpp(256) : 0xf7931000 0x00003000 "mouhid.sys "
.\debug.cpp(256) : 0xf735e000 0x00018000 "SCSIPORT.SYS "
.\debug.cpp(256) : 0xf794d000 0x00003000 "VMSCSI.SY_ "
.\debug.cpp(256) : 0xf7845000 0x00008000 "VIAPDSK.SY_ "
.\debug.cpp(256) : 0xf7219000 0x0001d000 "viamraid.SY_ "
.\debug.cpp(256) : 0xf71b2000 0x00011000 "SISRAID4.SY_ "
.\debug.cpp(256) : 0xf784d000 0x00008000 "SISRAID2.SY_ "
.\debug.cpp(256) : 0xf767d000 0x0000c000 "SISRAID1.SY_ "
.\debug.cpp(256) : 0xf768d000 0x0000c000 "SISRAID.SY_ "
.\debug.cpp(256) : 0xf717c000 0x00036000 "si3531.SY_ "
.\debug.cpp(256) : 0xf7165000 0x00017000 "SI3132B5.SY_ "
.\debug.cpp(256) : 0xf700b000 0x00019000 "nvatabus.SY_ "
.\debug.cpp(256) : 0xf61d2000 0x000c4000 "dmboot.sys "
.\debug.cpp(256) : 0xf7291000 0x0000d000 "cdrom.sys "
.\debug.cpp(256) : 0xf7281000 0x00009000 "disk.sys "
.\debug.cpp(256) : 0xf61bb000 0x00017000 "ksecdd.sys "
.\debug.cpp(256) : 0xf6198000 0x00023000 "fastfat.sys "
.\debug.cpp(256) : 0xf610b000 0x0008d000 "ntfs.sys "
.\debug.cpp(256) : 0xf7271000 0x00010000 "cdfs.sys "
.\debug.cpp(256) : 0xf60de000 0x0002d000 "ndis.sys "
.\debug.cpp(256) : 0xf60c3000 0x0001b000 "mup.sys "
.\debug.cpp(256) : 0xf7b78000 0x00001000 "\SystemRoot\System32\drivers\audstub.sys "
.\debug.cpp(256) : 0xf7a25000 0x00002000 "\SystemRoot\System32\Drivers\RootMdm.sys "
.\debug.cpp(256) : 0xf78cd000 0x00008000 "\SystemRoot\System32\Drivers\Modem.SYS "
.\debug.cpp(256) : 0xf7a29000 0x00002000 "\SystemRoot\System32\DRIVERS\swenum.sys "
.\debug.cpp(256) : 0xf5f30000 0x00023000 "\SystemRoot\System32\DRIVERS\ks.sys "
.\debug.cpp(256) : 0xf79f1000 0x00004000 "\SystemRoot\system32\drivers\ramdriv.sys "
.\debug.cpp(256) : 0xf78ed000 0x00006000 "\SystemRoot\System32\drivers\vga.sys "
.\debug.cpp(256) : 0xbafec000 0x00014000 "\SystemRoot\System32\drivers\VIDEOPRT.SYS "
.\debug.cpp(256) : 0xbafbb000 0x00011000 "\SystemRoot\System32\Drivers\Udfs.SYS "
.\debug.cpp(256) : 0xf79fd000 0x00003000 "\SystemRoot\System32\DRIVERS\rasacd.sys "
.\debug.cpp(256) : 0xf7b90000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS "
.\debug.cpp(256) : 0xf77ed000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS "
.\debug.cpp(256) : 0xf77fd000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS "
.\debug.cpp(256) : 0xbafa8000 0x00013000 "\SystemRoot\System32\drivers\ipsec.sys "
.\debug.cpp(256) : 0xf7a2d000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS "
.\debug.cpp(256) : 0xbf800000 0x001c1000 "\SystemRoot\System32\win32k.sys "
.\debug.cpp(256) : 0xf7815000 0x00005000 "\SystemRoot\System32\watchdog.sys "
.\debug.cpp(256) : 0xf5fcf000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys "
.\debug.cpp(256) : 0xbf9c1000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys "
.\debug.cpp(256) : 0xf7bf1000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys "
.\debug.cpp(256) : 0xbff50000 0x00003000 "\SystemRoot\System32\framebuf.dll "
.\debug.cpp(256) : 0xf72f1000 0x00010000 "\SystemRoot\system32\DRIVERS\bcm4sbxp.sys "
.\debug.cpp(256) : 0xf788d000 0x00007000 "\SystemRoot\system32\DRIVERS\usbprint.sys "
.\debug.cpp(256) : 0xf72d1000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys "
.\debug.cpp(256) : 0xf78fd000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS "
.\debug.cpp(256) : 0xbaa8c000 0x0002c000 "\SystemRoot\system32\DRIVERS\rdbss.sys "
.\debug.cpp(256) : 0xbaa1d000 0x0006f000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys "
.\debug.cpp(256) : 0xba9c5000 0x00058000 "\SystemRoot\system32\DRIVERS\tcpip.sys "
.\debug.cpp(256) : 0xba9a3000 0x00022000 "\SystemRoot\system32\drivers\afd.sys "
.\debug.cpp(256) : 0xba97b000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys "
.\debug.cpp(256) : 0x7c900000 0x000af000 "\I386\SYSTEM32\NTDLL.DLL "
.\debug.cpp(263) : **********************************************
.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
.\debug.cpp(308) : **********************************************
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D: "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS "
.\debug.cpp(400) : Destination "\Device\Ndis "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1 "
.\debug.cpp(400) : Destination "\Device\Video0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmIoDaemon "
.\debug.cpp(400) : Destination "\Device\DmControl\DmIoDaemon "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857} "
.\debug.cpp(400) : Destination "\Device\00000010 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip "
.\debug.cpp(400) : Destination "\Device\Ip "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_026E&SUBSYS_01ED1028&REV_A3#3&2411e6fe&0&59#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0017 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev "
.\debug.cpp(400) : Destination "\Device\IPSEC "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a9acf2e1-0602-11e0-b69a-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_2003#6&1a134603&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030} "
.\debug.cpp(400) : Destination "\Device\00000047 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice "
.\debug.cpp(400) : Destination "\Device\WMIDataDevice "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_03f0&Pid_5311#CN84OFV20C04J5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-5 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE "
.\debug.cpp(400) : Destination "\Device\NamedPipe "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC "
.\debug.cpp(400) : Destination "\Device\Mup "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a9acf2e0-0602-11e0-b69a-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0 "
.\debug.cpp(400) : Destination "\Device\USBFDO-0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp "
