Solved Logs from recent scans as requested for search conduit viurs

[Resolved] Logs from recent scans as requested for search conduit viurs

Hope this helps and more importantly, it's the right information.


Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.04.19.11

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Robert :: MISBRI [administrator]

Protection: Enabled

4/19/2013 7:40:41 PM
mbam-log-2013-04-19 (19-40-41).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 292685
Time elapsed: 5 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.7.2
Run by Robert at 19:57:20 on 2013-04-19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3006.1627 [GMT -4:00]
.
AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Dell V305\dldtmon.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell V305\dldtMsdMon.exe
C:\WINDOWS\system32\dldtcoms.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
C:\Program Files\Constant Guard Protection Suite\IDVaultSvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Dell V305\dldtmon.exe
C:\Program Files\Dell V305\dldtMsdMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\norton security suite\engine\5.2.2.3\coieplg.dll
BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\norton security suite\engine\5.2.2.3\ips\ipsbho.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Constant Guard Protection Suite (COM): {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - c:\documents and settings\all users\application data\white sky, inc\id vault\iebho1.1.730.1\NativeBHO.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton security suite\engine\5.2.2.3\coieplg.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton security suite\engine\5.2.2.3\coieplg.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [dldtmon.exe] "c:\program files\dell v305\dldtmon.exe "
mRun: [dldtamon] "c:\program files\dell v305\dldtamon.exe "
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\consta~1.lnk - c:\program files\constant guard protection suite\IDVault.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC} - c:\program files\java\jre7\bin\jp2iexp.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1319813260218
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{9FB4F921-0E71-4114-88AA-FF727A58AE16} : DHCPNameServer = 75.75.75.75 75.75.76.76
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\robert\application data\mozilla\firefox\profiles\xt7ojczo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&CUI=UN25537841211507552&UM=2&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - WhiteSmoke New Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN25537841211507552&UM=2&q=
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\coffplgn_2011_7_3_6\components\coFFPlgn.dll
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10516.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_168.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: !HIDDEN! 2011-11-05 03:05; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0502020.003\symds.sys [2012-7-16 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0502020.003\symefa.sys [2012-7-16 744568]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\bashdefs\20130412.001\BHDrvx86.sys [2013-4-12 1000024]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0502020.003\ironx86.sys [2012-7-16 136312]
R2 dldt_device;dldt_device;c:\windows\system32\dldtcoms.exe -service --> c:\windows\system32\dldtcoms.exe -service [?]
R2 IDVaultSvc;CGPS Service;c:\program files\constant guard protection suite\IDVaultSvc.exe [2012-8-30 62064]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-4-19 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-4-19 701512]
R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\5.2.2.3\ccsvchst.exe [2012-7-16 130008]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-8-9 106656]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\ipsdefs\20130419.001\IDSXpx86.sys [2013-4-19 373728]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-4-19 22856]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20130419.008\NAVENG.SYS [2013-4-19 93296]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20130419.008\NAVEX15.SYS [2013-4-19 1603824]
S2 dldtCATSCustConnectService;dldtCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dldtserv.exe [2011-10-28 99568]
.
=============== Created Last 30 ================
.
2013-04-19 23:38:08 -------- d-----w- c:\documents and settings\robert\application data\Malwarebytes
2013-04-19 23:37:54 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2013-04-19 23:37:53 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-19 23:37:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-04-16 16:00:57 -------- d-----w- c:\documents and settings\robert\application data\PowerISO
