Solved 'AntiVirus' malware chaos

ggs · 2010/12/21

[Resolved] 'AntiVirus' malware chaos

My System: 2002 Dell Dimension 8200, 512 RAM, Windows XP Home, SP3, Avast Pro.
Summary of events to this post: About a month ago the system picked up the malware "AntiVirus" which locked up everything. No Internet out, no Word, no Control Panel, zit. The system did start in Safe Mode and allow usage of Word, but no Internet. Downloaded Malwarebytes and CCleaner to a flash on another computer. In Safe Mode was able to run both programs on the infected system. Eliminated "AntiVirus" malware and several other "˜findsâ€™ by Malwarebytes. Ran Avast two or three times, and each time it found another problem, usually a PUP. After all this "˜cleaningâ€™ the system screen on restart goes blue. Desktop screen can be coaxed back through Task Manager. No Internet out, but Internet comes in, because Avast is updating and announcing it. Also, at frequent intervals, Avast announces aâ€Threat Detected and stopped.â€œ (always the same threat while the CPU is going crazy). Rerun Malwarebytes and CCleaner. Zit. Run Avast in the Boot-time mode. Clean. Contact Avast about how to reinstall Avast after I wipe the drive. They say, first run HighJackThis and send the log. I did. They find a couple of things to remove, which I did, twice. No improvement. A day or so later Avast gets whacked. Can’t start Avast, can’t fix Avast. It be dead. But I can start system in the Safe Mode. I disconnect the system from Internet, and now the problem has provoked my stubborn side. I wipe Avast and IE8 and assume that IE3 is still in the system if Iâ€™m ever able to reconnect. Windows Defender finds nothing. Malewarebytes finds minor stuff. Windows Firewall is non-functional because it can’t find the net. I post my intro on WindowsBBS and receive specific instructions to follow -- what to load, run and post. Here’s the summary of my actions after receiving WindowsBBS instructions: 1)Downloaded and ran TFC file. Restarted computer and worked through Task Manager to desktop screen. 2)Reran Malwarebytes. Log attached. 3)Downloaded and ran GMER.exe. Log attached. I actually ran GMER before I reran Malwarebytes. When I tried to rerun it after running Malwarebytes, it froze. Same in the Safe Mode. It gets stuck and Iâ€™ve had to hard crash more than once. 4)Downloaded and ran MBR.exe. Log attached. 5)Downloaded dds. Ran dds and a white screen of strange symbols comes up. No cmd screen, no offer of a log. Unable to find where script blockers are active. Same results in Safe Mode and with file name changes. I expect the consensus will be, "wipe the drive." But any suggestions offered will be appreciated. Thanks, ggs

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5214

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

12/17/2010 9:20:59 PM
mbam-log-2010-12-17 (21-20-59).txt

Scan type: Full scan (C:\|)
Objects scanned: 285548
Time elapsed: 59 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Start (PUM.Disabled.Cryptsvc) -> Bad: (4) Good: (2) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15530 - http://www.gmer.net
Autostart scan 2010-12-17 22:27:16
Windows 5.1.2600 Service Pack 3

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon >>>
@UserinitC:\WINDOWS\system32\userinit.exe, = C:\WINDOWS\system32\userinit.exe,
@Taskman /*file not found*/ = /*file not found*/

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
dimsntfy@DLLName = %SystemRoot%\System32\dimsntfy.dll
WgaLogon@DLLName = WgaLogon.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
Creative Service for CDROM Access@ = C:\WINDOWS\System32\CTsvcCDA.EXE
ScsiPort@ = %SystemRoot%\system32\drivers\scsiport.sys

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@MSConfigC:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto = C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
@Windows Defender "C:\Program Files\Windows Defender\MSASCui.exe" -hide = "C:\Program Files\Windows Defender\MSASCui.exe" -hide
@Synchronization Manager%SystemRoot%\system32\mobsync.exe /logon = %SystemRoot%\system32\mobsync.exe /logon
@MSN Toolbar "C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe" = "C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe "
@Microsoft Default Manager "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume = "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
@LTWinModem1ltmsg.exe 9 = ltmsg.exe 9
@HP Software UpdateC:\Program Files\HP\HP Software Update\HPWuSchd2.exe = C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
@AdaptecDirectCD "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" = "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe "

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@swg "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
@ctfmon.exeC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad@WPDShServiceObj = C:\WINDOWS\system32\WPDShServiceObj.dll

HKLM\Software\Classes\.scr@ = C:\WINDOWS\NOTEPAD.EXE "%1 "

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks@{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} = C:\PROGRA~1\WIFD1F~1\MpShHook.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web Folders*/C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL = C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL
@{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} /*Shell Extensions for RealOne Player*/C:\Program Files\Real\RealPlayer\rpshell.dll = C:\Program Files\Real\RealPlayer\rpshell.dll
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/C:\WINDOWS\system32\twext.dll = C:\WINDOWS\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/C:\WINDOWS\system32\twext.dll = C:\WINDOWS\system32\twext.dll
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\system32\extmgr.dll = C:\WINDOWS\system32\extmgr.dll
@{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /*IE Microsoft BrowserBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /*IE Fade Task*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{205D7A97-F16D-4691-86EF-F3075DCCA57D} /*IE Menu Desk Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3028902F-6374-48b2-8DC6-9725E775B926} /*IE AutoComplete*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*IE Search Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*The Internet*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{43886CD5-6529-41c4-A707-7B3C92C05E68} /*IE Navigation Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{44C76ECD-F7FA-411c-9929-1B77BA77F524} /*IE Menu Site*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{4B78D326-D922-44f9-AF2A-07805C2A3560} /*IE Menu Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /*IE Microsoft History AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /*IE Tracking Shell Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6CF48EF8-44CD-45d2-8832-A16EA016311B} /*IE IShellFolderBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{73CFD649-CD48-4fd8-A272-2070EA56526B} /*IE BandProxy*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /*IE MRU AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /*IE RSS Feeder Folder*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /*IE Microsoft Shell Folder AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{B31C5FAE-961F-415b-BAF0-E697A5178B94} /*IE Microsoft Multiple AutoComplete List Container*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /*Microsoft Browser Architecture*/(null) =
@{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /*IE Shell Rebar BandSite*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E6EE9AAC-F76B-4947-8260-A9F136138E11} /*IE Shell Band Site Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F2CF5485-4E02-4f68-819C-B92DE9277049} /*&Links*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /*IE Registry Tree Options Utility*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /*IE User Assist*/(null) =
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /*IE Custom MRU AutoCompleted List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*History*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{35786D3C-B075-49b9-88DD-029876E11C01} /*Portable Devices*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} /*Portable Devices Menu*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{e82a2d71-5b2f-43a0-97b8-81be15854de8} /*ShellLink for Application References*/c:\WINDOWS\system32\dfshim.dll = c:\WINDOWS\system32\dfshim.dll
@{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} /*Shell Icon Handler for Application References*/c:\WINDOWS\system32\dfshim.dll = c:\WINDOWS\system32\dfshim.dll
@{45670FA8-ED97-4F44-BC93-305082590BFB} /*Microsoft.XPS.Shell.Metadata.1*/%SystemRoot%\System32\XPSSHHDR.DLL = %SystemRoot%\System32\XPSSHHDR.DLL
@{44121072-A222-48f2-A58A-6D9AD51EBBE9} /*Microsoft.XPS.Shell.Thumbnail.1*/%SystemRoot%\System32\XPSSHHDR.DLL = %SystemRoot%\System32\XPSSHHDR.DLL
@{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} /*Microsoft Office OneNote Namespace Extension for Windows Desktop Search*/C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL = C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office\Office12\msohevi.dll = C:\Program Files\Microsoft Office\Office12\msohevi.dll
@{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} /*Microsoft Office Metadata Handler*/C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
@{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} /*Microsoft Office Thumbnail Handler*/C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
@{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE} /*snxPluginShell extension*/(null) =

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\MBAMShlExt@{57CE581A-0CB6-4266-9CA0-19364C90A0B3} = C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{02478D38-C3F9-4efb-9B51-7695ECA05670}C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll = C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
@{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll = C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll = C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
@{9030D464-4C02-4ABF-8ECC-5164760863C6}C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
@{AA58ED58-01DD-4d91-8333-CF10577473F7}C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll = C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
@{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll = C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
@{d2ce3e00-f94a-4740-988e-03dc2f38c34f}C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\npwinext.dll = C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\npwinext.dll

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = /*file not found*/

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Start Pagehttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://att.my.yahoo.com/ = http://att.my.yahoo.com/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\System32\ITSS.DLL
lid@CLSID = C:\WINDOWS\System32\msvidctl.dll
mctp@CLSID = C:\Program Files\Microsoft ActiveSync\aatp.dll
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-help@CLSID = C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
ms-its@CLSID = C:\WINDOWS\System32\ITSS.DLL
ms-itss@CLSID = C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll

HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID = C:\WINDOWS\System32\wiascr.dll

C:\Documents and Settings\Chub\Start Menu\Programs\Startup = DESKTOP.INI

C:\Documents and Settings\All Users\Start Menu\Programs\Startup = DESKTOP.INI

---- EOF - GMER 1.0.15 ----

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000007d

Kernel Drivers (total 173):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0x832A2000 \WINDOWS\system32\KDCOM.DLL
0xF8A0A000 \WINDOWS\system32\BOOTVID.dll
0xF85A7000 ACPI.sys
0xF8AF6000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF8596000 pci.sys
0xF85F6000 isapnp.sys
0xF8BBE000 pciide.sys
0xF8876000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF8AF8000 aliide.sys
0xF8AFA000 cmdide.sys
0xF8AFC000 toside.sys
0xF8AFE000 viaide.sys
0xF8B00000 intelide.sys
0xF8606000 MountMgr.sys
0xF8577000 ftdisk.sys
0xF887E000 PartMgr.sys
0xF8616000 VolSnap.sys
0xF8A0E000 cpqarray.sys
0xF855F000 \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
0xF8547000 atapi.sys
0xF8A12000 aha154x.sys
0xF8886000 sparrow.sys
0xF8626000 aic78xx.sys
0xF8A16000 dac960nt.sys
0xF8636000 ql10wnt.sys
0xF8A1A000 amsint.sys
0xF888E000 asc.sys
0xF8A1E000 asc3550.sys
0xF8896000 mraid35x.sys
0xF889E000 i2omp.sys
0xF8A22000 ini910u.sys
0xF8646000 ql1240.sys
0xF8656000 aic78u2.sys
0xF88A6000 symc8xx.sys
0xF88AE000 sym_u3.sys
0xF88B6000 sym_hi.sys
0xF88BE000 ABP480N5.SYS
0xF88C6000 asc3350p.sys
0xF8B02000 cd20xrnt.sys
0xF8666000 ultra.sys

broni · 2010/12/21

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

==============================================================

MBRCheck log is incomplete, but we won't worry about it for now.

Download TDSSKiller and save it to your desktop.

Extract (unzip) its contents to your desktop.

Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

It may ask you to reboot the computer to complete the process. Click on Reboot Now.

If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.

If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

ggs · 2010/12/22

broni:
I downloaded and ran TDSSKiller. It found a bug. On restart, desktop came up for first time in three weeks. I restarted again to double check. Same results. The TDSSKiller report is attached. In your initial response you noted that the MBRCheck report was incomplete. My cut-and-paste goof. The complete MBRCheck report is also attached. I've downloaded IE8 for reinstallation when you bless it. Infected computer is still physically disconnected from the net. Although I didn't post one of those smiley faces with this response, I am wearing a big grin. Thanks, ggs