.\debug.cpp(400) : Destination "\Device\Tcp "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1 "
.\debug.cpp(400) : Destination "\Device\USBFDO-1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0 "
.\debug.cpp(400) : Destination "\Device\Harddisk0\DR0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN "
.\debug.cpp(400) : Destination "\DosDevices\LPT1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#8&2a9a6e67&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap "
.\debug.cpp(400) : Destination "\Device\FsWrap "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_2003#6&1a134603&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\00000047 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1 "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DR1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0 "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_026D&SUBSYS_01ED1028&REV_A3#3&2411e6fe&0&58#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_DVD+-RW_TS-H553A_______________DE04#4&21479b0c&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\00000041 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857} "
.\debug.cpp(400) : Destination "\Device\00000013 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global "
.\debug.cpp(400) : Destination "\GLOBAL?? "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&26e8faff&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_045e&Pid_0040#6&53ab790&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030} "
.\debug.cpp(400) : Destination "\Device\00000046 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a9acf2e2-0602-11e0-b69a-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_413c&Pid_2003#5&3837fe3a&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_DVD+-RW_TS-H553A_______________DE04#4&21479b0c&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\00000041 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager "
.\debug.cpp(400) : Destination "\Device\MountPointManager "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmConfig "
.\debug.cpp(400) : Destination "\Device\DmControl\DmConfig "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_03f0&Pid_5311&MI_01#6&1d1f1b2a&0&0001#{28d78fad-5a12-11d1-ae5b-0000f803a8c2} "
.\debug.cpp(400) : Destination "\Device\0000004b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#8&2a9a6e67&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ROOT#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\0000003c "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmTrace "
.\debug.cpp(400) : Destination "\Device\DmControl\DmTrace "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ROOT#dmio#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\0000003d "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{627A4B80-677F-4724-BD0C-EE47A4041F86} "
.\debug.cpp(400) : Destination "\Device\{627A4B80-677F-4724-BD0C-EE47A4041F86} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_045e&Pid_0040#6&53ab790&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\00000046 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_HP&Prod_Officejet_6310&Rev_1.00#7&2256e975&0&CN84OFV20C04J5&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\0000004f "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0: "
.\debug.cpp(400) : Destination "\Device\NvAta0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&2a21177b&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&SignatureD0F4738COffset2738A00Length2471BDAC00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_046d&Pid_08a6#5&3837fe3a&0&6#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-4 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_045e&Pid_0040#5&3837fe3a&0&3#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\B: "
.\debug.cpp(400) : Destination "\Device\RAMDriv "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST "
.\debug.cpp(400) : Destination "\Device\IPMULTICAST "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407} "
.\debug.cpp(400) : Destination "\Device\0000000a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1: "
.\debug.cpp(400) : Destination "\Device\NvAta1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmLoader "
.\debug.cpp(400) : Destination "\Device\DmLoader "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow "
.\debug.cpp(400) : Destination "\Device\LanmanRedirector "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl "
.\debug.cpp(400) : Destination "\Device\FtControl "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\X: "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C: "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT "
.\debug.cpp(400) : Destination "\Device\MailSlot "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX "
.\debug.cpp(400) : Destination "\DosDevices\COM1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL "
.\debug.cpp(400) : Destination "\Device\Null "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT "
.\debug.cpp(400) : Destination " "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Standard 33600 bps Modem "
.\debug.cpp(400) : Destination "\Device\00000009 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskST3160812AS_____________________________3.ADH___#2020202020202020202020204C353753564C3730#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\00000040 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmInfo "
.\debug.cpp(400) : Destination "\Device\DmControl\DmInfo "
.\debug.cpp(409) : --
.\debug.cpp(453) : **********************************************
.\boot_cleaner.cpp(565) : System volume is \\.\X:
.\boot_cleaner.cpp(659) : main(): DeviceIoControl() ERROR 1
.\boot_cleaner.cpp(660) : ERROR: Can't process volume \\.\X:
.\boot_cleaner.cpp(1151) : Done;