2013-04-16 15:46:56 -------- d-----w- c:\documents and settings\robert\application data\SwvUpdater
2013-04-16 15:46:52 45056 ----a-w- c:\windows\system32\WNASPI32.DLL
2013-04-16 15:46:52 16877 ----a-w- c:\windows\system32\drivers\ASPI32.SYS
2013-04-16 15:46:39 -------- d-----w- c:\program files\Conduit
2013-04-16 15:46:35 -------- d-----w- c:\documents and settings\robert\local settings\application data\Conduit
2013-04-15 15:06:53 4323192 ----a-w- c:\documents and settings\all users\SPL3701.tmp
2013-04-12 13:37:59 920472 ----a-w- c:\program files\mozilla firefox\firefox.exe
2013-04-04 12:19:37 -------- d-----w- c:\program files\Mozilla Firefox.bak
.
==================== Find3M ====================
.
2013-04-11 14:22:56 770384 ----a-w- c:\windows\system32\msvcr100.dll
2013-04-11 14:22:56 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-02-19 00:58:24 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-19 00:58:24 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-04 22:16:30 146756 ----a-w- c:\documents and settings\all users\SPL6.tmp
.
============= FINISH: 19:57:51.56 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 10/28/2011 8:30:18 AM
System Uptime: 4/18/2013 8:21:46 AM (35 hours ago)
.
Motherboard: Dell Inc | |
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ | Socket M2 | 2104/1000mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 102.993 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
J: is FIXED (NTFS) - 298 GiB total, 12.278 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP477: 1/20/2013 1:52:32 PM - System Checkpoint
RP478: 1/21/2013 2:51:31 PM - System Checkpoint
RP479: 1/22/2013 3:51:27 PM - System Checkpoint
RP480: 1/23/2013 5:19:51 PM - System Checkpoint
RP481: 1/24/2013 6:16:41 PM - System Checkpoint
RP482: 1/25/2013 6:51:39 PM - System Checkpoint
RP483: 1/26/2013 7:51:29 PM - System Checkpoint
RP484: 1/27/2013 7:57:37 PM - System Checkpoint
RP485: 1/28/2013 8:42:36 PM - System Checkpoint
RP486: 1/30/2013 9:51:25 AM - System Checkpoint
RP487: 1/31/2013 10:12:07 AM - Removed Content Manager
RP488: 2/1/2013 11:14:56 AM - System Checkpoint
RP489: 2/2/2013 12:09:41 PM - System Checkpoint
RP490: 2/3/2013 12:43:33 PM - System Checkpoint
RP491: 2/4/2013 1:10:51 PM - System Checkpoint
RP492: 2/5/2013 1:20:45 PM - System Checkpoint
RP493: 2/6/2013 1:43:58 PM - System Checkpoint
RP494: 2/7/2013 2:36:06 PM - System Checkpoint
RP495: 2/8/2013 2:42:53 PM - System Checkpoint
RP496: 2/9/2013 3:00:05 PM - System Checkpoint
RP497: 2/10/2013 3:43:38 PM - System Checkpoint
RP498: 2/11/2013 4:42:32 PM - System Checkpoint
RP499: 2/12/2013 5:52:11 PM - System Checkpoint
RP500: 2/13/2013 6:42:07 PM - System Checkpoint
RP501: 2/14/2013 7:04:24 PM - System Checkpoint
RP502: 2/16/2013 10:52:39 AM - System Checkpoint
RP503: 2/17/2013 11:42:53 AM - System Checkpoint
RP504: 2/18/2013 12:02:21 PM - System Checkpoint
RP505: 2/19/2013 12:10:18 PM - System Checkpoint
RP506: 2/20/2013 12:18:52 PM - System Checkpoint
RP507: 2/21/2013 1:28:32 PM - System Checkpoint
RP508: 2/22/2013 1:59:53 PM - System Checkpoint
RP509: 2/23/2013 2:00:19 PM - System Checkpoint
RP510: 2/24/2013 2:00:56 PM - System Checkpoint
RP511: 2/25/2013 2:20:08 PM - System Checkpoint
RP512: 2/26/2013 2:59:57 PM - System Checkpoint
RP513: 2/27/2013 3:59:55 PM - System Checkpoint
RP514: 2/28/2013 5:00:10 PM - System Checkpoint
RP515: 3/1/2013 6:01:01 PM - System Checkpoint
RP516: 3/2/2013 6:59:54 PM - System Checkpoint
RP517: 3/3/2013 8:35:54 PM - System Checkpoint
RP518: 3/4/2013 9:00:59 PM - System Checkpoint
RP519: 3/5/2013 9:59:48 PM - System Checkpoint
RP520: 3/6/2013 11:00:52 PM - System Checkpoint
RP521: 3/7/2013 11:12:51 PM - System Checkpoint
RP522: 3/8/2013 11:59:37 PM - System Checkpoint
RP523: 3/10/2013 1:06:32 AM - System Checkpoint
RP524: 3/11/2013 2:06:34 AM - System Checkpoint
RP525: 3/12/2013 3:06:30 AM - System Checkpoint
RP526: 3/13/2013 4:06:23 AM - System Checkpoint
RP527: 3/14/2013 5:06:18 AM - System Checkpoint
RP528: 3/15/2013 6:06:16 AM - System Checkpoint
RP529: 3/16/2013 10:02:13 AM - System Checkpoint
RP530: 3/17/2013 10:06:06 AM - System Checkpoint
RP531: 3/18/2013 10:29:18 AM - System Checkpoint
RP532: 3/19/2013 11:21:40 AM - System Checkpoint
RP533: 3/20/2013 12:05:47 PM - System Checkpoint
RP534: 3/21/2013 12:19:35 PM - System Checkpoint
RP535: 3/22/2013 12:29:39 PM - System Checkpoint
RP536: 3/23/2013 1:05:46 PM - System Checkpoint
RP537: 3/24/2013 2:07:00 PM - System Checkpoint
RP538: 3/25/2013 3:06:56 PM - System Checkpoint
RP539: 3/26/2013 4:05:45 PM - System Checkpoint
RP540: 3/27/2013 4:17:14 PM - System Checkpoint
RP541: 3/28/2013 5:05:45 PM - System Checkpoint
RP542: 3/29/2013 5:55:32 PM - System Checkpoint
RP543: 3/30/2013 6:05:45 PM - System Checkpoint