2010/12/22 12:05:46.0703 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
2010/12/22 12:05:46.0703 ================================================================================
2010/12/22 12:05:46.0703 SystemInfo:
2010/12/22 12:05:46.0703
2010/12/22 12:05:46.0703 OS Version: 5.1.2600 ServicePack: 3.0
2010/12/22 12:05:46.0703 Product type: Workstation
2010/12/22 12:05:46.0703 ComputerName: PITA1
2010/12/22 12:05:46.0703 UserName: Chub
2010/12/22 12:05:46.0703 Windows directory: C:\WINDOWS
2010/12/22 12:05:46.0703 System windows directory: C:\WINDOWS
2010/12/22 12:05:46.0703 Processor architecture: Intel x86
2010/12/22 12:05:46.0703 Number of processors: 1
2010/12/22 12:05:46.0703 Page size: 0x1000
2010/12/22 12:05:46.0703 Boot type: Normal boot
2010/12/22 12:05:46.0703 ================================================================================
2010/12/22 12:05:46.0968 Initialize success
2010/12/22 12:05:52.0343 ================================================================================
2010/12/22 12:05:52.0343 Scan started
2010/12/22 12:05:52.0343 Mode: Manual;
2010/12/22 12:05:52.0343 ================================================================================
2010/12/22 12:05:54.0031 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2010/12/22 12:05:54.0437 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
2010/12/22 12:05:54.0968 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/12/22 12:05:55.0390 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/12/22 12:05:55.0859 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2010/12/22 12:05:56.0281 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/12/22 12:05:56.0859 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/12/22 12:05:57.0328 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2010/12/22 12:05:57.0765 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2010/12/22 12:05:58.0187 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2010/12/22 12:05:58.0578 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2010/12/22 12:05:59.0046 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2010/12/22 12:05:59.0421 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2010/12/22 12:05:59.0875 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2010/12/22 12:06:00.0265 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2010/12/22 12:06:00.0656 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2010/12/22 12:06:01.0078 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2010/12/22 12:06:01.0453 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2010/12/22 12:06:01.0906 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2010/12/22 12:06:02.0312 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/12/22 12:06:02.0734 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/12/22 12:06:03.0500 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/12/22 12:06:03.0968 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/12/22 12:06:04.0328 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/12/22 12:06:04.0718 bvrp_pci (c043ca48f1f5c00ff8272180fbbd15e9) C:\WINDOWS\system32\drivers\bvrp_pci.sys
2010/12/22 12:06:05.0234 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2010/12/22 12:06:05.0593 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/12/22 12:06:06.0062 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2010/12/22 12:06:06.0437 CdaC15BA (69419792390122eefd84e598d896715b) C:\WINDOWS\System32\drivers\CdaC15BA.SYS
2010/12/22 12:06:06.0875 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/12/22 12:06:07.0359 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/12/22 12:06:07.0734 Cdr4_xp (bf79e659c506674c0497cc9c61f1a165) C:\WINDOWS\system32\drivers\Cdr4_xp.sys
2010/12/22 12:06:08.0203 Cdralw2k (2c41cd49d82d5fd85c72d57b6ca25471) C:\WINDOWS\system32\drivers\Cdralw2k.sys
2010/12/22 12:06:08.0609 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/12/22 12:06:09.0125 cdudf_xp (5b20a47b0413240cdb93106bd58602a1) C:\WINDOWS\system32\drivers\cdudf_xp.sys
2010/12/22 12:06:09.0937 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2010/12/22 12:06:10.0375 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2010/12/22 12:06:10.0765 ctljystk (71007bd2e1e26927fe3e4eb00c0beedf) C:\WINDOWS\system32\DRIVERS\ctljystk.sys
2010/12/22 12:06:11.0265 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2010/12/22 12:06:11.0656 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2010/12/22 12:06:12.0171 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/12/22 12:06:12.0546 DM9102 (51ef6ca3d57055fed6ab99021d562443) C:\WINDOWS\system32\DRIVERS\DM9PCI5.SYS
2010/12/22 12:06:13.0234 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2010/12/22 12:06:13.0921 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2010/12/22 12:06:14.0406 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/12/22 12:06:14.0812 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/12/22 12:06:15.0343 Dot4 (3e4b043f8bc6be1d4820cc6c9c500306) C:\WINDOWS\system32\DRIVERS\Dot4.sys
2010/12/22 12:06:15.0812 Dot4Print (77ce63a8a34ae23d9fe4c7896d1debe7) C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys
2010/12/22 12:06:16.0250 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2010/12/22 12:06:16.0625 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/12/22 12:06:17.0093 dvd_2K (3677e155d87dda2bc53142d7d234d12a) C:\WINDOWS\system32\drivers\dvd_2K.sys
2010/12/22 12:06:18.0140 emu10k (ae4e46d96e9d33790c8617e36791b576) C:\WINDOWS\system32\drivers\emu10k1f.sys
2010/12/22 12:06:18.0781 emu10k1 (aadc81e967c25dd7c90e150fec6eab74) C:\WINDOWS\system32\drivers\ctlface.sys
2010/12/22 12:06:19.0265 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/12/22 12:06:19.0750 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/12/22 12:06:20.0171 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2010/12/22 12:06:20.0593 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/12/22 12:06:21.0046 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2010/12/22 12:06:21.0500 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/12/22 12:06:21.0953 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/12/22 12:06:22.0375 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2010/12/22 12:06:22.0828 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/12/22 12:06:23.0312 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/12/22 12:06:23.0781 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2010/12/22 12:06:24.0203 hpt3xx (b077b7f8e79779ea967e84a4fc040227) C:\WINDOWS\system32\DRIVERS\hpt3xx.sys
2010/12/22 12:06:24.0656 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2010/12/22 12:06:25.0093 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2010/12/22 12:06:25.0515 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2010/12/22 12:06:26.0046 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/12/22 12:06:26.0531 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2010/12/22 12:06:27.0000 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2010/12/22 12:06:27.0453 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/12/22 12:06:27.0921 Imapi (52fa4d5bf104c7b02adc49c414b484ed) C:\WINDOWS\system32\drivers\ImapiRox.sys
2010/12/22 12:06:28.0343 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2010/12/22 12:06:28.0765 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2010/12/22 12:06:29.0234 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/12/22 12:06:29.0687 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2010/12/22 12:06:30.0156 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/12/22 12:06:30.0578 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/12/22 12:06:31.0078 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/12/22 12:06:31.0515 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/12/22 12:06:32.0031 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/12/22 12:06:32.0453 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/12/22 12:06:32.0890 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/12/22 12:06:33.0375 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/12/22 12:06:33.0921 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/12/22 12:06:34.0343 l8042pr2 (80794cc09e6aea4c10ec35ae6ba86ad4) C:\WINDOWS\system32\DRIVERS\L8042Pr2.sys
2010/12/22 12:06:35.0218 LHidFlt2 (9de00e4938d396384504af5ddcc45770) C:\WINDOWS\system32\DRIVERS\LHidFlt2.sys
2010/12/22 12:06:35.0656 LHidUsb (a7ac5b2ad8cb4fb486eb9c5d0554da58) C:\WINDOWS\system32\drivers\LHidUsb.Sys
2010/12/22 12:06:36.0140 LKbdFlt2 (b3e69110fba2c07b634e6bf20fe9f9ac) C:\WINDOWS\system32\DRIVERS\LKbdFlt2.sys
2010/12/22 12:06:36.0562 LMouFlt2 (6d8f6f74341d804a2552d5c6edc98cb9) C:\WINDOWS\system32\DRIVERS\LMouFlt2.sys
2010/12/22 12:06:37.0218 ltmodem5 (e9ebe8ccd1e5b3ca2ddf1765147caca0) C:\WINDOWS\system32\DRIVERS\ltmdmxp.sys
2010/12/22 12:06:37.0640 mmc_2K (a54fd7e564c996cfcee6ee7491f3c318) C:\WINDOWS\system32\drivers\mmc_2K.sys
2010/12/22 12:06:38.0109 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/12/22 12:06:38.0531 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2010/12/22 12:06:38.0953 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/12/22 12:06:39.0437 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/12/22 12:06:39.0843 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/12/22 12:06:40.0343 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/12/22 12:06:40.0734 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2010/12/22 12:06:41.0203 mrtRate (a7566da7aa8b74f1cebc18afd6b6cfa0) C:\WINDOWS\system32\drivers\mrtRate.sys
2010/12/22 12:06:41.0640 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/12/22 12:06:42.0281 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/12/22 12:06:42.0796 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/12/22 12:06:43.0234 Msikbd2k (877ffd0fb093b80f5ed6ba64d7921881) C:\WINDOWS\system32\DRIVERS\msikbd2k.sys
2010/12/22 12:06:43.0625 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/12/22 12:06:44.0078 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/12/22 12:06:44.0500 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/12/22 12:06:44.0875 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/12/22 12:06:45.0343 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/12/22 12:06:45.0750 MxlW2k (19dd5c581eef70134ccef87d626f4417) C:\WINDOWS\system32\drivers\MxlW2k.sys
2010/12/22 12:06:46.0250 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/12/22 12:06:46.0671 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/12/22 12:06:47.0171 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/12/22 12:06:47.0593 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/12/22 12:06:48.0015 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/12/22 12:06:48.0500 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/12/22 12:06:48.0953 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/12/22 12:06:49.0515 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/12/22 12:06:50.0078 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/12/22 12:06:50.0656 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/12/22 12:06:51.0687 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2010/12/22 12:06:52.0890 nv4 (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2010/12/22 12:06:53.0328 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/12/22 12:06:53.0765 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/12/22 12:06:54.0250 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
2010/12/22 12:06:54.0734 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/12/22 12:06:55.0156 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/12/22 12:06:55.0609 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/12/22 12:06:56.0031 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/12/22 12:06:56.0812 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/12/22 12:06:57.0296 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/12/22 12:06:59.0296 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2010/12/22 12:06:59.0750 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2010/12/22 12:07:00.0140 PfModNT (2f5532f9b0f903b26847da674b4f55b2) C:\WINDOWS\System32\PfModNT.sys
2010/12/22 12:07:00.0781 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/12/22 12:07:01.0218 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2010/12/22 12:07:01.0671 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/12/22 12:07:02.0078 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/12/22 12:07:02.0515 pwd_2K (dd37e1d9f08eec0cb0fc84e010f33c3b) C:\WINDOWS\system32\drivers\pwd_2K.sys
2010/12/22 12:07:02.0937 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2010/12/22 12:07:03.0343 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2010/12/22 12:07:03.0781 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2010/12/22 12:07:04.0171 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2010/12/22 12:07:04.0609 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2010/12/22 12:07:05.0015 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/12/22 12:07:05.0468 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/12/22 12:07:05.0937 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/12/22 12:07:06.0343 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/12/22 12:07:06.0796 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/12/22 12:07:07.0296 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/12/22 12:07:07.0765 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/12/22 12:07:08.0328 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/12/22 12:07:08.0812 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/12/22 12:07:09.0406 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/12/22 12:07:09.0890 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/12/22 12:07:10.0328 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/12/22 12:07:10.0765 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/12/22 12:07:11.0218 sfman (28b740a66cb88be3d0cd93d5664d7d88) C:\WINDOWS\system32\drivers\sfman.sys
2010/12/22 12:07:12.0093 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2010/12/22 12:07:12.0531 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2010/12/22 12:07:12.0921 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/12/22 12:07:13.0406 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/12/22 12:07:13.0906 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/12/22 12:07:14.0484 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/12/22 12:07:14.0890 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/12/22 12:07:15.0375 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2010/12/22 12:07:15.0781 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2010/12/22 12:07:16.0218 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2010/12/22 12:07:16.0625 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2010/12/22 12:07:17.0031 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/12/22 12:07:17.0656 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/12/22 12:07:18.0187 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/12/22 12:07:18.0625 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/12/22 12:07:19.0046 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/12/22 12:07:19.0531 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2010/12/22 12:07:19.0984 UdfReadr_xp (3af8116d049e6f98a6d37913da989984) C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
2010/12/22 12:07:20.0531 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/12/22 12:07:20.0953 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2010/12/22 12:07:21.0562 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/12/22 12:07:22.0140 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/12/22 12:07:22.0640 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/12/22 12:07:23.0078 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/12/22 12:07:23.0531 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/12/22 12:07:23.0937 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/12/22 12:07:24.0390 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/12/22 12:07:24.0781 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/12/22 12:07:25.0187 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2010/12/22 12:07:25.0656 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2010/12/22 12:07:26.0062 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/12/22 12:07:26.0546 vsdatant (1b648150030fad2f07ba2ee7bb94cd25) C:\WINDOWS\system32\vsdatant.sys
2010/12/22 12:07:27.0203 wacommousefilter (427a8bc96f16c40df81c2d2f4edd32dd) C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys
2010/12/22 12:07:27.0671 wacomvhid (51d580f30d1a1f2ea4965af6abc2bcb2) C:\WINDOWS\system32\DRIVERS\wacomvhid.sys
2010/12/22 12:07:28.0062 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/12/22 12:07:28.0546 wanatw (ba1d9278448cb26152a18b6a06b61ea3) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
2010/12/22 12:07:28.0984 wceusbsh (4c0b8ef721783f52f8e531fbdc4b1f74) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
2010/12/22 12:07:29.0843 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/12/22 12:07:30.0437 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/12/22 12:07:30.0937 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/12/22 12:07:31.0031 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/12/22 12:07:31.0203 ================================================================================
2010/12/22 12:07:31.0203 Scan finished
2010/12/22 12:07:31.0203 ================================================================================
2010/12/22 12:07:31.0218 Detected object count: 1
2010/12/22 12:08:15.0062 \HardDisk0 - will be cured after reboot
2010/12/22 12:08:15.0062 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2010/12/22 12:09:13.0015 Deinitialize success