 

recovery console

I can't find recovery console. But did the MBR check again anyway.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 140):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF7358000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7347000 pci.sys
0xF7487000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7497000 MountMgr.sys
0xF7328000 ftdisk.sys
0xF74A7000 \WINDOWS\system32\drivers\CLASSPNP.SYS
0xF770F000 PartMgr.sys
0xF74B7000 VolSnap.sys
0xF72FA000 atapi.sys
0xF74C7000 disk.sys
0xF72C0000 fltmgr.sys
0xF72AE000 sr.sys
0xF7298000 DRVMCDB.SYS
0xF74D7000 PxHelp20.sys
0xF7281000 KSecDD.sys
0xF726E000 WudfPf.sys
0xF71E1000 Ntfs.sys
0xF71B4000 NDIS.sys
0xF719A000 Mup.sys
0xF7557000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xF6D8B000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6D77000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7847000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6D53000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF784F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7567000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7162000 \SystemRoot\System32\Drivers\CLBStor.SYS
0xF7857000 \SystemRoot\System32\Drivers\ASAPIW2K.sys
0xF79FF000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
0xF7577000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7587000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6D30000 \SystemRoot\system32\DRIVERS\ks.sys
0xF785F000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF7597000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys
0xF6D08000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF7BA8000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF75F7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF715A000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6CF1000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7607000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7617000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7867000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6CE0000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7627000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF786F000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7877000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7637000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF787F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7887000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7A13000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6C82000 \SystemRoot\system32\DRIVERS\update.sys
0xF7917000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF6C54000 \SystemRoot\system32\DRIVERS\MarvinBus.sys
0xF6B30000 \SystemRoot\system32\drivers\sthda.sys
0xF6B0C000 \SystemRoot\system32\drivers\portcls.sys
0xF7657000 \SystemRoot\system32\drivers\drmk.sys
0xF7667000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7677000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7A21000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF795B000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7A29000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7B38000 \SystemRoot\System32\Drivers\Null.SYS
0xF7A2B000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7757000 \SystemRoot\System32\Drivers\DLARTL_N.SYS
0xF775F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7767000 \SystemRoot\System32\drivers\vga.sys
0xF7A2D000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7A2F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF776F000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7777000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7967000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF439B000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF4342000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF76A7000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF431C000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF42F4000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF797B000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xF42AA000 \SystemRoot\System32\drivers\afd.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF427F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF7172000 \??\C:\WINDOWS\system32\drivers\pclepci.sys
0xF420F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF76E7000 \SystemRoot\System32\Drivers\Fips.SYS
0xF777F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF3F06000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF75E7000 \SystemRoot\system32\drivers\lvusbsta.sys
0xF7647000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF401F000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF7837000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF783F000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xF413F000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF4473000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xF4007000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xF3F93000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF41FF000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF3F8F000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF3A71000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF34FF000 \SystemRoot\system32\DRIVERS\LV302AV.SYS
0xF41EF000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xF32E4000 \SystemRoot\system32\DRIVERS\lvsvf2.sys
0xF79AD000 \SystemRoot\system32\DRIVERS\lv302af.sys
0xF41DF000 \SystemRoot\system32\drivers\usbaudio.sys
0xF39C9000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF2441000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79B5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF3A39000 \SystemRoot\System32\drivers\Dxapi.sys
0xF404F000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7BA7000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF42E0000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xF76C7000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
0xF7B54000 \SystemRoot\System32\DLA\DLADResN.SYS
0xBA5EA000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
0xF42D0000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
0xF79FB000 \SystemRoot\System32\DLA\DLAPoolM.SYS
0xBA5C3000 \SystemRoot\System32\Drivers\CLBUDF.SYS
0xBA5B2000 \SystemRoot\System32\Drivers\Udfs.SYS
0xF3ECE000 \SystemRoot\System32\DLA\DLABOIOM.SYS
0xBA59A000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
0xBA584000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
0xF3FEF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB9C2D000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xB9A48000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB9900000 \SystemRoot\system32\DRIVERS\srv.sys
0xF788F000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xB9373000 \SystemRoot\system32\drivers\wdmaud.sys
0xB94E0000 \SystemRoot\system32\drivers\sysaudio.sys
0xB9244000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 63):
0 System Idle Process
4 System
564 C:\WINDOWS\system32\smss.exe
612 csrss.exe
636 C:\WINDOWS\system32\winlogon.exe
680 C:\WINDOWS\system32\services.exe
700 C:\WINDOWS\system32\lsass.exe
908 C:\WINDOWS\system32\svchost.exe
972 svchost.exe
1080 C:\Program Files\Windows Defender\MsMpEng.exe
1144 C:\WINDOWS\system32\svchost.exe
1192 C:\WINDOWS\system32\svchost.exe
1308 svchost.exe
1388 svchost.exe
1492 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1848 C:\WINDOWS\system32\spoolsv.exe
516 svchost.exe
544 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
584 C:\Program Files\Bonjour\mDNSResponder.exe
656 C:\Program Files\Java\jre6\bin\jqs.exe
1220 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
1508 C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
1740 C:\WINDOWS\system32\nvsvc32.exe
1780 C:\WINDOWS\system32\HPZipm12.exe
1800 C:\Program Files\CyberLink\Shared files\RichVideo.exe
1944 C:\WINDOWS\system32\svchost.exe
120 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
704 C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
2476 alg.exe
3884 C:\WINDOWS\system32\wuauclt.exe
1036 MpCmdRun.exe
2424 C:\WINDOWS\explorer.exe
1896 C:\Program Files\Dell\Media Experience\DMXLauncher.exe
3036 C:\WINDOWS\stsystra.exe
1024 C:\WINDOWS\system32\DLA\DLACTRLW.EXE
3128 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
3084 C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
3040 C:\Program Files\Windows Defender\MSASCui.exe
1320 C:\WINDOWS\system32\LVCOMSX.EXE
3016 C:\Program Files\Logitech\Video\LogiTray.exe
3072 C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
3052 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
816 C:\Program Files\HP\HP Software Update\hpwuschd2.exe
3180 C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
3224 C:\Program Files\iTunes\iTunesHelper.exe
2508 C:\PROGRA~1\ALWILS~1\Avast5\AvastUI.exe
2936 <unknown>
3328 C:\WINDOWS\system32\ctfmon.exe
804 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
3292 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
3436 C:\Documents and Settings\Melanie\Desktop\MBRCheck.exe
3440 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
2704 C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
3544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
3640 C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
1016 C:\Program Files\FinePixViewer\QuickDCF2.exe
3680 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
3772 C:\Program Files\Logitech\Video\FxSvr2.exe
3908 C:\Program Files\iPod\bin\iPodService.exe
396 <unknown>
476 C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
2296 wmiprvse.exe
1720 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)

PhysicalDrive0 Model Number: ST3160812AS, Rev: 3.ADH

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Dell MBR code detected
SHA1: 57BDF501CE769EF2720C705B6C71C893DA31574E


Done!