RP544: 3/31/2013 6:59:28 PM - System Checkpoint
RP545: 4/1/2013 7:05:45 PM - System Checkpoint
RP546: 4/2/2013 7:20:13 PM - System Checkpoint
RP547: 4/3/2013 8:05:48 PM - System Checkpoint
RP548: 4/4/2013 8:23:43 PM - System Checkpoint
RP549: 4/5/2013 9:05:49 PM - System Checkpoint
RP550: 4/6/2013 9:44:19 PM - System Checkpoint
RP551: 4/7/2013 9:52:48 PM - System Checkpoint
RP552: 4/8/2013 10:44:21 PM - System Checkpoint
RP553: 4/9/2013 11:44:24 PM - System Checkpoint
RP554: 4/11/2013 12:44:21 AM - System Checkpoint
RP555: 4/12/2013 1:44:22 AM - System Checkpoint
RP556: 4/13/2013 1:54:05 AM - System Checkpoint
RP557: 4/14/2013 3:07:36 AM - System Checkpoint
RP558: 4/15/2013 4:05:57 AM - System Checkpoint
RP559: 4/16/2013 4:54:13 AM - System Checkpoint
RP560: 4/17/2013 5:22:25 AM - System Checkpoint
RP561: 4/18/2013 6:22:22 AM - System Checkpoint
RP562: 4/18/2013 8:12:51 AM - Removed GuardedID.
RP563: 4/19/2013 8:52:12 AM - System Checkpoint
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader XI
Athlon 64 Processor Driver
Broadcom 440x 10/100 Integrated Controller
Broadcom Management Programs
Cisco WebEx Meeting Center for Firefox or Chrome
Cisco WebEx Meetings
Constant Guard Protection Suite
Dell Resource CD
Dell V305
Fast Video Converter 1.0
High Definition Audio Driver Package - KB835221
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
iTunes
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
Java 7 Update 7
Java Auto Updater
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 20.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
Music Transfer
Norton Security Suite
NVIDIA Drivers
Primo
Reel Deal Slot Mysteries Pyramid Conspiracy
Runtime
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
SigmaTel Audio
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2598845)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 8
Windows Media Player Firefox Plugin
Windows Presentation Foundation
Windows XP Service Pack 3
XML Paper Specification Shared Components Pack 1.0
XP Codec Pack
.
==== Event Viewer Messages From Past Week ========
.
4/15/2013 12:06:21 PM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 1698035. Number of bytes printed: 0. Total number of pages in the document: 8. Number of pages printed: 2. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 12:05:09 PM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 1698035. Number of bytes printed: 0. Total number of pages in the document: 8. Number of pages printed: 5. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 12:00:21 PM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 3177160. Number of bytes printed: 0. Total number of pages in the document: 13. Number of pages printed: 6. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 11:56:45 AM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 3313908. Number of bytes printed: 0. Total number of pages in the document: 14. Number of pages printed: 3. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 11:54:03 AM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 3395520. Number of bytes printed: 0. Total number of pages in the document: 16. Number of pages printed: 5. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 11:24:27 AM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 1328549. Number of bytes printed: 0. Total number of pages in the document: 6. Number of pages printed: 2. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 11:22:38 AM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 4345547. Number of bytes printed: 0. Total number of pages in the document: 16. Number of pages printed: 11. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 11:19:06 AM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 4682789. Number of bytes printed: 0. Total number of pages in the document: 19. Number of pages printed: 6. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 11:15:30 AM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 4852927. Number of bytes printed: 0. Total number of pages in the document: 21. Number of pages printed: 4. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/15/2013 11:12:34 AM, error: Print [6161] - The document 2012 return.pdf owned by Robert failed to print on printer Dell V305. Data type: RAW. Size of the spool file in bytes: 5113735. Number of bytes printed: 0. Total number of pages in the document: 25. Number of pages printed: 5. Client machine: \\MISBRI. Win32 error code returned by the print processor: 0 (0x0).
4/12/2013 1:50:35 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the dldtCATSCustConnectService service to connect.
4/12/2013 1:50:35 PM, error: Service Control Manager [7000] - The dldtCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
.
==== End Of File ===========================