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000007d

Kernel Drivers (total 174):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0x832A7000 \WINDOWS\system32\KDCOM.DLL
0xF8A0A000 \WINDOWS\system32\BOOTVID.dll
0xF85A7000 ACPI.sys
0xF8AF6000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF8596000 pci.sys
0xF85F6000 isapnp.sys
0xF8BBE000 pciide.sys
0xF8876000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF8AF8000 aliide.sys
0xF8AFA000 cmdide.sys
0xF8AFC000 toside.sys
0xF8AFE000 viaide.sys
0xF8B00000 intelide.sys
0xF8606000 MountMgr.sys
0xF8577000 ftdisk.sys
0xF887E000 PartMgr.sys
0xF8616000 VolSnap.sys
0xF8A0E000 cpqarray.sys
0xF855F000 \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
0xF8547000 atapi.sys
0xF8A12000 aha154x.sys
0xF8886000 sparrow.sys
0xF8626000 aic78xx.sys
0xF8A16000 dac960nt.sys
0xF8636000 ql10wnt.sys
0xF8A1A000 amsint.sys
0xF888E000 asc.sys
0xF8A1E000 asc3550.sys
0xF8896000 mraid35x.sys
0xF889E000 i2omp.sys
0xF8A22000 ini910u.sys
0xF8646000 ql1240.sys
0xF8656000 aic78u2.sys
0xF88A6000 symc8xx.sys
0xF88AE000 sym_u3.sys
0xF88B6000 sym_hi.sys
0xF88BE000 ABP480N5.SYS
0xF88C6000 asc3350p.sys
0xF8B02000 cd20xrnt.sys
0xF8666000 ultra.sys
0xF8676000 hpt3xx.sys
0xF88CE000 dpti2o.sys
0xF852E000 adpu160m.sys
0xF8686000 ql1080.sys
0xF8696000 ql1280.sys
0xF86A6000 ql12160.sys
0xF8A26000 cbidf2k.sys
0xF8502000 dac2w2k.sys
0xF88D6000 hpn.sys
0xF88DE000 perc2.sys
0xF8B04000 perc2hib.sys
0xF86B6000 disk.sys
0xF86C6000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF84E2000 fltmgr.sys
0xF84D0000 sr.sys
0xF84B9000 KSecDD.sys
0xF842C000 Ntfs.sys
0xF83FF000 NDIS.sys
0xF86D6000 sisagp.sys
0xF86E6000 viaagp.sys
0xF83E5000 Mup.sys
0xF86F6000 agp440.sys
0xF8706000 alim1541.sys
0xF8716000 amdagp.sys
0xF8726000 agpCPQ.sys
0xF8796000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF735F000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xF734B000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF728D000 \SystemRoot\system32\drivers\emu10k1f.sys
0xF7269000 \SystemRoot\system32\drivers\portcls.sys
0xF87A6000 \SystemRoot\system32\drivers\drmk.sys
0xF7246000 \SystemRoot\system32\drivers\ks.sys
0xF87B6000 \SystemRoot\system32\drivers\sfman.sys
0xF8B68000 \SystemRoot\system32\drivers\ctlface.sys
0xF8CBF000 \SystemRoot\System32\DRIVERS\ctljystk.sys
0xF7C26000 \SystemRoot\System32\DRIVERS\gameenum.sys
0xF71A9000 \SystemRoot\System32\DRIVERS\ltmdmxp.sys
0xF8926000 \SystemRoot\System32\Drivers\Modem.SYS
0xF892E000 \SystemRoot\System32\DRIVERS\DM9PCI5.SYS
0xF8936000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF87C6000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF8B6A000 \SystemRoot\System32\DRIVERS\LKbdFlt2.sys
0xF8B6C000 \SystemRoot\System32\DRIVERS\msikbd2k.sys
0xF893E000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF87D6000 \SystemRoot\System32\DRIVERS\LMouFlt2.sys
0xF8946000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF87E6000 \SystemRoot\System32\DRIVERS\serial.sys
0xF7C22000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF7195000 \SystemRoot\System32\DRIVERS\parport.sys
0xF894E000 \SystemRoot\system32\drivers\ImapiRox.sys
0xF8956000 \SystemRoot\System32\Drivers\MxlW2k.SYS
0xF8866000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF7D4C000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF7182000 \SystemRoot\System32\Drivers\pwd_2K.SYS
0xF895E000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF715E000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF7C1A000 \SystemRoot\system32\DRIVERS\wacomvhid.sys
0xF7D3C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF8966000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF8CCD000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF7D2C000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF7C16000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF7147000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF7D1C000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF7D0C000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF896E000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF7136000 \SystemRoot\System32\DRIVERS\psched.sys
0xF7CFC000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF8976000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF897E000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF7CEC000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF8B6E000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF70D8000 \SystemRoot\System32\DRIVERS\update.sys
0xF8ACE000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF8986000 \SystemRoot\System32\Drivers\mmc_2K.SYS
0xF7CDC000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF8B70000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF8ABA000 \SystemRoot\System32\DRIVERS\mouhid.sys
0xF7577000 \SystemRoot\system32\DRIVERS\wacommousefilter.sys
0xF7CCC000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF83BD000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF89F6000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF83A5000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF8CF2000 \SystemRoot\System32\Drivers\Cdr4_xp.SYS
0xF8CFC000 \SystemRoot\System32\Drivers\Cdralw2k.SYS
0xF8BA8000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8CFD000 \SystemRoot\System32\Drivers\Null.SYS
0xF8BAA000 \SystemRoot\System32\Drivers\Beep.SYS
0xF88F6000 \SystemRoot\System32\drivers\vga.sys
0xF8BAC000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8BAE000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF88FE000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF890E000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF3C81000 \SystemRoot\System32\Drivers\UdfReadr_xp.SYS
0xF8AAA000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF3C34000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF3BDB000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF3BB3000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF3B91000 \SystemRoot\System32\drivers\afd.sys
0xF563F000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF3B66000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF7C2E000 \SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS
0xF3AF6000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF560F000 \SystemRoot\System32\Drivers\Fips.SYS
0xF3AD0000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF55FF000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF27A6000 \SystemRoot\System32\DRIVERS\usbccgp.sys
0xF279E000 \SystemRoot\System32\DRIVERS\USBSTOR.SYS
0xF2796000 \SystemRoot\System32\DRIVERS\usbprint.sys
0xECF77000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xECF5F000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8BA4000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEE109000 \SystemRoot\System32\drivers\Dxapi.sys
0xEEC9C000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xEEC0C000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xEF874000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xED0BF000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF27FA000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEB80B000 \??\C:\WINDOWS\System32\drivers\CdaC15BA.SYS
0xECFEF000 \SystemRoot\System32\DRIVERS\srv.sys
0xED09B000 \SystemRoot\System32\Drivers\mrtRate.SYS
0xF235C000 \??\C:\WINDOWS\System32\PfModNT.sys
0xEDDBB000 \SystemRoot\system32\drivers\wdmaud.sys
0xF3531000 \SystemRoot\system32\drivers\sysaudio.sys
0xEBFFE000 \SystemRoot\System32\Drivers\HTTP.sys
0xECFEB000 \SystemRoot\System32\DRIVERS\asyncmac.sys
0xEBCED000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll

Processes (total 44):
0 System Idle Process
4 System
448 C:\WINDOWS\SYSTEM32\smss.exe
512 csrss.exe
536 C:\WINDOWS\SYSTEM32\winlogon.exe
584 C:\WINDOWS\SYSTEM32\services.exe
596 C:\WINDOWS\SYSTEM32\lsass.exe
784 C:\WINDOWS\SYSTEM32\svchost.exe
880 svchost.exe
932 C:\Program Files\Windows Defender\MsMpEng.exe
980 C:\WINDOWS\SYSTEM32\svchost.exe
1028 C:\Program Files\WTouch\WTouchService.exe
1196 svchost.exe
1268 svchost.exe
1360 C:\WINDOWS\SYSTEM32\spoolsv.exe
1472 svchost.exe
1516 C:\WINDOWS\Nhksrv.exe
1544 C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE
1564 C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE
1632 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
1736 C:\WINDOWS\SYSTEM32\svchost.exe
1804 C:\WINDOWS\SYSTEM32\svchost.exe
1900 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
1960 C:\WINDOWS\SYSTEM32\svchost.exe
2004 C:\WINDOWS\SYSTEM32\Pen_Tablet.exe
120 C:\WINDOWS\SYSTEM32\ups.exe
204 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
408 C:\WINDOWS\SYSTEM32\MsPMSPSv.exe
836 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
1040 alg.exe
3176 C:\Program Files\WTouch\WTouchUser.exe
3336 C:\WINDOWS\SYSTEM32\WTablet\Pen_TabletUser.exe
3364 C:\WINDOWS\SYSTEM32\Pen_Tablet.exe
3536 C:\WINDOWS\SYSTEM32\devldr32.exe
3560 C:\WINDOWS\explorer.exe
3932 C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe
248 C:\WINDOWS\SYSTEM32\WISPTIS.EXE
1276 C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
664 C:\WINDOWS\SYSTEM32\ltmsg.exe
1952 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
1552 C:\WINDOWS\SYSTEM32\ctfmon.exe
2696 C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
3852 C:\WINDOWS\notepad.exe
1384 G:\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`01f60800 (NTFS)

PhysicalDrive0 Model Number: MAXTOR6L040J2, Rev: A93.0500

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!

broni · 2010/12/22

Good news

MBRCheck log looks good

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.pif
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

ggs · 2010/12/22

broni:
I'll download ComboFix shortly. But before I run it, I got questions: 1)Malwarebytes is running and I don't know how to turn it off; delete? 2)CCleaner is on but doesn't seem to run until told to, but is it a potential problem? 3)Script blocking has me concerned. DDS wouldn't run. Where do you suggest I look to turn the blocking off? 4)With the gain today on Rootkit.Win32, would it hurt anything if I tried to run DDS again? I'm still grinnin'. Thanks, ggs

broni · 2010/12/22

DDS is just a scanner, so no need to re-run it.
It's also not active, as well, as CCleaner.
Don't worry about running MBAM.

Go ahead with Combofix.

ggs · 2010/12/23

ComboFix Logs

Broni:
ComboFix starts out fine, then it runs into Avast, which I deleted two weeks ago. With warning bloc on the screen, I fish out all the Avast files and delete them. A couple of files refuse to be deleted, but they seem unimportant, so I stupidly use the mouse to keep going. Then ComboFix says it needs to get to the net to update; so I stupidly make the physical internet connection, which immediately results in three minutes of max cpu buzz. I disconnect the internet, and ComboFix keeps on kepping on, giving me Log-1 attached. I run ComboFix again, ignoring its Avast objections. The result is Log #2. The difference in the logs seems to be the "Other Deletions" in Log 1 and no files deleted in Log 2. Both Logs 1 & 2 are attached. To play it safe, I ran ComboFix a couple of more times. Same results, "Other Deletions" in one log and not in the other. I'm still grinnin', but what made you suspect that RootKit.Win32 was the culprit?. Thanks, ggs

Log #1
ComboFix 10-12-22.01 - Chub 12/22/2010 21:49:08.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.148 [GMT -5:00]
Running from: c:\documents and settings\Chub\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Chub\Local Settings\Application Data\{609CF68F-7901-4A35-957F-271C48CCF3F8}
c:\documents and settings\Chub\Local Settings\Application Data\{609CF68F-7901-4A35-957F-271C48CCF3F8}\chrome.manifest
c:\documents and settings\Chub\Local Settings\Application Data\{609CF68F-7901-4A35-957F-271C48CCF3F8}\chrome\content\_cfg.js
c:\documents and settings\Chub\Local Settings\Application Data\{609CF68F-7901-4A35-957F-271C48CCF3F8}\chrome\content\overlay.xul
c:\documents and settings\Chub\Local Settings\Application Data\{609CF68F-7901-4A35-957F-271C48CCF3F8}\install.rdf
c:\documents and settings\Tim\Local Settings\Application Data\{246FA755-C714-4A9F-96E4-0B6D209EEA07}
c:\documents and settings\Tim\Local Settings\Application Data\{246FA755-C714-4A9F-96E4-0B6D209EEA07}\chrome.manifest
c:\documents and settings\Tim\Local Settings\Application Data\{246FA755-C714-4A9F-96E4-0B6D209EEA07}\chrome\content\_cfg.js
c:\documents and settings\Tim\Local Settings\Application Data\{246FA755-C714-4A9F-96E4-0B6D209EEA07}\chrome\content\overlay.xul
c:\documents and settings\Tim\Local Settings\Application Data\{246FA755-C714-4A9F-96E4-0B6D209EEA07}\install.rdf
c:\program files\Internet Explorer\iexplore.exe.tmp
c:\windows\Downloaded Program Files\ocget.dll
c:\windows\oxozikequw.dll
c:\windows\patch.exe
c:\windows\system\oeminfo.ini
c:\windows\system32\chknatch.dll
c:\windows\system32\images
c:\windows\system32\images\FGWinNT_ToolBar_eng.gif
c:\windows\system32\images\FGWinNT_ToolBar_kor.gif
c:\windows\system32\images\FGWinNT_Tray_eng.bmp
c:\windows\system32\images\FGWinNT_Tray_kor.gif
c:\windows\system32\images\FGWinNT_View_eng.jpg
c:\windows\system32\images\FGWinNT_View_kor.jpg
c:\windows\system32\images\RUN_ENG.JPG
c:\windows\system32\images\RUN_KOR.JPG
c:\windows\system32\images\toolbar_eng.jpg
c:\windows\system32\images\toolbar_kor.jpg
c:\windows\system32\Oeminfo.ini

.
((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
.