 

i can't

I can't download combofix to the desktop because I can't get that far. I reboot and end up with the blue screen still. The only way I can get on is by using the OTL disk that we made.

 

combofix

Ok. It has let me on long enough to download and run combofix. And it installed the recovery console.

--------------------------------------------------------------------

ComboFix 10-12-11.06 - Melanie 12/12/2010 13:49:31.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.958.464 [GMT -6:00]
Running from: c:\documents and settings\Melanie\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Melanie\LOCALS~1\Temp\IadHide4.dll
c:\documents and settings\Melanie\Local Settings\Temp\IadHide4.dll
c:\documents and settings\Melanie\System
c:\documents and settings\Melanie\System\win_qs8.jqx
C:\Documents
c:\program files\UNWISE.EXE
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\logs

.
((((((((((((((((((((((((( Files Created from 2010-11-12 to 2010-12-12 )))))))))))))))))))))))))))))))
.

2010-12-12 03:50 . 2010-12-12 03:50 -------- d-----w- c:\program files\7-Zip
2010-12-10 07:47 . 2010-11-10 04:33 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{C7D6923B-0745-408D-9D3A-43D1FB5032E6}\mpengine.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-29 23:42 . 2009-08-29 15:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-29 23:42 . 2009-08-29 15:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-10 04:33 . 2006-12-18 01:17 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2010-10-19 16:41 . 2009-10-02 17:31 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-09-18 17:23 . 2004-08-10 18:51 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-10 18:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-10 18:51 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-10 18:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-14 18:32 . 2010-05-30 02:39 398744 ----a-r- c:\windows\system32\cpnprt2.cid
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM "= "c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2006-12-24 20480]
"LogitechSoftwareUpdate "= "c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 68856]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-08-23 7630848]
"nwiz "= "nwiz.exe" [2006-08-23 1617920]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-08-23 86016]
"DMXLauncher "= "c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"SigmatelSysTrayApp "= "stsystra.exe" [2006-08-15 282624]
"DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Corel Photo Downloader "= "c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]
"LVCOMSX "= "c:\windows\system32\LVCOMSX.EXE" [2005-05-27 221184]
"LogitechVideoRepair "= "c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray "= "c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"USB2Check "= "c:\windows\system32\PCLECoInst.dll" [2004-09-21 73728]
"USBToolTip "= "c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-06-01 196608]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-06 185896]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"RemoteControl8 "= "c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-21 83240]
"PDVD8LanguageShortcut "= "c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"PinnacleDriverCheck "= "c:\windows\system32\PSDrvCheck.exe" [2004-03-11 406016]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 221184]
"avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-1-27 303104]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-12-23 450560]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe "=
"c:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe "=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [8/27/2009 5:49 PM 165584]
R1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [11/14/2009 8:52 PM 15784]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/27/2009 5:50 PM 17744]
R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [11/14/2009 8:52 PM 162344]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [10/4/2009 8:51 AM 17408]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-12-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2010-12-12 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2010-12-12 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2008-03-26 14:53]

2010-12-12 c:\windows\Tasks\User_Feed_Synchronization-{D849E1C1-B3CC-4887-B7C7-344812599166}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=yie7c
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {FAB2BB9D-91E9-457E-9D42-75A7FCCBBC00} - hxxp://www.avataritag.com/app/Plugin/DFusionHomeWebPlugIn.Installer.exe
FF - ProfilePath - c:\documents and settings\Melanie\Application Data\Mozilla\Firefox\Profiles\531rj6m2.default\
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPDFusionWebFirefox.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\Total Immersion\DFusionHomeWebPlugIn\NPDFusionWebFirefox.dll
FF - HiddenExt: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\documents and settings\Melanie\Application Data\Mozilla\Firefox\Profiles\531rj6m2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-InstantBurn - f:\instan~1\Win2K\IBurn.exe
HKLM-Run-UpdatePDRShortCut - f:\dvd suite\MUITransfer\MUIStartMenu.exe
HKLM-Run-UpdatePPShortCut - f:\powerproducer\MUITransfer\MUIStartMenu.exe
AddRemove-HijackThis - c:\documents and settings\Melanie\Desktop\HijackThis.exe



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3696)
c:\windows\system32\WININET.dll
c:\docume~1\Melanie\LOCALS~1\Temp\IadHide4.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
c:\windows\stsystra.exe
c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-12-12 14:01:59 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-12 20:01

Pre-Run: 100,721,917,952 bytes free
Post-Run: 100,681,465,856 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 49FD25FCF07EAB3C7CF82E3B233772DF

 

otl.txt

OTL logfile created on: 12/12/2010 3:51:14 PM - Run 4
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Melanie\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.00 Mb Total Physical Memory | 362.00 Mb Available Physical Memory | 38.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 145.78 Gb Total Space | 93.73 Gb Free Space | 64.30% Space Free | Partition Type: NTFS