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-04-19 19:54:30
-----------------------------
19:54:30.474 OS Version: Windows 5.1.2600 Service Pack 3
19:54:30.474 Number of processors: 2 586 0x6B01
19:54:30.474 ComputerName: MISBRI UserName: Robert
19:54:31.567 Initialize success
19:54:54.545 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000062
19:54:54.545 Disk 0 Vendor: GB0250C8045 HPG6 Size: 238475MB BusType: 3
19:54:54.686 Disk 0 MBR read successfully
19:54:54.686 Disk 0 MBR scan
19:54:54.686 Disk 0 Windows XP default MBR code
19:54:54.686 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 238464 MB offset 63
19:54:54.686 Disk 0 scanning sectors +488376000
19:54:54.764 Disk 0 scanning C:\WINDOWS\system32\drivers
19:55:00.247 Service scanning
19:55:06.027 Modules scanning
19:55:13.103 Disk 0 trace - called modules:
19:55:13.119 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sys
19:55:13.119 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8abeaab8]
19:55:13.119 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000064[0x8ac5e420]
19:55:13.119 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\00000062[0x8ac51030]
19:55:13.119 Scan finished successfully
19:55:51.796 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Robert\Desktop\MBR.dat "
19:55:51.796 The log file has been saved successfully to "C:\Documents and Settings\Robert\Desktop\aswMBR.txt "