2010-12-18 02:40 . 2010-12-18 02:40 -------- d-----w- c:\documents and settings\Guest\Application Data\Malwarebytes
2010-12-11 03:25 . 2010-12-11 03:26 -------- d-----w- c:\program files\Windows Defender
2010-12-09 01:47 . 2010-12-09 01:47 -------- d-----w- c:\documents and settings\Default User\Application Data\WTouch
2010-12-09 01:44 . 2010-12-09 01:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Max Secure
2010-12-06 20:17 . 2010-12-06 20:17 -------- d-----w- c:\documents and settings\Chub\Application Data\DriverCure
2010-12-06 20:17 . 2010-12-06 20:17 -------- d-----w- c:\documents and settings\Chub\Application Data\ParetoLogic
2010-12-06 20:16 . 2010-12-06 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-12-06 14:13 . 2002-01-08 22:00 176128 ----a-w- c:\windows\system32\RcdScan.dll
2010-12-06 14:13 . 1999-05-07 18:24 414944 ----a-w- c:\windows\system32\COMCT332.OCX
2010-12-06 14:13 . 1998-11-10 15:46 328480 ----a-w- c:\windows\system32\ssa3d30.ocx
2010-12-03 17:50 . 2010-12-03 18:06 -------- d-----w- c:\documents and settings\Tim
2010-12-03 04:48 . 2010-12-03 04:49 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-12-03 01:11 . 2010-12-03 01:11 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-12-03 00:34 . 2010-12-15 03:12 -------- d-----w- C:\## aswSnx private storage
2010-12-02 20:44 . 2010-12-02 20:44 -------- d-----w- c:\documents and settings\Chub\Application Data\Malwarebytes
2010-12-02 20:44 . 2010-11-29 22:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-02 20:44 . 2010-12-02 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-02 20:43 . 2010-11-29 22:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-02 20:43 . 2010-12-02 20:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-02 18:28 . 2008-04-14 00:12 1033728 ----a-w- c:\windows\Copy of explorer.exe
2010-12-02 04:32 . 2010-12-03 18:31 -------- d-----w- c:\documents and settings\Administrator
2010-12-02 04:16 . 2010-12-08 13:48 0 ----a-w- c:\windows\Gwurinazob.bin
2010-12-02 04:11 . 2010-12-02 04:11 -------- d-----w- c:\windows\system32\%APPDATA%
2010-12-01 20:56 . 2010-12-01 20:56 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-23 12:56 . 2008-10-28 17:49 118272 ----a-w- c:\windows\system32\hpz3l696.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 00:52 . 2006-10-17 15:49 63839744 ----a-w- c:\program files\Common Files\TaxWise Workstation.msi
2005-06-30 21:34 . 2005-06-30 21:34 26161916 ----a-w- c:\program files\NAV05ENG.exe
2004-12-22 21:58 . 2005-01-10 22:38 18448384 ----a-w- c:\program files\Common Files\TaxWise Workstation Setup.msi
2002-03-15 21:16 . 2002-03-15 21:16 98304 ----a-w- c:\program files\internet explorer\plugins\IEHelper.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2003-01-03 02:42 . 2002-07-01 14:50 28672 c:\documents and settings\Chub\Desktop\MouseWare\system\bak\EM_EXEC.EXE

2001-09-04 21:31 . 2001-09-04 21:31 655360 c:\program files\Adaptec\Easy CD Creator 5\DirectCD\bak\DirectCD.exe
2001-09-04 19:31 . 2001-09-04 19:31 655360 c:\program files\Adaptec\Easy CD Creator 5\DirectCD\Directcd.exe

2005-06-12 22:52 . 2005-06-12 22:52 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2002-03-08 08:08 . 2001-03-28 07:00 102400 c:\program files\Creative\SBLive\Program\bak\AHQInit.exe

2006-02-19 06:41 . 2006-02-19 06:41 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe
2007-05-08 21:24 . 2007-05-08 21:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe

2007-01-23 21:23 . 2006-11-09 20:07 49263 c:\program files\Java\jre1.5.0_10\bin\bak\jusched.exe

2000-07-07 03:19 . 2000-07-07 03:19 151616 c:\program files\MacOpener\bak\MacLic.exe

2003-04-14 23:30 . 2004-10-13 16:24 1694208 c:\program files\Messenger\bak\msmsgs.exe
2008-08-23 22:41 . 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe

2003-12-25 14:34 . 2003-04-22 22:43 413775 c:\program files\Microsoft ActiveSync\bak\WCESCOMM.EXE

2005-08-24 23:25 . 2005-08-24 23:25 101080 c:\program files\Microsoft Location Finder\bak\LocationFinder.exe

2001-07-25 16:00 . 2001-07-25 16:00 241714 c:\program files\Microsoft Money\System\bak\Activation.exe

2004-02-14 03:02 . 2004-02-14 03:02 77824 c:\program files\QuickTime\bak\qttask.exe

2002-03-08 08:06 . 2001-09-23 13:14 163840 c:\windows\bak\DELLMMKB.EXE

2002-03-08 08:08 . 2000-05-11 07:00 90112 c:\windows\bak\Updreg.exe

2003-09-05 21:40 . 2004-08-04 04:56 15360 c:\windows\SYSTEM32\bak\ctfmon.exe
2003-09-05 21:40 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-14 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTWinModem1 "= "ltmsg.exe 9" [X]
"Synchronization Manager "= "c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"MSN Toolbar "= "c:\program files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe" [2010-07-06 240480]
"Microsoft Default Manager "= "c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AdaptecDirectCD "= "c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 655360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Camio Viewer 2000.lnk]
backup=c:\windows\pss\Camio Viewer 2000.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MacName.lnk]
backup=c:\windows\pss\MacName.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk]
backup=c:\windows\pss\QuickBooks 2002 Delivery Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Chub^Start Menu^Programs^Startup^PowerReg SchedulerV2.exe]
backup=c:\windows\pss\PowerReg SchedulerV2.exeStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\WINDOWS\\SYSTEM32\\mmc.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009

R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [3/14/2002 5:44 PM 34712]
R2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [8/6/2001 2:41 PM 28672]
R2 TabletServicePen;TabletServicePen;c:\windows\SYSTEM32\Pen_Tablet.exe [6/9/2010 4:24 PM 4497704]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [6/9/2010 4:25 PM 113448]
R3 Msikbd2k;DellTouch;c:\windows\SYSTEM32\DRIVERS\Msikbd2k.sys [10/3/2000 4:18 PM 6942]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/22/2010 5:19 PM 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 22:19]

2010-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 22:19]

2010-12-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.my.yahoo.com/
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE} - (no file)
AddRemove-HijackThis - G:\HijackThis.exe
AddRemove-_{53A908D4-99C6-469B-BC13-F4189F260742} - c:\program files\Corel\Corel Painter Essentials 4\MSILauncher {53A908D4-99C6-469B-BC13-F4189F260742}

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-22 22:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4233ADD3-CD31-D295-804BA870321FDEF4}\{F4A8E5F3-7E68-2DD0-FA9D328203A7D1A7}\{07380252-9142-5EC5-94F639FC4AE64832}*]
"WHRUBFTNUT3JMXQXKMKSXOBADA1 "=hex:01,00,01,00,00,00,00,00,7d,86,67,30,10,5d,1c,
b8,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2052)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\drivers\CDAC11BA.EXE
c:\windows\System32\CTsvcCDA.EXE
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\System32\MsPMSPSv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\WTouch\WTouchUser.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\WTablet\Pen_TabletUser.exe
c:\windows\system32\devldr32.exe
c:\windows\system32\ltmsg.exe
c:\windows\system32\WISPTIS.EXE
.
**************************************************************************
.
Completion time: 2010-12-22 22:24:46 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-23 03:24

Pre-Run: 9,546,985,472 bytes free
Post-Run: 10,529,357,824 bytes free

- - End Of File - - EF83CC313716BF7514518E0FB247DCF3

Log #2
ComboFix 10-12-22.01 - Chub 12/22/2010 23:21:36.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.193 [GMT -5:00]
Running from: c:\documents and settings\Chub\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
.

2010-12-18 02:40 . 2010-12-18 02:40 -------- d-----w- c:\documents and settings\Guest\Application Data\Malwarebytes
2010-12-11 03:25 . 2010-12-11 03:26 -------- d-----w- c:\program files\Windows Defender
2010-12-09 01:47 . 2010-12-09 01:47 -------- d-----w- c:\documents and settings\Default User\Application Data\WTouch
2010-12-09 01:44 . 2010-12-09 01:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Max Secure
2010-12-06 20:17 . 2010-12-06 20:17 -------- d-----w- c:\documents and settings\Chub\Application Data\DriverCure
2010-12-06 20:17 . 2010-12-06 20:17 -------- d-----w- c:\documents and settings\Chub\Application Data\ParetoLogic
2010-12-06 20:16 . 2010-12-06 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-12-06 14:13 . 2002-01-08 22:00 176128 ----a-w- c:\windows\system32\RcdScan.dll
2010-12-06 14:13 . 1999-05-07 18:24 414944 ----a-w- c:\windows\system32\COMCT332.OCX
2010-12-06 14:13 . 1998-11-10 15:46 328480 ----a-w- c:\windows\system32\ssa3d30.ocx
2010-12-03 17:50 . 2010-12-03 18:06 -------- d-----w- c:\documents and settings\Tim
2010-12-03 04:48 . 2010-12-03 04:49 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-12-03 01:11 . 2010-12-03 01:11 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-12-03 00:34 . 2010-12-15 03:12 -------- d-----w- C:\## aswSnx private storage
2010-12-02 20:44 . 2010-12-02 20:44 -------- d-----w- c:\documents and settings\Chub\Application Data\Malwarebytes
2010-12-02 20:44 . 2010-11-29 22:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-02 20:44 . 2010-12-02 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-02 20:43 . 2010-11-29 22:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-02 20:43 . 2010-12-02 20:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-02 18:28 . 2008-04-14 00:12 1033728 ----a-w- c:\windows\Copy of explorer.exe
2010-12-02 04:32 . 2010-12-03 18:31 -------- d-----w- c:\documents and settings\Administrator
2010-12-02 04:16 . 2010-12-08 13:48 0 ----a-w- c:\windows\Gwurinazob.bin
2010-12-02 04:11 . 2010-12-02 04:11 -------- d-----w- c:\windows\system32\%APPDATA%
2010-12-01 20:56 . 2010-12-01 20:56 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-23 12:56 . 2008-10-28 17:49 118272 ----a-w- c:\windows\system32\hpz3l696.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 00:52 . 2006-10-17 15:49 63839744 ----a-w- c:\program files\Common Files\TaxWise Workstation.msi
2005-06-30 21:34 . 2005-06-30 21:34 26161916 ----a-w- c:\program files\NAV05ENG.exe
2004-12-22 21:58 . 2005-01-10 22:38 18448384 ----a-w- c:\program files\Common Files\TaxWise Workstation Setup.msi
2002-03-15 21:16 . 2002-03-15 21:16 98304 ----a-w- c:\program files\internet explorer\plugins\IEHelper.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2003-01-03 02:42 . 2002-07-01 14:50 28672 c:\documents and settings\Chub\Desktop\MouseWare\system\bak\EM_EXEC.EXE

2001-09-04 21:31 . 2001-09-04 21:31 655360 c:\program files\Adaptec\Easy CD Creator 5\DirectCD\bak\DirectCD.exe
2001-09-04 19:31 . 2001-09-04 19:31 655360 c:\program files\Adaptec\Easy CD Creator 5\DirectCD\Directcd.exe

2005-06-12 22:52 . 2005-06-12 22:52 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2002-03-08 08:08 . 2001-03-28 07:00 102400 c:\program files\Creative\SBLive\Program\bak\AHQInit.exe

2006-02-19 06:41 . 2006-02-19 06:41 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe
2007-05-08 21:24 . 2007-05-08 21:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe

2007-01-23 21:23 . 2006-11-09 20:07 49263 c:\program files\Java\jre1.5.0_10\bin\bak\jusched.exe

2000-07-07 03:19 . 2000-07-07 03:19 151616 c:\program files\MacOpener\bak\MacLic.exe

2003-04-14 23:30 . 2004-10-13 16:24 1694208 c:\program files\Messenger\bak\msmsgs.exe
2008-08-23 22:41 . 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe

2003-12-25 14:34 . 2003-04-22 22:43 413775 c:\program files\Microsoft ActiveSync\bak\WCESCOMM.EXE

2005-08-24 23:25 . 2005-08-24 23:25 101080 c:\program files\Microsoft Location Finder\bak\LocationFinder.exe

2001-07-25 16:00 . 2001-07-25 16:00 241714 c:\program files\Microsoft Money\System\bak\Activation.exe

2004-02-14 03:02 . 2004-02-14 03:02 77824 c:\program files\QuickTime\bak\qttask.exe

2002-03-08 08:06 . 2001-09-23 13:14 163840 c:\windows\bak\DELLMMKB.EXE

2002-03-08 08:08 . 2000-05-11 07:00 90112 c:\windows\bak\Updreg.exe

2003-09-05 21:40 . 2004-08-04 04:56 15360 c:\windows\SYSTEM32\bak\ctfmon.exe
2003-09-05 21:40 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-14 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTWinModem1 "= "ltmsg.exe 9" [X]
"Synchronization Manager "= "c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"MSN Toolbar "= "c:\program files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe" [2010-07-06 240480]
"Microsoft Default Manager "= "c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AdaptecDirectCD "= "c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 655360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Camio Viewer 2000.lnk]
backup=c:\windows\pss\Camio Viewer 2000.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MacName.lnk]
backup=c:\windows\pss\MacName.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk]
backup=c:\windows\pss\QuickBooks 2002 Delivery Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Chub^Start Menu^Programs^Startup^PowerReg SchedulerV2.exe]
backup=c:\windows\pss\PowerReg SchedulerV2.exeStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\WINDOWS\\SYSTEM32\\mmc.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCPxpsp2res.dll,-22009

R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [3/14/2002 5:44 PM 34712]
R2 TabletServicePen;TabletServicePen;c:\windows\SYSTEM32\Pen_Tablet.exe [6/9/2010 4:24 PM 4497704]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [6/9/2010 4:25 PM 113448]
R3 Msikbd2k;DellTouch;c:\windows\SYSTEM32\DRIVERS\Msikbd2k.sys [10/3/2000 4:18 PM 6942]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/22/2010 5:19 PM 136176]
S2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [8/6/2001 2:41 PM 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 22:19]

2010-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 22:19]

2010-12-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.my.yahoo.com/
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-22 23:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4233ADD3-CD31-D295-804BA870321FDEF4}\{F4A8E5F3-7E68-2DD0-FA9D328203A7D1A7}\{07380252-9142-5EC5-94F639FC4AE64832}*]
"WHRUBFTNUT3JMXQXKMKSXOBADA1 "=hex:01,00,01,00,00,00,00,00,7d,86,67,30,10,5d,1c,
b8,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1364)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-12-22 23:44:28
ComboFix-quarantined-files.txt 2010-12-23 04:44
ComboFix2.txt 2010-12-23 03:24

Pre-Run: 10,543,316,992 bytes free
Post-Run: 10,529,689,600 bytes free

- - End Of File - - 81AEEA3C99A8E5AB2976C2E6F95F4725

broni · 2010/12/24

What is your current AV program, or you don't have any installed?