Computer Name: M | User Name: Melanie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/12 15:50:08 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Melanie\Desktop\OTL.exe
PRC - [2010/09/07 09:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 09:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/06/01 09:17:48 | 005,252,408 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
PRC - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/05/05 23:55:51 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/20 20:23:22 | 000,083,240 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2007/08/09 01:27:52 | 000,073,728 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2007/05/21 13:47:40 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2007/01/30 12:02:00 | 000,303,104 | ---- | M] (FUJIFILM Corporation) -- C:\Program Files\FinePixViewer\QuickDCF2.exe
PRC - [2006/12/23 21:24:37 | 000,020,480 | ---- | M] (Logitech) -- C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
PRC - [2006/11/03 18:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/08/15 03:00:20 | 000,282,624 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2006/08/14 14:20:26 | 000,462,336 | ---- | M] (Corel, Inc.) -- C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
PRC - [2006/06/01 02:37:48 | 000,196,608 | ---- | M] (Pinnacle Systems GmbH) -- C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
PRC - [2006/02/10 06:56:12 | 000,479,232 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
PRC - [2006/01/19 09:22:20 | 000,049,152 | ---- | M] (Pinnacle Systems) -- c:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
PRC - [2005/10/05 03:12:00 | 000,094,208 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
PRC - [2005/09/08 05:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE
PRC - [2005/06/08 15:14:44 | 000,217,088 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Video\LogiTray.exe
PRC - [2005/06/08 14:44:56 | 000,192,512 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Video\FxSvr2.exe
PRC - [2005/05/27 09:18:16 | 000,221,184 | ---- | M] (Logitech Inc.) -- C:\WINDOWS\system32\LVCOMSX.EXE
PRC - [2005/05/03 23:04:28 | 009,150,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
PRC - [2004/07/27 16:50:18 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/12/12 15:50:08 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Melanie\Desktop\OTL.exe
MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2006/12/23 21:24:37 | 000,024,576 | ---- | M] (BackWeb) -- C:\Documents and Settings\Melanie\Local Settings\Temp\IadHide4.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/09/07 09:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 09:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 09:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/08/09 01:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2006/11/03 18:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2006/01/19 09:22:20 | 000,049,152 | ---- | M] (Pinnacle Systems) [Auto | Running] -- c:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe -- (PinnacleSys.MediaServer)
SRV - [2005/05/03 23:04:28 | 009,150,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe -- (MSSQL$PINNACLESYS)
SRV - [2005/05/03 20:42:56 | 000,323,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE -- (SQLAgent$PINNACLESYS)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\SBREdrv.sys -- (SBRE)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2010/09/07 08:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 08:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 08:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 08:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/07 08:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/07 08:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009/08/28 18:42:44 | 000,017,408 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\netaapl.sys -- (Netaapl)
DRV - [2008/04/13 12:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 12:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 12:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 10:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/10/26 09:55:46 | 000,015,784 | ---- | M] (Cyberlink Co.,Ltd.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\CLBStor.sys -- (CLBStor)
DRV - [2007/10/26 09:55:44 | 000,162,344 | ---- | M] (CyberLink Corporation.) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\CLBUDF.sys -- (CLBUDF)
DRV - [2006/08/23 12:12:38 | 003,959,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2006/08/15 03:00:18 | 001,171,464 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2006/08/14 06:29:44 | 000,044,544 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/08/05 07:00:48 | 000,089,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\nvraid.sys -- (nvraid) NVIDIA nForce(tm)
DRV - [2006/08/05 07:00:40 | 000,105,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2006/06/18 21:37:34 | 000,036,864 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2006/05/08 23:27:22 | 000,426,624 | ---- | M] (Pinnacle Systems) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MarvinUsb.sys -- (PinnacleMarvinUsb)
DRV - [2005/09/12 03:30:00 | 000,089,264 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)
DRV - [2005/09/08 05:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005/09/08 05:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005/09/08 05:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005/09/08 05:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005/09/08 05:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005/09/08 05:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005/09/08 05:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005/08/25 12:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005/08/25 12:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2005/08/12 05:20:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM)
DRV - [2005/07/13 15:55:22 | 000,171,008 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MarvinBus.sys -- (MarvinBus)
DRV - [2005/05/27 03:46:20 | 000,913,280 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV302AV.SYS -- (PID_08A0) QuickCam IM(PID_08A0)
DRV - [2005/05/27 03:37:58 | 000,007,136 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2005/05/27 03:31:26 | 000,022,016 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2005/02/23 18:40:26 | 000,011,264 | ---- | M] (VOB Computersysteme GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\asapiW2k.sys -- (ASAPIW2K)
DRV - [2005/02/09 12:59:00 | 000,014,165 | ---- | M] (Pinnacle Systems GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Pclepci.sys -- (PCLEPCI)
DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4061128
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4061128

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&fr=yie7c
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/04 20:14:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/04 20:14:25 | 000,000,000 | ---D | M]