 

Her you go. Thank you.

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Robert [Admin rights]
Mode : Remove -- Date : 04/20/2013 10:13:39
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 1 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
SSDT[12] : NtAlertResumeThread @ 0x805D4BDC -> HOOKED (Unknown @ 0x8A7D1C80)
SSDT[13] : NtAlertThread @ 0x805D4B8C -> HOOKED (Unknown @ 0x8A7B8568)
SSDT[17] : NtAllocateVirtualMemory @ 0x805A8AC2 -> HOOKED (Unknown @ 0x8A529968)
SSDT[19] : NtAssignProcessToJobObject @ 0x805D66A0 -> HOOKED (Unknown @ 0x8A7DDA48)
SSDT[31] : NtConnectPort @ 0x805A45D8 -> HOOKED (Unknown @ 0x8A7A9C10)
SSDT[43] : NtCreateMutant @ 0x8061758E -> HOOKED (Unknown @ 0x8A524008)
SSDT[52] : NtCreateSymbolicLinkObject @ 0x805C3A02 -> HOOKED (Unknown @ 0x8A50D210)
SSDT[53] : NtCreateThread @ 0x805D1038 -> HOOKED (Unknown @ 0x8A4EA488)
SSDT[57] : NtDebugActiveProcess @ 0x80643A1C -> HOOKED (Unknown @ 0x8A7DD510)
SSDT[68] : NtDuplicateObject @ 0x805BE010 -> HOOKED (Unknown @ 0x8A71BD30)
SSDT[83] : NtFreeVirtualMemory @ 0x805B2FBA -> HOOKED (Unknown @ 0x8A53FCD8)
SSDT[89] : NtImpersonateAnonymousToken @ 0x805F9258 -> HOOKED (Unknown @ 0x8A7D8188)
SSDT[91] : NtImpersonateThread @ 0x805D7860 -> HOOKED (Unknown @ 0x8A7D1D58)
SSDT[97] : NtLoadDriver @ 0x80584172 -> HOOKED (Unknown @ 0x8A7FDB10)
SSDT[108] : NtMapViewOfSection @ 0x805B2042 -> HOOKED (Unknown @ 0x8A791160)
SSDT[114] : NtOpenEvent @ 0x8060EF4C -> HOOKED (Unknown @ 0x8A7DA630)
SSDT[122] : NtOpenProcess @ 0x805CB456 -> HOOKED (Unknown @ 0x8A79C440)
SSDT[123] : NtOpenProcessToken @ 0x805EDF26 -> HOOKED (Unknown @ 0x8A936258)
SSDT[125] : NtOpenSection @ 0x805AA3F4 -> HOOKED (Unknown @ 0x8A7DCB20)
SSDT[128] : NtOpenThread @ 0x805CB6E2 -> HOOKED (Unknown @ 0x8A6C6C00)
SSDT[137] : NtProtectVirtualMemory @ 0x805B8426 -> HOOKED (Unknown @ 0x8A507080)
SSDT[206] : NtResumeThread @ 0x805D4A18 -> HOOKED (Unknown @ 0x8AB4E958)
SSDT[213] : NtSetContextThread @ 0x805D2C1A -> HOOKED (Unknown @ 0x8A972D08)
SSDT[228] : NtSetInformationProcess @ 0x805CDEA0 -> HOOKED (Unknown @ 0x8A9AFD80)
SSDT[240] : NtSetSystemInformation @ 0x8060FC04 -> HOOKED (Unknown @ 0x8A7DCF00)
SSDT[253] : NtSuspendProcess @ 0x805D4AE0 -> HOOKED (Unknown @ 0x8A7DC9A8)
SSDT[254] : NtSuspendThread @ 0x805D4952 -> HOOKED (Unknown @ 0x8AB54410)
SSDT[257] : NtTerminateProcess @ 0x805D22D8 -> HOOKED (Unknown @ 0x8A95DA88)
SSDT[258] : NtTerminateThread @ 0x805D24D2 -> HOOKED (Unknown @ 0x8A95D928)
SSDT[267] : NtUnmapViewOfSection @ 0x805B2E50 -> HOOKED (Unknown @ 0x8A95FE08)
SSDT[277] : NtWriteVirtualMemory @ 0x805B43D4 -> HOOKED (Unknown @ 0x8A7D7B58)
S_SSDT[307] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x8A950228)
S_SSDT[383] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x8A80F6D0)
S_SSDT[414] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x8A8130E0)
S_SSDT[416] : NtUserGetKeyState -> HOOKED (Unknown @ 0x8A85EC20)
S_SSDT[428] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x8AA9AD38)
S_SSDT[460] : NtUserMessageCall -> HOOKED (Unknown @ 0x8A96B6C0)
S_SSDT[475] : NtUserPostMessage -> HOOKED (Unknown @ 0x8A968D50)
S_SSDT[476] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x8A97DA68)
S_SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x8A869A30)
S_SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x8A7EAE48)

¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: GB0250C8045 +++++
--- User ---
[MBR] a5d5a22d8110cf4a72a936d3376459c6
[BSP] dcc8aee2233fee74d23d1330cb19bf3d : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 238464 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[2]_D_04202013_02d1013.txt >>
RKreport[1]_S_04202013_02d1011.txt ; RKreport[2]_D_04202013_02d1013.txt



Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.04.20.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Robert :: MISBRI [administrator]

4/20/2013 10:29:49 AM
mbar-log-2013-04-20 (10-29-49).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 26250
Time elapsed: 11 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, J:\ DRIVE_FIXED
CPU speed: 2.104000 GHz
Memory total: 3152457728, free: 1892421632

------------ Kernel report ------------
04/20/2013 10:17:00
------------ Loaded modules -----------
\WINDOWS\system32\ntkrnlpa.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
pciide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
dmload.sys
dmio.sys
PartMgr.sys
VolSnap.sys
atapi.sys
nvata.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltmgr.sys
SYMDS.SYS
sr.sys
SYMEFA.SYS
PxHelp20.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
Mup.sys
\SystemRoot\system32\DRIVERS\AmdK8.sys
\SystemRoot\system32\DRIVERS\nv4_mini.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\bcm4sbxp.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\rdpdr.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\drivers\sthda.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\N360\0502020.003\SYMTDI.SYS
\SystemRoot\system32\DRIVERS\ipnat.sys
\??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\drivers\N360\0502020.003\Ironx86.SYS
\SystemRoot\system32\drivers\N360\0502020.003\SRTSPX.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
\??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20130412.001\BHDrvx86.sys
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\dump_nvata.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\drivers\aspi32.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\System32\Drivers\HTTP.sys
\SystemRoot\System32\Drivers\N360\0502020.003\SRTSP.SYS
\SystemRoot\System32\TSDDD.dll
\??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20130419.001\IDSxpx86.sys
\??\C:\WINDOWS\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\ipfltdrv.sys
\??\C:\DOCUME~1\Robert\LOCALS~1\Temp\aswMBR.sys
\??\C:\DOCUME~1\Robert\LOCALS~1\Temp\mbr.sys
\??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20130419.020\NAVEX15.SYS
\??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20130419.020\NAVENG.SYS
\SystemRoot\System32\nv4_disp.dll
\SystemRoot\system32\drivers\kmixer.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk5\DR14
Upper Device Object: 0xffffffff89e2bab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007d\
Lower Device Object: 0xffffffff88d8be80
Lower Device Driver Name: \Driver\usbstor\
Driver name found: usbstor
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk4\DR5
Upper Device Object: 0xffffffff8a504170
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000006f\
Lower Device Object: 0xffffffff8a50d960
Lower Device Driver Name: \Driver\usbstor\
Driver name found: usbstor
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR4
Upper Device Object: 0xffffffff8a7302f0
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000006e\
Lower Device Object: 0xffffffff8a509b08
Lower Device Driver Name: \Driver\usbstor\
Driver name found: usbstor
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR3
Upper Device Object: 0xffffffff8a6c7ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000006d\
Lower Device Object: 0xffffffff8a4f9ea0
Lower Device Driver Name: \Driver\usbstor\
Driver name found: usbstor
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR2
Upper Device Object: 0xffffffff8a538030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000006c\
Lower Device Object: 0xffffffff8a4eba08
Lower Device Driver Name: \Driver\usbstor\
Driver name found: usbstor
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8abeaab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000062\
Lower Device Object: 0xffffffff8ac51030
Lower Device Driver Name: \Driver\nvata\
Driver name found: nvata
Initialization returned 0x0
Load Function returned 0x0
Downloaded database version: v2013.04.20.05
Downloaded database version: v2013.04.17.03
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8abeaab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8ac248f8, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8abeaab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8ac5e420, DeviceName: \Device\00000064\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff8ac51030, DeviceName: \Device\00000062\, DriverName: \Driver\nvata\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe1eb4ff0, 0xffffffff8abeaab8, 0xffffffff8a1a7ab8
Lower DeviceData: 0xffffffffe3d6f298, 0xffffffff8ac51030, 0xffffffff8923fd10
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\WINDOWS\system32\drivers...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: E5E5234D