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\Gwurinazob.bin
c:\program files\NAV05ENG.exe


Folder::
c:\documents and settings\All Users\Application Data\Max Secure

AWF::
c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe

DDS::
uInternet Settings,ProxyOverride = <local>

RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4233ADD3-CD31-D295-804BA870321FDEF4}\{F4A8E5F3-7E68-2DD0-FA9D328203A7D1A7}\{07380252-9142-5EC5-94F639FC4AE64832}*]

SecCenter::
{7591DB91-41F0-48A3-B128-1A293FD8233D}
3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

ggs · 2010/12/24

Broni:
Here it is X-Mas Eve and you're still hard at it. Let's take a break, while I make sure that I understand what you have instructed me to do. Windows Defender deactivated. No AV programs running that I know of. Malwarebytes-free is reportably 'No Problem'. Windows Firewall is off. I'll start your copy-paste procedure tomorrow. No need to respond. I'll work this out and report. Thanks, ggs

broni · 2010/12/24

You're welcome

ggs · 2010/12/27

Broni: Below is the ComboFix.txt log. When ComboFix ran, it warned that Avast was scanning. I ran Search, and it came up empty for Avast. I continued with ComboFix. Thanks, ggs

ComboFix 10-12-22.01 - Chub 12/25/2010 17:57:40.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.198 [GMT -5:00]
Running from: c:\documents and settings\Chub\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Chub\Desktop\CFScript.txt

FILE ::
"c:\program files\NAV05ENG.exe "
"c:\windows\Gwurinazob.bin "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Max Secure
c:\documents and settings\All Users\Application Data\Max Secure\Max Registry Cleaner\SYSRegC.dll
c:\program files\NAV05ENG.exe
c:\windows\Gwurinazob.bin

.
((((((((((((((((((((((((( Files Created from 2010-11-25 to 2010-12-25 )))))))))))))))))))))))))))))))
.

2010-12-18 02:40 . 2010-12-18 02:40 -------- d-----w- c:\documents and settings\Guest\Application Data\Malwarebytes
2010-12-11 03:25 . 2010-12-11 03:26 -------- d-----w- c:\program files\Windows Defender
2010-12-09 01:47 . 2010-12-09 01:47 -------- d-----w- c:\documents and settings\Default User\Application Data\WTouch
2010-12-06 20:17 . 2010-12-06 20:17 -------- d-----w- c:\documents and settings\Chub\Application Data\DriverCure
2010-12-06 20:17 . 2010-12-06 20:17 -------- d-----w- c:\documents and settings\Chub\Application Data\ParetoLogic
2010-12-06 20:16 . 2010-12-06 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-12-06 14:13 . 2002-01-08 22:00 176128 ----a-w- c:\windows\system32\RcdScan.dll
2010-12-06 14:13 . 1999-05-07 18:24 414944 ----a-w- c:\windows\system32\COMCT332.OCX
2010-12-06 14:13 . 1998-11-10 15:46 328480 ----a-w- c:\windows\system32\ssa3d30.ocx
2010-12-03 17:50 . 2010-12-03 18:06 -------- d-----w- c:\documents and settings\Tim
2010-12-03 04:48 . 2010-12-03 04:49 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-12-03 01:11 . 2010-12-03 01:11 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-12-03 00:34 . 2010-12-15 03:12 -------- d-----w- C:\## aswSnx private storage
2010-12-02 20:44 . 2010-12-02 20:44 -------- d-----w- c:\documents and settings\Chub\Application Data\Malwarebytes
2010-12-02 20:44 . 2010-11-29 22:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-02 20:44 . 2010-12-02 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-02 20:43 . 2010-11-29 22:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-02 20:43 . 2010-12-02 20:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-02 18:28 . 2008-04-14 00:12 1033728 ----a-w- c:\windows\Copy of explorer.exe
2010-12-02 04:32 . 2010-12-03 18:31 -------- d-----w- c:\documents and settings\Administrator
2010-12-02 04:11 . 2010-12-02 04:11 -------- d-----w- c:\windows\system32\%APPDATA%
2010-12-01 20:56 . 2010-12-01 20:56 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 00:52 . 2006-10-17 15:49 63839744 ----a-w- c:\program files\Common Files\TaxWise Workstation.msi
2004-12-22 21:58 . 2005-01-10 22:38 18448384 ----a-w- c:\program files\Common Files\TaxWise Workstation Setup.msi
2002-03-15 21:16 . 2002-03-15 21:16 98304 ----a-w- c:\program files\internet explorer\plugins\IEHelper.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2003-01-03 02:42 . 2002-07-01 14:50 28672 c:\documents and settings\Chub\Desktop\MouseWare\system\bak\EM_EXEC.EXE

2001-09-04 21:31 . 2001-09-04 21:31 655360 c:\program files\Adaptec\Easy CD Creator 5\DirectCD\bak\DirectCD.exe
2001-09-04 19:31 . 2001-09-04 19:31 655360 c:\program files\Adaptec\Easy CD Creator 5\DirectCD\Directcd.exe

2005-06-12 22:52 . 2005-06-12 22:52 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2002-03-08 08:08 . 2001-03-28 07:00 102400 c:\program files\Creative\SBLive\Program\bak\AHQInit.exe

2007-01-23 21:23 . 2006-11-09 20:07 49263 c:\program files\Java\jre1.5.0_10\bin\bak\jusched.exe

2000-07-07 03:19 . 2000-07-07 03:19 151616 c:\program files\MacOpener\bak\MacLic.exe

2003-04-14 23:30 . 2004-10-13 16:24 1694208 c:\program files\Messenger\bak\msmsgs.exe
2008-08-23 22:41 . 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe

2003-12-25 14:34 . 2003-04-22 22:43 413775 c:\program files\Microsoft ActiveSync\bak\WCESCOMM.EXE

2005-08-24 23:25 . 2005-08-24 23:25 101080 c:\program files\Microsoft Location Finder\bak\LocationFinder.exe

2001-07-25 16:00 . 2001-07-25 16:00 241714 c:\program files\Microsoft Money\System\bak\Activation.exe

2004-02-14 03:02 . 2004-02-14 03:02 77824 c:\program files\QuickTime\bak\qttask.exe

2002-03-08 08:06 . 2001-09-23 13:14 163840 c:\windows\bak\DELLMMKB.EXE

2002-03-08 08:08 . 2000-05-11 07:00 90112 c:\windows\bak\Updreg.exe

2003-09-05 21:40 . 2004-08-04 04:56 15360 c:\windows\SYSTEM32\bak\ctfmon.exe
2003-09-05 21:40 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-14 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTWinModem1 "= "ltmsg.exe 9" [X]
"Synchronization Manager "= "c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"MSN Toolbar "= "c:\program files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe" [2010-07-06 240480]
"Microsoft Default Manager "= "c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"AdaptecDirectCD "= "c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 655360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Camio Viewer 2000.lnk]
backup=c:\windows\pss\Camio Viewer 2000.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MacName.lnk]
backup=c:\windows\pss\MacName.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk]
backup=c:\windows\pss\QuickBooks 2002 Delivery Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Chub^Start Menu^Programs^Startup^PowerReg SchedulerV2.exe]
backup=c:\windows\pss\PowerReg SchedulerV2.exeStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\SYSTEM32\\mmc.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\WINDOWS\\system32\\sessmgr.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP "= 3389:TCP:*isabledxpsp2res.dll,-22009

R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [3/14/2002 5:44 PM 34712]
R2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [8/6/2001 2:41 PM 28672]
R2 TabletServicePen;TabletServicePen;c:\windows\SYSTEM32\Pen_Tablet.exe [6/9/2010 4:24 PM 4497704]
R2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [6/9/2010 4:25 PM 113448]
R3 Msikbd2k;DellTouch;c:\windows\SYSTEM32\DRIVERS\Msikbd2k.sys [10/3/2000 4:18 PM 6942]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/22/2010 5:19 PM 136176]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-12-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 22:19]

2010-12-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-22 22:19]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.my.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-25 18:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4088)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\drivers\CDAC11BA.EXE
c:\windows\System32\CTsvcCDA.EXE
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\System32\MsPMSPSv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\WTouch\WTouchUser.exe
c:\windows\system32\WTablet\Pen_TabletUser.exe
c:\windows\system32\devldr32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\ltmsg.exe
c:\windows\system32\WISPTIS.EXE
.
**************************************************************************
.
Completion time: 2010-12-25 18:27:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-25 23:27
ComboFix2.txt 2010-12-24 00:09
ComboFix3.txt 2010-12-23 04:44
ComboFix4.txt 2010-12-23 03:24

Pre-Run: 10,544,701,440 bytes free
Post-Run: 10,532,159,488 bytes free

- - End Of File - - 543EA9E1532ED6BF57C83F8DF9426C5F

broni · 2010/12/27

Looks good

How is computer doing?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

ggs · 2010/12/28

Broni:
Here's the Extras log. I've got a million questions, but enlighten me on so many Error notices. By the way PITA1 stands for Pain In The (Bleep) 1. I also have PITA2, and PITA3. Cheers, ggs

OTL Extras logfile created on: 12/28/2010 3:35:22 PM - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\Chub\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 231.00 Mb Available Physical Memory | 45.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 9.84 Gb Free Space | 26.41% Space Free | Partition Type: NTFS
Drive G: | 3.72 Gb Total Space | 3.70 Gb Free Space | 99.42% Space Free | Partition Type: FAT32