[2009/04/23 07:12:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\Mozilla\Extensions
[2010/10/12 18:16:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\Mozilla\Firefox\Profiles\531rj6m2.default\extensions
[2010/08/04 10:41:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Melanie\Application Data\Mozilla\Firefox\Profiles\531rj6m2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/10/12 18:16:17 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/26 12:13:08 | 000,393,216 | ---- | M] (Invenda Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll
[2009/11/20 14:05:31 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/12/02 16:14:22 | 001,933,312 | ---- | M] (Total Immersion) -- C:\Program Files\Mozilla Firefox\plugins\NPDFusionWebFirefox.dll
[2009/11/20 14:05:32 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2010/12/12 13:55:58 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe (Corel, Inc.)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [ISUSPM Startup] c:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe ()
O4 - HKLM..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe ()
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [USB2Check] C:\WINDOWS\System32\PCLECoInst.DLL (Pinnacle Systems)
O4 - HKLM..\Run: [USBToolTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKCU..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe (Logitech)
O4 - HKCU..\Run: [LogitechSoftwareUpdate] C:\Program Files\Logitech\Video\ManifestEngine.exe (Logitech Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab (Windows Live Safety Center Base Module)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {FAB2BB9D-91E9-457E-9D42-75A7FCCBBC00} http://www.avataritag.com/app/Plugin/DFusionHomeWebPlugIn.Installer.exe (CDFusionActiveXCtl Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Melanie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Melanie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/21 12:58:22 | 000,000,095 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\WINDOWS\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3fhg - C:\WINDOWS\System32\mp3fhg.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: VIDC.3iv2 - C:\WINDOWS\System32\3ivxVfWCodec.dll (3ivx.com)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: VIDC.I420 - vdrcodec.dll File not found
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\pvmjpg30.dll (Pegasus Imaging Corporation)
Drivers32: VIDC.VP31 - C:\WINDOWS\System32\vp31vfw.dll (On2.com)
Drivers32: VIDC.VP60 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.VP61 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.VP62 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.VP70 - C:\WINDOWS\System32\vp7vfw.dll (On2.com)
Drivers32: VIDC.wmv3 - C:\WINDOWS\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: VIDC.X264 - C:\WINDOWS\System32\x264vfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/12/12 15:50:07 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Melanie\Desktop\OTL.exe
[2010/12/12 13:47:42 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/12/12 13:43:42 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/12/12 13:43:42 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/12/12 13:43:42 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/12/12 13:43:42 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/12/12 13:43:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/12/12 13:43:32 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/12/12 13:43:23 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/11 21:50:00 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2010/12/11 21:39:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Melanie\Desktop\tdsskiller

========== Files - Modified Within 30 Days ==========

[2010/12/12 15:50:08 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Melanie\Desktop\OTL.exe
[2010/12/12 14:15:59 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/12/12 13:58:07 | 000,000,466 | ---- | M] () -- C:\WINDOWS\tasks\SDMsgUpdate (TE).job
[2010/12/12 13:56:19 | 000,081,191 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/12/12 13:55:58 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/12 13:55:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/12/12 13:55:29 | 1005,047,808 | -HS- | M] () -- C:\hiberfil.sys
[2010/12/12 13:47:46 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/12/12 13:41:19 | 003,988,679 | R--- | M] () -- C:\Documents and Settings\Melanie\Desktop\ComboFix.exe
[2010/12/12 13:39:27 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/12/12 12:04:26 | 000,000,396 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D849E1C1-B3CC-4887-B7C7-344812599166}.job
[2010/12/11 21:46:10 | 001,110,476 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\7z920.exe
[2010/12/11 21:43:20 | 000,039,605 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\bootkit_remover.rar
[2010/12/11 21:34:54 | 001,230,779 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\tdsskiller.zip
[2010/12/11 17:49:35 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\MBRCheck.exe
[2010/12/11 17:48:43 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\0kub6k4w.exe
[2010/12/10 18:48:04 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/12/10 08:43:57 | 000,481,768 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/12/10 08:43:57 | 000,088,556 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/12/09 11:09:05 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/12/09 09:00:03 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\Microsoft Office Word 2003.lnk
[2010/12/07 07:32:19 | 000,240,640 | ---- | M] () -- C:\Documents and Settings\Melanie\My Documents\calendar2010.doc
[2010/12/06 19:13:32 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\Melanie\My Documents\chore chart luke on my weekend.xls
[2010/12/06 15:17:53 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/11/29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/19 09:48:49 | 000,024,576 | ---- | M] () -- C:\Documents and Settings\Melanie\My Documents\11.doc
[2010/11/17 17:27:18 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\Melanie\My Documents\chore chart luke.xls
[2010/11/14 17:05:59 | 000,034,304 | ---- | M] () -- C:\Documents and Settings\Melanie\My Documents\Fax list of MDs.xls
[2010/11/13 19:20:09 | 000,027,136 | ---- | M] () -- C:\Documents and Settings\Melanie\My Documents\New ADL log.xls