Computer Name: PITA1 | User Name: Chub | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNetisabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabledxpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*isabledxpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe -- File not found
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe -- File not found
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SYSTEM32\mmc.exe" = C:\WINDOWS\SYSTEM32\mmc.exe:*isabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*isabled:hpqdia.exe -- ( )
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*isabled:hpqphunl.exe -- (Hewlett-Packard)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{13E824B4-FE15-4F8D-94C6-A7F98EBF9F01}" = TaxWise Workstation Setup
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1E0AD97C-678A-48C6-A7C3-CCC87F2DA9D8}" = PS_BSIZE_04_B8500_Software_Min
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36495C59-089C-49D1-BD15-9E5BD86DC9A1}" = ItsDeductible Express
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4E921E6B-CFF1-4901-B262-FD049AC8EF56}" = SolidWorks 2004 SP0
"{53A908D4-99C6-469B-BC13-F4189F260742}" = Corel Painter Essentials 4
"{5783F2D7-0103-0409-0000-0060B0CE6BBA}" = Mechanical Desktop 6
"{578596FF-7F65-4767-9F90-37920741148C}" = MSN Toolbar Platform
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.70
"{582876EC-A178-44D4-9823-C10D6C62EAFF}" = AGEIA PhysX v2.6.0
"{609F7AC8-C510-11D4-A788-009027ABA5D0}" = Easy CD Creator 5 Basic
"{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{69A83D99-D41B-4396-BCC4-3DCB77DFFED0}" = WebIQ Technology Engine
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{7148F0A8-6813-11D6-A77B-00B0D0142060}" = Java 2 Runtime Environment, SE v1.4.2_06
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76BEC1D7-8A9F-472D-84C7-014BB155E4B2}" = HP Photosmart and Deskjet 7.0 Software
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{809987B2-F964-11D4-A1A5-00104BD190B1}" = QuickBooks Pro 2002
"{81E76DE9-BBCB-449C-91BB-6E4E5436D496}" = Adobe Audition 1.0
"{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90D55A3F-1D99-4C94-A77E-46DC14F0BF08}" = Help and Support Customization
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9A3EABC0-CA06-11D4-BF77-00104B130C19}" = EPSON TWAIN 5
"{9D18F7F8-B984-4249-8512-CC621BC59F12}" = Microsoft Location Finder
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox
"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
"{B69CC1A5-0404-11D6-ABCB-005004C21D30}" = EPSON Copy Utility
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{E2F06576-226D-4F4E-B162-0583509760BA}" = TaxWise Workstation
"{E3C9FB9B-5D79-469e-8E81-9A5ACE0BB517}" = HP Photosmart B8500 Driver 12.0 Rel .4
"{E79F34D1-578C-4AB8-922A-1667F87987D2}" = TaxWise Workstation
"{E7A2604C-0131-4415-9D0A-717E1BB1EDD2}" = Microsoft XNA Framework
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{F7558F8A-1448-482F-9919-1F96B0234727}" = TaxWise Workstation
"{FC88C8F6-507B-4150-B2B1-6F9A414300ED}" = TaxWise Workstation Setup
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"{FF0B0792-F6E7-4627-B820-EA50617E223B}" = QuarkXPress 6.5
"Adobe Atmosphere Player" = Adobe Atmosphere Player for Acrobat and Adobe Reader
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Illustrator 7.0" = Adobe Illustrator 7.0
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"AMA" = AutoCAD Mechanical 6 Migration Assistance
"AnswerWorks" = AnswerWorks Runtime
"Autodesk Learning Assistance" = Autodesk Learning Assistance
"Birds of North America V2.5" = Birds of North America V2.5
"CCleaner" = CCleaner
"CdaC13Ba" = SafeCast Shared Components
"Cool Edit 2000" = Cool Edit 2000
"DRDownloadWizard" = eBot
"EPSON Photo Print" = EPSON Photo Print
"Eye Candy 4000" = Eye Candy 4000
"FileZilla" = FileZilla (remove only)
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HTML Password Lock_is1" = HTML Password Lock 3.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"Instruments Builder 4" = Instruments Builder 4
"interneTIFFX" = interneTIFF 6.2-FREE (IE Browser)
"KPT 6" = KPT 6
"LiveReg" = LiveReg (Symantec Corporation)
"Logitech Resource Center" = Logitech Resource Center
"LTWinModem" = Lucent Win Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MDTAMA" = Mechanical Desktop 6 Migration Assistance
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Press Interactive Training" = Microsoft Interactive Training
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"MUSICMATCH Jukebox" = MUSICMATCH Jukebox
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Pen Tablet Driver" = Bamboo
"PestPatrol" = PestPatrol
"PPTView97" = Microsoft PowerPoint Viewer 97
"Q309521" = Windows XP Hotfix (SP1) [See Q309521 for more information]
"Q319580" = Windows XP Application Compatibility Update[Q319580]
"QuarkXPress" = QuarkXPress 4.0
"RealPlayer 6.0" = RealPlayer
"Silent Package Run-Time Sample" = EPSON Scanner Reference Guide
"Sound Blaster Live! Value" = Sound Blaster Live! Value
"StreetPlugin" = Learn2 Player (Uninstall Only)
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"WAV MP3 Converter" = WAV MP3 Converter 2.3 build 691
"Wave@MP3" = River Past Wave@MP3
"Web Controls_is1" = Support.com Web Controls
"WIC" = Windows Imaging Component
"Windows CE Services" = Microsoft ActiveSync 3.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/7/2010 11:12:52 PM | Computer Name = PITA1 | Source = Microsoft Office 12 | ID = 2000
Description = Accepted Safe Mode action : Microsoft Office Word.

Error - 12/9/2010 8:02:46 PM | Computer Name = PITA1 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 12/9/2010 8:02:46 PM | Computer Name = PITA1 | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 12/10/2010 11:27:11 PM | Computer Name = PITA1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

Error - 12/11/2010 9:03:31 AM | Computer Name = PITA1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

Error - 12/25/2010 6:43:04 PM | Computer Name = PITA1 | Source = Application Error | ID = 1000
Description = Faulting application pev.exe, version 0.0.0.0, faulting module pev.exe,
version 0.0.0.0, fault address 0x0008d560.

[ OSession Events ]
Error - 7/16/2010 4:40:07 PM | Computer Name = PITA1 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16683
seconds with 1380 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 12/28/2010 4:19:10 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:19:10 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:24:11 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:24:11 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:29:11 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:29:11 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:34:11 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:34:11 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:39:12 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 12/28/2010 4:39:12 PM | Computer Name = PITA1 | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

< End of report >

broni · 2010/12/28

We won't worry about any Event Viewer errors unless we have to.
That won't happen until we're done with a whole cleaning process.

I still need OTL.txt log.

ggs · 2010/12/28

Broni:
The first response I sent was the OTL log. I got an overload signal. Sent OTL first, but evidently, I punched the wrong keys. Here's the OTL log, attached. And in response to your previous question about how the computer was doing: the computer is feeling good, and my grin is starting to turn into a smile. Thanks, ggs P.S. I just got notice that I'm about 2500 characters to long. So, I'll break it up about 2/3ds the way down and resend. Cheers

OTL logfile created on: 12/28/2010 3:35:22 PM - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\Chub\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 231.00 Mb Available Physical Memory | 45.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 9.84 Gb Free Space | 26.41% Space Free | Partition Type: NTFS
Drive G: | 3.72 Gb Total Space | 3.70 Gb Free Space | 99.42% Space Free | Partition Type: FAT32

Computer Name: PITA1 | User Name: Chub | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/27 20:27:08 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chub\Desktop\OTL.exe
PRC - [2010/07/06 12:30:48 | 000,240,480 | ---- | M] (Microsoft Corp.) -- C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe
PRC - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/11/23 18:53:58 | 004,781,352 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\WTouch\WTouchUser.exe
PRC - [2009/11/23 18:53:58 | 000,113,448 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\WTouch\WTouchService.exe
PRC - [2009/11/23 18:53:56 | 004,497,704 | ---- | M] (Wacom Technology, Corp.) -- C:\WINDOWS\SYSTEM32\Pen_Tablet.exe
PRC - [2009/11/23 18:53:56 | 001,823,528 | ---- | M] (Wacom Technology, Corp.) -- C:\WINDOWS\SYSTEM32\WTablet\Pen_TabletUser.exe
PRC - [2009/07/17 11:12:14 | 000,288,080 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/10/26 12:45:04 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\WISPTIS.EXE
PRC - [2003/01/05 11:13:56 | 000,052,736 | ---- | M] (Macrovision) -- C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE
PRC - [2001/08/31 14:44:30 | 000,025,600 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\SYSTEM32\devldr32.exe
PRC - [2001/08/06 14:41:48 | 000,028,672 | ---- | M] () -- C:\WINDOWS\Nhksrv.exe
PRC - [2001/04/03 11:38:30 | 000,038,912 | ---- | M] (LUCENT TECHNOLOGIES) -- C:\WINDOWS\SYSTEM32\ltmsg.exe

========== Modules (SafeList) ==========

MOD - [2010/12/27 20:27:08 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chub\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009/11/23 18:53:58 | 000,113,448 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\WTouch\WTouchService.exe -- (WTouchService)
SRV - [2009/11/23 18:53:56 | 004,497,704 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\WINDOWS\SYSTEM32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2005/11/14 00:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/01/05 11:13:56 | 000,052,736 | ---- | M] (Macrovision) [Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE -- (C-DillaCdaC11BA)
SRV - [2001/08/06 14:41:48 | 000,028,672 | ---- | M] () [Auto | Running] -- C:\WINDOWS\Nhksrv.exe -- (Nhksrv)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\el90xbc5.sys -- (EL90XBC)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2009/05/20 13:54:06 | 000,013,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\wacomvhid.sys -- (wacomvhid)
DRV - [2008/04/13 13:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum)
DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2007/02/16 13:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\wacommousefilter.sys -- (wacommousefilter)
DRV - [2005/08/19 02:00:00 | 000,002,560 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2005/08/19 02:00:00 | 000,002,432 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2005/04/19 17:05:14 | 000,279,880 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\vsdatant.sys -- (vsdatant)
DRV - [2004/08/03 21:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv4)
DRV - [2004/08/03 21:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv)
DRV - [2003/01/05 11:13:54 | 000,011,376 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\CdaC15BA.SYS -- (CdaC15BA)
DRV - [2003/01/02 21:44:02 | 000,028,164 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\MxlW2k.sys -- (MxlW2k)
DRV - [2002/07/02 11:20:51 | 000,070,382 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\LMouFlt2.sys -- (LMouFlt2)
DRV - [2002/07/02 11:20:51 | 000,040,508 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\LHIDUSB.SYS -- (LHidUsb)
DRV - [2002/07/02 11:20:51 | 000,023,854 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\LHIDFLT2.SYS -- (LHidFlt2)
DRV - [2002/07/02 11:20:51 | 000,006,030 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\LKbdFlt2.sys -- (LKbdFlt2)
DRV - [2002/07/02 11:20:50 | 000,050,830 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\L8042Pr2.sys -- (l8042pr2)
DRV - [2002/01/23 12:59:54 | 000,661,770 | ---- | M] (LT) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ltmdmxp.sys -- (ltmodem5)
DRV - [2001/09/27 11:58:20 | 000,028,396 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2001/09/13 19:09:48 | 000,777,088 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\emu10k1f.sys -- (emu10k) Creative SB Live! Value (WDM)
DRV - [2001/09/10 11:43:46 | 000,205,824 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys -- (UdfReadr_xp)
DRV - [2001/09/04 17:37:08 | 000,233,344 | ---- | M] (Roxio) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\cdudf_xp.sys -- (cdudf_xp)
DRV - [2001/09/04 16:39:50 | 000,017,990 | ---- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Dvd_2k.sys -- (dvd_2K)
DRV - [2001/09/04 16:39:40 | 000,019,702 | ---- | M] (Roxio) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Mmc_2k.sys -- (mmc_2K)
DRV - [2001/09/04 16:39:28 | 000,078,454 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\pwd_2K.sys -- (pwd_2K)
DRV - [2001/08/31 14:37:58 | 000,036,992 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\sfman.sys -- (sfman) Creative SoundFont Manager Driver (WDM)
DRV - [2001/08/22 08:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)
DRV - [2001/08/20 12:59:38 | 000,025,472 | ---- | M] (Roxio Inc.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\imapiRox.sys -- (Imapi)
DRV - [2001/08/18 07:00:00 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/18 07:00:00 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/18 07:00:00 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/18 07:00:00 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/18 07:00:00 | 000,038,144 | ---- | M] (HighPoint Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\hpt3xx.sys -- (hpt3xx)
DRV - [2001/08/18 07:00:00 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/18 07:00:00 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/18 07:00:00 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/18 07:00:00 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/18 07:00:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/18 07:00:00 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/18 07:00:00 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/18 07:00:00 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/18 07:00:00 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/18 07:00:00 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/18 07:00:00 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 13:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\AC97INTC.SYS -- (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM)
DRV - [2001/08/17 13:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctljystk.sys -- (ctljystk)
DRV - [2001/08/17 13:11:42 | 000,029,696 | ---- | M] (CNet Technology, Inc. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DM9PCI5.SYS -- (DM9102) DAVICOM 9102(A)
DRV - [2001/07/11 12:34:52 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctlface.sys -- (emu10k1) Creative Interface Manager Driver (WDM)
DRV - [2001/06/20 18:32:54 | 000,004,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\bvrp_pci.sys -- (bvrp_pci)
DRV - [2001/02/28 10:42:44 | 000,034,712 | ---- | M] (Marimba, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\MrtRate.sys -- (mrtRate)
DRV - [2000/10/03 16:18:24 | 000,006,942 | ---- | M] (Netropa Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Msikbd2k.sys -- (Msikbd2k)
DRV - [1999/12/17 02:00:00 | 000,006,752 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\PfModNT.sys -- (PfModNT)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://att.my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://att.my.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\Firefox [2010/11/22 14:41:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/11/23 20:01:04 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2010/12/25 18:15:26 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Companion BHO) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [LTWinModem1] C:\WINDOWS\System32\ltmsg.exe (LUCENT TECHNOLOGIES)
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MSN Toolbar] C:\Program Files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe (Microsoft Corp.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\NPJPI150_10.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL (Microsoft Corporation)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-40e1-a617-af65a72a0465/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/DataServer/Pub/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {41695A8E-6414-11D4-8FB3-00D0B7730277} http://activex.microsoft.com/objects/ocget.dll (Reg Error: Key error.)
O16 - DPF: {737D14F8-4090-11D4-AE0E-0010830243BD} file:///C:/Program%20Files/MDT6/SysVerChk.ocx (SysVerChk Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Program Files\Microsoft ActiveSync\AATP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/09/20 12:17:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2003/03/29 08:35:01 | 000,000,000 | ---D | M] - C:\AutoPtch -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux1 - C:\WINDOWS\System32\ctwdm32.dll (Creative Technology Ltd.)
Drivers32: MSACM.CEGSM - C:\WINDOWS\System32\MOBILEV.ACM ()
Drivers32: msacm.ctmp3 - C:\WINDOWS\SYSTEM32\ctmp3.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\L3CODECX.ACM (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2010/12/28 15:30:20 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Chub\Desktop\OTL.exe
[2010/12/26 00:18:45 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/12/25 18:27:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/12/25 17:54:22 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/12/22 20:31:53 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/12/22 20:24:37 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/12/22 20:24:37 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/12/22 20:24:37 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/12/22 20:24:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/12/22 19:59:57 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/22 11:58:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chub\Desktop\tdsskiller
[2010/12/14 22:05:01 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Chub\Recent
[2010/12/10 22:25:59 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Defender
[2010/12/06 15:17:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chub\Application Data\DriverCure
[2010/12/06 15:17:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chub\Application Data\ParetoLogic
[2010/12/06 15:16:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/12/06 09:13:40 | 000,328,480 | ---- | C] (Sheridan Software Systems, Inc.) -- C:\WINDOWS\System32\ssa3d30.ocx
[2010/12/02 23:49:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\AdobeUM
[2010/12/02 23:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Real
[2010/12/02 23:49:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2010/12/02 23:48:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2010/12/02 20:10:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/12/02 20:10:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/12/02 19:34:18 | 000,000,000 | ---D | C] -- C:\## aswSnx private storage
[2010/12/02 15:44:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chub\Application Data\Malwarebytes
[2010/12/02 15:44:07 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/02 15:44:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/12/02 15:43:57 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/02 15:43:56 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/01 23:11:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\%APPDATA%
[2010/12/01 15:56:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/12/01 15:56:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[1998/10/14 17:03:00 | 000,059,392 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
[1 C:\Documents and Settings\Chub\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Chub\Local Settings\Application Data\*.tmp -> ]
[1 C:\Documents and Settings\Chub\Application Data\*.tmp files -> C:\Documents and Settings\Chub\Application Data\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/28 15:29:05 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/12/28 10:02:21 | 000,443,040 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2010/12/28 10:02:21 | 000,072,382 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT
[2010/12/28 09:58:40 | 000,001,374 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2010/12/28 09:58:25 | 000,000,878 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/12/28 09:57:59 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2010/12/28 09:57:58 | 535,904,256 | -HS- | M] () -- C:\hiberfil.sys
[2010/12/27 20:27:08 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chub\Desktop\OTL.exe
[2010/12/25 18:15:26 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2010/12/22 20:32:05 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/12/22 18:57:16 | 003,996,586 | R--- | M] () -- C:\Documents and Settings\Chub\Desktop\ComboFix.exe
[2010/12/21 21:14:16 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\tdsskiller.zip
[2010/12/21 17:32:30 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\Word.lnk
[2010/12/20 21:21:46 | 000,000,378 | ---- | M] () -- C:\WINDOWS\System32\Pen_Tablet.dat
[2010/12/19 11:16:39 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/12/17 20:15:25 | 000,000,217 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\Shortcut to Windows Firewall.lnk
[2010/12/15 20:48:25 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/12/11 11:45:26 | 000,000,848 | ---- | M] () -- C:\Documents and Settings\Chub\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/11 11:22:50 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/12/08 21:11:56 | 000,174,417 | ---- | M] () -- C:\WINDOWS\System32\AdobeFnt.lst
[2010/12/08 18:08:02 | 000,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/12/07 22:16:16 | 000,002,303 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\SolidWorks 2004.lnk
[2010/12/07 22:13:36 | 000,002,473 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\Excel.lnk
[2010/12/06 09:10:02 | 000,001,666 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\Solution Center.lnk
[2010/12/05 14:33:26 | 000,115,848 | ---- | M] () -- C:\WINDOWS\hphins29.dat
[2010/12/02 19:35:19 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\Internet Explorer.lnk
[2010/12/02 18:21:04 | 000,116,313 | ---- | M] () -- C:\WINDOWS\hphins29.dat.temp
[2010/12/02 15:44:08 | 000,000,817 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/01 23:16:04 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Xnoxazefijocif.dat
[2010/12/01 23:14:59 | 000,001,200 | ---- | M] () -- C:\Documents and Settings\Chub\Desktop\Watch TV.lnk
[2010/12/01 23:10:31 | 000,001,072 | ---- | M] () -- C:\WINDOWS\System32\Improve Your PC.lnk
[2010/11/29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[1 C:\Documents and Settings\Chub\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Chub\Local Settings\Application Data\*.tmp -> ]
[1 C:\Documents and Settings\Chub\Application Data\*.tmp files -> C:\Documents and Settings\Chub\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/22 20:32:05 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/12/22 20:31:57 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/12/22 20:24:37 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/12/22 20:24:37 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/12/22 20:24:37 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/12/22 20:24:37 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/12/22 20:24:37 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/12/22 19:48:40 | 003,996,586 | R--- | C] () -- C:\Documents and Settings\Chub\Desktop\ComboFix.exe
[2010/12/22 11:58:17 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\Chub\Desktop\tdsskiller.zip
[2010/12/20 21:21:44 | 000,000,378 | ---- | C] () -- C:\WINDOWS\System32\Pen_Tablet.dat
[2010/12/20 15:56:42 | 535,904,256 | -HS- | C] () -- C:\hiberfil.sys
[2010/12/17 20:15:25 | 000,000,217 | ---- | C] () -- C:\Documents and Settings\Chub\Desktop\Shortcut to Windows Firewall.lnk
[2010/12/08 15:57:42 | 000,001,917 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/12/06 20:13:17 | 000,035,371 | ---- | C] () -- C:\Documents and Settings\Chub\Local Settings\Application Data\FASTWiz.log
[2010/12/02 19:35:19 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Chub\Desktop\Internet Explorer.lnk
[2010/12/02 18:13:32 | 000,115,848 | ---- | C] () -- C:\WINDOWS\hphins29.dat
[2010/12/02 18:13:32 | 000,001,060 | ---- | C] () -- C:\WINDOWS\hphmdl29.dat
[2010/12/02 15:44:08 | 000,000,817 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/01 23:16:04 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Xnoxazefijocif.dat
[2010/12/01 23:14:56 | 000,001,200 | ---- | C] () -- C:\Documents and Settings\Chub\Desktop\Watch TV.lnk
[2010/12/01 23:10:27 | 000,001,072 | ---- | C] () -- C:\WINDOWS\System32\Improve Your PC.lnk
[2010/12/01 15:57:21 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/20 20:11:12 | 000,001,188 | ---- | C] () -- C:\WINDOWS\Mpcwty01.ini
[2010/10/20 19:50:57 | 000,001,669 | ---- | C] () -- C:\WINDOWS\Mpcwty02.ini
[2008/01/04 17:30:08 | 000,549,376 | ---- | C] () -- C:\WINDOWS\System32\u2ltw.dll
[2007/04/06 11:06:18 | 000,910,368 | ---- | C] () -- C:\WINDOWS\System32\OWL52T.DLL
[2007/03/26 13:56:21 | 000,035,175 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/10/17 14:59:18 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Chub\Local Settings\Application Data\fusioncache.dat
[2006/10/17 10:49:48 | 063,839,744 | ---- | C] () -- C:\Program Files\Common Files\TaxWise Workstation.msi
[2006/09/28 13:55:34 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PhysXLoader.dll
[2006/09/26 13:01:40 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2006/09/08 08:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2005/12/21 17:57:36 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll
[2005/12/21 17:57:04 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll
[2005/12/21 17:54:34 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll
[2005/12/17 12:57:37 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\Chub\Application Data\ntp.ini
[2005/03/07 14:56:16 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\virport.dll
[2005/02/23 10:34:07 | 000,000,048 | ---- | C] () -- C:\WINDOWS\PerWin.ini
[2005/01/10 17:38:52 | 018,448,384 | ---- | C] () -- C:\Program Files\Common Files\TaxWise Workstation Setup.msi
[2005/01/10 17:34:43 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2004/12/14 17:55:22 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\SmAgentAPI.dll
[2004/07/15 16:42:56 | 000,000,064 | ---- | C] () -- C:\WINDOWS\qwimp.ini
[2004/04/26 14:41:42 | 000,071,749 | ---- | C] () -- C:\WINDOWS\HCExtOutput.dll
[2004/04/26 14:41:42 | 000,000,823 | ---- | C] () -- C:\WINDOWS\TSC.ini
[2004/04/26 14:41:01 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2003/11/26 20:54:41 | 000,000,056 | ---- | C] () -- C:\WINDOWS\AudACM.ini
[2003/10/28 17:42:56 | 000,000,995 | ---- | C] () -- C:\Program Files\SolidWorksswxJRNL.BAK
[2003/10/28 17:39:57 | 000,639,052 | ---- | C] () -- C:\WINDOWS\System32\BBPDFPortMon.dll
[2003/09/05 16:39:49 | 001,142,784 | ---- | C] () -- C:\WINDOWS\System32\quartz(4).dll
[2003/09/05 16:39:49 | 001,142,784 | ---- | C] () -- C:\WINDOWS\System32\quartz(3).dll
[2003/09/05 11:41:37 | 001,142,784 | ---- | C] () -- C:\WINDOWS\System32\quartz(2).dll
[2003/07/15 10:43:38 | 000,577,635 | ---- | C] () -- C:\WINDOWS\System32\InstallPrinter.dll
[2003/06/07 16:29:29 | 000,050,647 | ---- | C] () -- C:\WINDOWS\System32\okcckdd.dll
[2003/06/07 16:29:29 | 000,050,607 | ---- | C] () -- C:\WINDOWS\System32\ftiitx.dll
[2003/04/19 20:39:56 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2003/04/19 16:33:54 | 000,290,919 | ---- | C] () -- C:\WINDOWS\System32\pythoncom21.dll
[2003/04/19 16:33:54 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes21.dll
[2003/04/19 16:31:08 | 000,096,768 | ---- | C] () -- C:\WINDOWS\SlantAdj.dll
[2003/04/19 16:31:08 | 000,000,072 | ---- | C] () -- C:\WINDOWS\System32\epDPE.ini
[2003/04/19 16:06:43 | 000,000,201 | ---- | C] () -- C:\WINDOWS\EPSON 2400 Installer.ini
[2003/02/26 11:59:18 | 003,907,655 | ---- | C] () -- C:\WINDOWS\System32\Bbgspdf.dll
[2003/01/30 06:04:00 | 000,618,496 | ---- | C] () -- C:\WINDOWS\System32\stlpmt45.dll
[2003/01/21 11:26:07 | 000,000,371 | ---- | C] () -- C:\WINDOWS\Trpmaker.INI
[2003/01/18 21:34:46 | 000,022,016 | ---- | C] () -- C:\Documents and Settings\Chub\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/01/07 15:43:56 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2003/01/05 11:13:57 | 000,202,752 | ---- | C] () -- C:\WINDOWS\CDAC14BA.DLL
[2003/01/05 11:13:55 | 000,011,376 | ---- | C] () -- C:\WINDOWS\System32\drivers\CdaC15BA.SYS
[2003/01/02 21:42:42 | 000,096,768 | ---- | C] () -- C:\WINDOWS\System32\LGUICOM.DLL
[2002/12/10 00:00:00 | 001,708,032 | ---- | C] () -- C:\WINDOWS\System32\MSO97V.DLL
[2002/12/10 00:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[2002/12/10 00:00:00 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\MSORFS.DLL
[2002/09/23 15:56:30 | 000,000,059 | ---- | C] () -- C:\WINDOWS\eficolor.ini
[2002/09/23 15:49:53 | 000,000,149 | ---- | C] () -- C:\WINDOWS\quark.ini
[2002/08/15 10:57:12 | 000,000,103 | ---- | C] () -- C:\WINDOWS\CTRec.INI
[2002/08/07 10:47:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Dfreq.INI
[2002/06/28 13:58:49 | 000,000,139 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2002/06/28 13:58:48 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2002/04/21 17:04:31 | 000,000,064 | ---- | C] () -- C:\WINDOWS\QBWCD.INI
[2002/04/18 07:58:20 | 000,001,279 | ---- | C] () -- C:\WINDOWS\tbs_bna.ini
[2002/04/18 07:58:13 | 000,000,038 | ---- | C] () -- C:\WINDOWS\tbs_job.ini
[2002/04/18 07:58:13 | 000,000,034 | ---- | C] () -- C:\WINDOWS\tbs_tbh.ini
[2002/04/18 07:58:12 | 000,002,390 | ---- | C] () -- C:\WINDOWS\tbs_quiz.ini
[2002/04/18 07:58:12 | 000,001,050 | ---- | C] () -- C:\WINDOWS\tbs_juke.ini
[2002/04/18 07:58:11 | 000,001,159 | ---- | C] () -- C:\WINDOWS\tbs_bows.ini
[2002/04/18 07:58:08 | 000,000,744 | ---- | C] () -- C:\WINDOWS\tbs_ss.ini
[2002/04/18 07:58:06 | 000,000,040 | ---- | C] () -- C:\WINDOWS\tbs_menu.ini
[2002/03/29 16:10:52 | 000,000,156 | ---- | C] () -- C:\WINDOWS\render.ini
[2002/03/26 16:51:11 | 000,000,020 | ---- | C] () -- C:\WINDOWS\InfModM.ini
[2002/03/23 08:37:58 | 000,000,171 | ---- | C] () -- C:\WINDOWS\INTUIT.INI
[2002/03/23 08:02:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QFN.ini
[2002/03/23 08:02:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QDQICK.ini
[2002/03/18 20:32:52 | 000,000,135 | ---- | C] () -- C:\WINDOWS\cool.ini
[2002/03/18 20:19:19 | 000,000,011 | ---- | C] () -- C:\WINDOWS\wordpad.ini
[2002/03/15 20:38:23 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2002/03/15 20:38:23 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2002/03/14 17:44:32 | 000,000,076 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2002/03/08 03:15:17 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2002/03/08 03:07:51 | 000,000,231 | ---- | C] () -- C:\WINDOWS\ac3api.ini
[2002/03/08 03:07:36 | 000,000,184 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2002/03/08 03:06:37 | 000,000,042 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2002/03/08 03:06:23 | 000,000,015 | ---- | C] () -- C:\WINDOWS\wgedit.ini
[2002/03/08 03:06:20 | 000,057,344 | ---- | C] () -- C:\WINDOWS\uninstBVRP.dll
[2002/03/08 03:06:10 | 000,004,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2002/03/08 03:06:06 | 000,000,004 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\DirectCDUserName.txt
[2002/03/08 03:02:59 | 000,000,897 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2001/09/20 13:08:48 | 000,000,784 | ---- | C] () -- C:\WINDOWS\LRUN32.INI
[2001/09/20 12:27:20 | 000,001,316 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2001/09/20 12:17:22 | 000,004,330 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001/08/10 14:14:16 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ImapiRoxPS.dll
[2000/09/18 16:50:28 | 000,202,752 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[1999/07/23 12:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 09:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll

ggs · 2010/12/28

Broni:
Here's the rest.