========== Files Created - No Company Name ==========

[2010/12/12 13:47:46 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/12/12 13:47:43 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/12/12 13:43:42 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/12/12 13:43:42 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/12/12 13:43:42 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/12/12 13:43:42 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/12/12 13:43:42 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/12/12 13:41:16 | 003,988,679 | R--- | C] () -- C:\Documents and Settings\Melanie\Desktop\ComboFix.exe
[2010/12/11 21:46:08 | 001,110,476 | ---- | C] () -- C:\Documents and Settings\Melanie\Desktop\7z920.exe
[2010/12/11 21:43:24 | 000,039,605 | ---- | C] () -- C:\Documents and Settings\Melanie\Desktop\bootkit_remover.rar
[2010/12/11 21:34:50 | 001,230,779 | ---- | C] () -- C:\Documents and Settings\Melanie\Desktop\tdsskiller.zip
[2010/12/11 17:49:35 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Melanie\Desktop\MBRCheck.exe
[2010/12/11 17:48:42 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Melanie\Desktop\0kub6k4w.exe
[2010/12/11 10:43:34 | 1005,047,808 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/19 09:48:48 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\Melanie\My Documents\11.doc
[2010/11/14 15:26:28 | 000,034,304 | ---- | C] () -- C:\Documents and Settings\Melanie\My Documents\Fax list of MDs.xls
[2010/11/13 18:28:05 | 000,027,136 | ---- | C] () -- C:\Documents and Settings\Melanie\My Documents\New ADL log.xls
[2010/02/21 13:05:28 | 000,194,248 | ---- | C] () -- C:\WINDOWS\System32\LTRFD13n.DLL
[2009/11/14 21:56:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PhotoNow.INI
[2009/09/12 18:37:34 | 000,000,221 | ---- | C] () -- C:\WINDOWS\NCLogConfig.ini
[2008/09/16 17:01:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI
[2008/09/03 16:53:54 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2008/09/03 16:49:27 | 000,003,860 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/03/17 15:27:48 | 000,000,021 | ---- | C] () -- C:\WINDOWS\atid.ini
[2008/01/20 20:55:38 | 000,157,696 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2008/01/20 20:55:36 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/01/20 20:55:36 | 000,540,178 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2008/01/20 20:55:34 | 000,006,144 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/01/20 20:55:33 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2007/06/10 15:05:34 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\macd32.dll
[2007/06/10 15:05:34 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\mase32.dll
[2007/06/10 15:05:34 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\mamc32.dll
[2007/06/10 15:05:34 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\masd32.dll
[2007/06/10 15:05:34 | 000,000,359 | ---- | C] () -- C:\WINDOWS\VFO.INI
[2007/06/10 15:05:33 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\ma32.dll
[2007/05/18 00:07:21 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\Melanie\Application Data\dvd.bmk
[2007/05/17 23:33:02 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\Melanie\Local Settings\Application Data\fusioncache.dat
[2007/04/06 19:33:13 | 000,002,182 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/03/22 17:56:27 | 000,000,024 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/12/23 23:52:15 | 000,002,672 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/12/23 22:02:00 | 000,009,255 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2006/12/17 19:43:49 | 000,075,088 | ---- | C] () -- C:\WINDOWS\System32\adwfil.dll
[2006/12/17 19:43:49 | 000,013,034 | ---- | C] () -- C:\WINDOWS\System32\gblfil.dll
[2006/12/17 19:43:49 | 000,010,834 | ---- | C] () -- C:\WINDOWS\System32\chtfil.dll
[2006/12/17 19:43:49 | 000,005,338 | ---- | C] () -- C:\WINDOWS\System32\wfileu.drv
[2006/12/17 19:43:49 | 000,005,142 | ---- | C] () -- C:\WINDOWS\System32\iawfil.dll
[2006/12/17 19:43:49 | 000,004,826 | ---- | C] () -- C:\WINDOWS\System32\vgamfil.dll
[2006/12/17 19:43:49 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\hatfil.dll
[2006/12/17 19:43:49 | 000,003,818 | ---- | C] () -- C:\WINDOWS\System32\viofil.dll
[2006/12/17 19:43:49 | 000,003,444 | ---- | C] () -- C:\WINDOWS\System32\srchin.dll
[2006/12/17 19:43:49 | 000,002,782 | ---- | C] () -- C:\WINDOWS\System32\lgwfil.dll
[2006/12/17 19:43:49 | 000,001,830 | ---- | C] () -- C:\WINDOWS\System32\cultfil.dll
[2006/12/17 19:43:49 | 000,001,378 | ---- | C] () -- C:\WINDOWS\System32\gdwfil.dll
[2006/12/17 19:43:49 | 000,000,980 | ---- | C] () -- C:\WINDOWS\System32\imgfil.dll
[2006/12/17 19:43:49 | 000,000,514 | ---- | C] () -- C:\WINDOWS\System32\snetfil.dll
[2006/12/17 19:43:49 | 000,000,400 | ---- | C] () -- C:\WINDOWS\bsnlst.dll
[2006/12/17 19:43:49 | 000,000,306 | ---- | C] () -- C:\WINDOWS\System32\picsfil.dll
[2006/12/17 19:43:49 | 000,000,258 | ---- | C] () -- C:\WINDOWS\System32\srchout.dll
[2006/12/17 19:43:47 | 000,334,174 | ---- | C] () -- C:\WINDOWS\sqlite3.dll
[2006/12/17 19:40:11 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/12/17 19:15:15 | 000,116,224 | ---- | C] () -- C:\Documents and Settings\Melanie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/28 21:44:15 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/11/28 21:33:30 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/11/28 21:27:41 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/11/28 21:07:32 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/11/28 21:07:32 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/11/28 21:07:32 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/11/28 21:07:32 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/11/28 21:07:32 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/11/28 21:07:32 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/11/28 21:07:31 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/11/28 21:06:35 | 000,000,394 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 01:56:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/10 13:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 13:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 12:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/07 02:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
[1999/01/27 13:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll

 

more otl.txt

========== LOP Check ==========

[2010/07/29 09:54:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/02/09 17:04:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverScanner
[2007/06/10 16:22:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle
[2007/06/10 16:23:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
[2009/11/14 21:07:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2007/06/13 17:58:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
[2009/10/04 09:07:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/07/26 12:12:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\E-centives
[2006/12/23 21:26:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\FotoWire
[2010/08/12 17:50:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\FUJIFILM
[2010/03/25 10:49:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\GetRightToGo
[2006/12/23 23:49:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\Leadertech
[2010/02/21 12:33:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\Pinnacle Systems
[2008/03/26 10:44:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\SmartDraw
[2009/12/13 14:33:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\Total Immersion
[2010/02/09 17:04:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\Uniblue
[2010/12/12 14:15:59 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/12/12 13:58:07 | 000,000,466 | ---- | M] () -- C:\WINDOWS\Tasks\SDMsgUpdate (TE).job
[2010/12/12 12:04:26 | 000,000,396 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{D849E1C1-B3CC-4887-B7C7-344812599166}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/09/23 16:35:44 | 000,000,013 | ---- | M] () -- C:\alrt_200.data
[2010/02/21 12:58:22 | 000,000,095 | ---- | M] () -- C:\AUTOEXEC.BAT
[2006/12/17 18:59:00 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/12/12 13:47:46 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/05/31 16:54:34 | 000,005,380 | ---- | M] () -- C:\CES.xml
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/12/12 14:02:00 | 000,015,048 | ---- | M] () -- C:\ComboFix.txt
[2004/08/10 13:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/11/28 21:10:42 | 000,006,279 | RH-- | M] () -- C:\dell.sdr
[2010/05/27 15:29:50 | 000,000,020 | ---- | M] () -- C:\dirref.ini
[2010/12/12 13:55:29 | 1005,047,808 | -HS- | M] () -- C:\hiberfil.sys
[2006/12/17 19:13:22 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2007/04/02 15:47:43 | 000,000,067 | ---- | M] () -- C:\inferno.log
[2004/08/10 13:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2008/03/17 15:27:56 | 000,001,702 | -H-- | M] () -- C:\IPH.PH
[2009/10/24 12:11:03 | 000,000,506 | ---- | M] () -- C:\LOGC5.log
[2009/10/24 12:15:57 | 000,000,480 | ---- | M] () -- C:\LOGC9.log
[2006/12/23 21:24:41 | 000,000,183 | ---- | M] () -- C:\LogiSetup.log
[2010/05/19 11:09:24 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2004/08/10 13:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/10/21 16:54:19 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/12/11 11:25:45 | 000,071,094 | ---- | M] () -- C:\OTL.Txt
[2010/12/12 13:55:28 | 1509,949,440 | -HS- | M] () -- C:\pagefile.sys
[2006/11/28 21:38:20 | 000,000,070 | ---- | M] () -- C:\SystemInfo.ini
[2010/12/11 21:40:59 | 000,053,934 | ---- | M] () -- C:\TDSSKiller.2.4.11.0_11.12.2010_21.40.10_log.txt
[2010/12/11 21:43:06 | 000,053,934 | ---- | M] () -- C:\TDSSKiller.2.4.11.0_11.12.2010_21.42.20_log.txt
[2009/08/31 08:08:42 | 000,000,838 | ---- | M] () -- C:\updatedatfix.log
[2007/07/05 15:21:16 | 000,000,152 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >
[2006/02/19 02:28:56 | 000,012,288 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\WINDOWS\Fonts\RandFont.dll

< %systemroot%\Fonts\*.ini >
[2004/08/10 13:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 06:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/04/10 13:02:32 | 000,074,240 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp054.dll
[2004/03/22 15:17:08 | 000,025,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 04:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 09:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 12:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 12:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 12:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/10/21 17:01:55 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2006/12/17 19:00:28 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Melanie\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/10 13:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Melanie\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/12/11 17:48:43 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\0kub6k4w.exe
[2010/12/11 21:46:10 | 001,110,476 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\7z920.exe
[2010/12/12 13:41:19 | 003,988,679 | R--- | M] () -- C:\Documents and Settings\Melanie\Desktop\ComboFix.exe
[2010/09/18 12:25:28 | 008,534,336 | ---- | M] (Mozilla) -- C:\Documents and Settings\Melanie\Desktop\Firefox Setup 3.6.10.exe
[2010/12/11 17:49:35 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Melanie\Desktop\MBRCheck.exe
[2010/12/12 15:50:08 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Melanie\Desktop\OTL.exe
[2010/10/11 10:28:07 | 000,755,552 | ---- | M] (Secunia) -- C:\Documents and Settings\Melanie\Desktop\PSISetup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2006/12/17 19:00:27 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Melanie\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/12/12 15:42:28 | 000,622,592 | -HS- | M] () -- C:\Documents and Settings\Melanie\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2009/01/30 16:40:22 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 18:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 01:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 01:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 08:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 11:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 18:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 01:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 01:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 01:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 01:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 01:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

< End of report >

 

otl.extras

Can't find an OTL extras log anywhere.

 

new otl

All processes killed
========== OTL ==========
Service SBRE stopped successfully!
Service SBRE deleted successfully!
File C:\WINDOWS\System32\drivers\SBREdrv.sys not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: Melanie
->Temp folder emptied: 29814239 bytes
->Temporary Internet Files folder emptied: 12506516 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 7856964 bytes
->Flash cache emptied: 2157 bytes

User: NetworkService
->Temp folder emptied: 2072 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18379 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 48.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: Melanie
->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 12122010_180030

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF711D.tmp not found!
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF712F.tmp not found!
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF7196.tmp not found!
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF71B3.tmp not found!
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF7237.tmp not found!
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF7249.tmp not found!
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF7292.tmp not found!
File\Folder C:\Documents and Settings\Melanie\Local Settings\Temp\~DF72A4.tmp not found!
C:\Documents and Settings\Melanie\Local Settings\Temporary Internet Files\Content.IE5\M2XGB2ZG\96695-active-blue-screen-death-3[1].html moved successfully.
C:\Documents and Settings\Melanie\Local Settings\Temporary Internet Files\Content.IE5\03XBGRV0\iframescript[1].htm moved successfully.
C:\Documents and Settings\Melanie\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Documents and Settings\Melanie\Local Settings\Temporary Internet Files\SuggestedSites.dat moved successfully.
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_ab4.dat not found!

Registry entries deleted on Reboot...

 

security check

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
ESET Online Scanner v3
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Adobe Flash Player 10.0.42.34
Mozilla Firefox (3.0.19) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Windows Defender MsMpEng.exe
Alwil Software Avast5 AvastSvc.exe
ALWILS~1 Avast5 avastUI.exe
````````````````````````````````
DNS Vulnerability Check:
Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?)

``````````End of Log````````````

 

eset

ESET scan found nothing.