========== LOP Check ==========

[2003/10/28 17:39:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bluebeam Software
[2009/02/10 18:31:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DassaultSystemes
[2010/12/06 16:55:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/11/22 14:39:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2005/02/27 18:43:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Quark
[2007/04/10 19:59:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\River Past G5
[2002/03/08 03:12:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sierra Imaging
[2008/01/04 17:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UniversalTaxSystems
[2005/03/29 15:35:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2002/03/29 15:35:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\Autodesk
[2009/02/10 18:31:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\DassaultSystemes
[2010/12/06 15:17:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\DriverCure
[2003/04/19 20:41:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\EPSON
[2004/07/19 21:03:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\Learn2.com
[2010/12/06 15:17:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\ParetoLogic
[2005/02/27 17:56:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\Quark
[2007/04/07 17:44:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\River Past G5
[2007/01/16 20:27:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\Viewpoint
[2010/06/09 16:26:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\WTouch

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2001/09/20 12:17:36 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2003/01/07 16:41:56 | 016,454,934 | ---- | M] () -- C:\BellSouthIW.reg
[2010/12/19 11:16:39 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/12/22 20:32:05 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2001/09/20 11:56:14 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/12/25 18:27:17 | 000,013,058 | ---- | M] () -- C:\ComboFix.txt
[2001/09/20 12:17:36 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2002/03/08 03:47:50 | 000,003,784 | RH-- | M] () -- C:\DELL.SDR
[2010/09/24 18:43:02 | 000,000,090 | ---- | M] () -- C:\error.log
[2010/12/28 09:57:58 | 535,904,256 | -HS- | M] () -- C:\hiberfil.sys
[2002/03/15 16:18:46 | 000,000,159 | ---- | M] () -- C:\INSTALL.LOG
[2001/09/20 12:17:36 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2002/03/08 03:13:33 | 000,000,313 | -H-- | M] () -- C:\IPH.PH
[2001/09/20 12:17:36 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2005/08/23 16:55:23 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/05/07 13:18:05 | 000,250,048 | ---- | M] () -- C:\ntldr
[2010/12/28 09:57:44 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
[2009/05/05 10:09:18 | 000,024,576 | ---- | M] () -- C:\SC 2009 Thank You.doc
[2010/03/27 19:28:07 | 000,000,004 | ---- | M] () -- C:\ss_nb.dat
[2010/03/27 19:27:59 | 000,000,004 | ---- | M] () -- C:\ss_udp.dat
[2010/03/27 19:27:59 | 000,000,122 | ---- | M] () -- C:\ss_udp2.dat
[2010/12/22 11:59:48 | 000,001,960 | ---- | M] () -- C:\TDSSKiller.2.4.12.0_22.12.2010_11.59.37_log.txt
[2010/12/22 12:09:13 | 000,049,928 | ---- | M] () -- C:\TDSSKiller.2.4.12.0_22.12.2010_12.05.46_log.txt
[2010/12/22 13:39:08 | 000,001,960 | ---- | M] () -- C:\TDSSKiller.2.4.12.0_22.12.2010_13.38.47_log.txt
[2005/09/13 14:29:18 | 000,001,258 | ---- | M] () -- C:\tidyerrors.txt
[2008/12/31 17:13:47 | 000,000,594 | ---- | M] () -- C:\updatedatfix.log
[2006/06/19 16:08:17 | 000,000,054 | ---- | M] () -- C:\ut.bat
[2006/06/21 22:03:22 | 000,000,056 | ---- | M] () -- C:\ut9x.bat
[2009/03/16 17:35:07 | 278,927,592 | ---- | M] (Microsoft Corporation) -- C:\WindowsXP-KB835935-SP2-ENU.exe

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2003/09/05 16:09:37 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\DESKTOP.INI

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\filterpipelineprintproc.dll
[2006/03/22 20:08:20 | 000,074,240 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\hpzpp463.dll
[2008/10/28 12:49:30 | 000,321,536 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\hpzpp696.dll
[2006/10/26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\msonpppr.dll
[2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\printfilterpipelinesvc.exe
[1 C:\WINDOWS\system32\spool\prtprocs\w32x86\*.tmp files -> C:\WINDOWS\system32\spool\prtprocs\w32x86\*.tmp -> ]

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/03/20 19:15:09 | 000,001,546 | -H-- | M] () -- C:\Documents and Settings\Chub\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2009/03/08 22:17:14 | 000,000,995 | ---- | M] () -- C:\Program Files\SolidWorksswxJRNL.BAK

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2003/09/05 11:57:42 | 001,028,096 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\default.sav
[2003/09/05 15:50:59 | 000,045,056 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\security.sav
[2003/09/05 11:57:42 | 026,513,408 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\software.sav
[2003/09/05 11:57:43 | 004,820,992 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\system.sav

< %PROGRAMFILES%\bak. /s >
[2007/10/10 19:32:25 | 000,000,000 | ---D | M] -- C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\bak
[2007/10/10 19:32:27 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files\Real\Update_OB\bak
[2007/10/10 19:32:25 | 000,000,000 | ---D | M] -- C:\Program Files\Creative\SBLive\Program\bak
[2007/10/10 19:32:27 | 000,000,000 | ---D | M] -- C:\Program Files\Java\jre1.5.0_10\bin\bak
[2007/10/10 19:32:27 | 000,000,000 | ---D | M] -- C:\Program Files\MacOpener\bak
[2007/10/10 19:32:24 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger\bak
[2007/10/10 19:32:24 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync\bak
[2007/10/10 19:32:24 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Location Finder\bak
[2007/10/10 19:32:26 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Money\System\bak
[2007/10/10 19:32:26 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime\bak

< %systemroot%\system32\bak. /s >
[2007/10/10 19:32:24 | 000,000,000 | ---D | M] -- C:\WINDOWS\SYSTEM32\bak

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/05/07 13:26:54 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/08/23 17:19:09 | 000,000,177 | -HS- | M] () -- C:\Documents and Settings\Chub\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
[2005/03/01 18:38:27 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Chub\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/12/22 18:57:16 | 003,996,586 | R--- | M] () -- C:\Documents and Settings\Chub\Desktop\ComboFix.exe
[2010/12/27 20:27:08 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chub\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >
[2004/12/22 16:58:38 | 018,448,384 | ---- | M] () -- C:\Program Files\Common Files\TaxWise Workstation Setup.msi
[2007/12/03 19:52:56 | 063,839,744 | ---- | M] () -- C:\Program Files\Common Files\TaxWise Workstation.msi

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >
[2003/02/20 17:42:30 | 000,000,008 | ---- | M] () -- C:\WINDOWS\JAVA\pord.wed

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2005/09/14 12:46:54 | 000,561,152 | ---- | M] (Citrix Online) -- C:\Documents and Settings\Chub\chatlnk.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2005/08/23 17:19:09 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Chub\Favorites\Desktop.ini
[2002/03/14 15:30:12 | 000,001,288 | ---- | M] () -- C:\Documents and Settings\Chub\Favorites\Microsoft bCentral.lnk
[2009/04/07 20:37:50 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Chub\Favorites\Search Results.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
Copy of explorer.exe
Wave@MP3 Uninstaller.exe

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/12/28 09:58:39 | 000,016,384 | -HS- | M] () -- C:\Documents and Settings\Chub\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\INF\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2002/12/17 10:23:28 | 000,015,692 | ---- | M] () -- C:\Program Files\Messenger\license.txt
[2002/12/17 10:23:22 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/12/17 10:23:22 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/12/17 10:23:28 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 19:12:28 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2002/08/29 05:41:26 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
[2002/12/17 10:23:18 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2002/12/17 10:23:18 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2002/12/17 10:23:18 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2002/12/17 10:23:24 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/07/17 10:41:06 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[2000/09/11 08:00:00 | 000,009,597 | ---- | M] () -- C:\WINDOWS\SYSTEM\RDB16.EXE

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< >

< End of report >

Holler, if I've ******* up again. Thanks, ggs

broni · 2010/12/28

You did fine

You need to reinstall your AV program.

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

================================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...8f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {41695A8E-6414-11D4-8FB3-00D0B7730277} http://activex.microsoft.com/objects/ocget.dll (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
[1 C:\Documents and Settings\Chub\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Chub\Local Settings\Application Data\*.tmp -> ]
[1 C:\Documents and Settings\Chub\Application Data\*.tmp files -> C:\Documents and Settings\Chub\Application Data\*.tmp -> ]
[2005/03/29 15:35:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2007/01/16 20:27:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chub\Application Data\Viewpoint


:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
===============================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

ggs · 2010/12/29

Broni:
AV reinstalled w/o going to the net. Java Script seems to be another matter. Am I cleared to go to the net (which means I may have to reinstall IE8 or mess around with IE files before I can get to the net)? Thanks, ggs

broni · 2010/12/29

You should be fine with reconnecting.

ggs · 2010/12/30

Broni: Net started up fine... with a bonus: Avast no longer makes the a loud decleration that it has updated the virus file, although Avast icon spins happily while net transictions are going on. Got through the Java stuff okay, I think. Ran OTL as directed, log attached. On re-boot the computer got to Desktop 5-10% faster. The rest of the downloads soon to follow. Thanks,ggs

All processes killed
========== OTL ==========
Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}
C:\WINDOWS\Downloaded Program Files\wvc1dmo.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31435657-9980-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {41695A8E-6414-11D4-8FB3-00D0B7730277}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{41695A8E-6414-11D4-8FB3-00D0B7730277}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{41695A8E-6414-11D4-8FB3-00D0B7730277}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{41695A8E-6414-11D4-8FB3-00D0B7730277}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41695A8E-6414-11D4-8FB3-00D0B7730277}\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
C:\Documents and Settings\Chub\Local Settings\Application Data\TestFile.tmp deleted successfully.
C:\Documents and Settings\Chub\Application Data\TestFile.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
C:\Documents and Settings\Chub\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\Chub\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\Chub\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\Chub\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\Chub\Application Data\Viewpoint\Viewpoint Media Player\Resources folder moved successfully.
C:\Documents and Settings\Chub\Application Data\Viewpoint\Viewpoint Media Player folder moved successfully.
C:\Documents and Settings\Chub\Application Data\Viewpoint folder moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Chub
->Temp folder emptied: 11854773 bytes
->Temporary Internet Files folder emptied: 16204263 bytes
->Java cache emptied: 1900 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1288 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Nancy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Tim
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5104 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 20898349 bytes

Total Files Cleaned = 47.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Chub
->Flash cache emptied: 0 bytes

User: Default User

User: Guest
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: Nancy
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Tim

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.18.0 log created on 12302010_172718

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Chub\Local Settings\Temp\~DF416A.tmp not found!
File\Folder C:\Documents and Settings\Chub\Local Settings\Temp\~DF417A.tmp not found!
File\Folder C:\Documents and Settings\Chub\Local Settings\Temp\~DF428E.tmp not found!
File\Folder C:\Documents and Settings\Chub\Local Settings\Temp\~DF429E.tmp not found!
File\Folder C:\Documents and Settings\Chub\Local Settings\Temp\~DF43B0.tmp not found!
File\Folder C:\Documents and Settings\Chub\Local Settings\Temp\~DF43BD.tmp not found!
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\ads[2].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\audmeasure[1].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\audmeasure[2].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\blank[1].html moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\blank[2].html moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\drts[1].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\L[4].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\L[5].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\KLMQ93KM\p-01-0VIaSjnOLg[2].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\AARN2Y8L\96893-active-antivirus-malware-chaos-2[1].html moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\AARN2Y8L\drts[1].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\AARN2Y8L\drts[2].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\51ASFBNR\audmeasure[1].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\51ASFBNR\drts[1].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\51ASFBNR\iframescript[1].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\51ASFBNR\openmail.app[1].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\audmeasure[1].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\fc[3].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\launch[1].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\L[5].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\L[6].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\openmail.app[2].htm moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\Content.IE5\0GO16OS6\p-01-0VIaSjnOLg[2].gif moved successfully.
C:\Documents and Settings\Chub\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!
File\Folder C:\WINDOWS\temp\_asw_aisI.tm~a02080\setup.lok not found!
File\Folder C:\WINDOWS\temp\_asw_aisI.tm~a00412\setup.lok not found!

Registry entries deleted on Reboot...

Log in or Sign up

Solved 'AntiVirus' malware chaos

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

Share This Page

Log in or Sign up

Solved 'AntiVirus' malware chaos

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

broni Moderator Malware Analyst

ggs Inactive Thread Starter

Share This Page

Useful Searches