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 488375937
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 250059350016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-488377168-488397168)...
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff8a538030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a50e388, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a538030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a4eba08, DeviceName: \Device\0000006c\, DriverName: \Driver\usbstor\
------------ End ----------
Physical Sector Size: 0
Drive: 2, DevicePointer: 0xffffffff8a6c7ab8, DeviceName: \Device\Harddisk2\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a4f7e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a6c7ab8, DeviceName: \Device\Harddisk2\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a4f9ea0, DeviceName: \Device\0000006d\, DriverName: \Driver\usbstor\
------------ End ----------
Physical Sector Size: 0
Drive: 3, DevicePointer: 0xffffffff8a7302f0, DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a5227d8, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a7302f0, DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a509b08, DeviceName: \Device\0000006e\, DriverName: \Driver\usbstor\
------------ End ----------
Physical Sector Size: 0
Drive: 4, DevicePointer: 0xffffffff8a504170, DeviceName: \Device\Harddisk4\DR5\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a4f98c8, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a504170, DeviceName: \Device\Harddisk4\DR5\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a50d960, DeviceName: \Device\0000006f\, DriverName: \Driver\usbstor\
------------ End ----------
Physical Sector Size: 512
Drive: 5, DevicePointer: 0xffffffff89e2bab8, DeviceName: \Device\Harddisk5\DR14\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff88badaf0, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff89e2bab8, DeviceName: \Device\Harddisk5\DR14\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff88d8be80, DeviceName: \Device\0000007d\, DriverName: \Driver\usbstor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk5\DR14\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffe3dac6b0, 0xffffffff89e2bab8, 0xffffffff884f85f0
Lower DeviceData: 0xffffffffea374240, 0xffffffff88d8be80, 0xffffffff8a91f798
Drive 5
Scanning MBR on drive 5...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A4B57300

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 625137282

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072932864 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Done!
Scan finished
=======================================

 

I ran Combofix, only it didn't save the Combofix.txt file. I did a search for the file and it wasn't located. Should run the program again?
Thank you

 

Okay
Thank you

 

Results from ComboFix.

ComboFix 13-04-22.01 - Robert 04/22/2013 7:41.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3006.1554 [GMT -4:00]
Running from: c:\documents and settings\Robert\Desktop\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\SPL3701.tmp
c:\documents and settings\All Users\SPL6.tmp
C:\DSC02503.JPG
C:\DSC02504.JPG
C:\DSC02505.JPG
C:\DSC02509.JPG
C:\DSC04013.JPG
C:\DSC04014.JPG
C:\DSC04015.JPG
C:\DSC04016.JPG
C:\DSC04017.JPG
C:\DSC04018.JPG
C:\DSC04460.JPG
C:\DSC04461.JPG
C:\DSC04462.JPG
C:\DSC04475.JPG
C:\DSC04476.JPG
C:\DSC04477.JPG
C:\DSC04478.JPG
C:\DSC04479.JPG
C:\DSC04480.JPG
C:\DSC04481.JPG
C:\DSC04482.JPG
C:\DSC04483.JPG
C:\DSC04484.JPG
C:\DSC04690.JPG
C:\DSC04691.JPG
C:\DSC04692.JPG
C:\DSC04693.JPG
C:\DSC04694.JPG
C:\DSC04698.JPG
C:\DSC04699.JPG
C:\DSC04700.JPG
C:\DSC04761.JPG
C:\DSC04762.JPG
C:\DSC04860.JPG
C:\DSC04861.JPG
C:\DSC04862.JPG
C:\DSC04863.JPG
C:\DSC04864.JPG
C:\DSC04865.JPG
C:\DSC04866.JPG
C:\DSC04867.JPG
C:\DSC04868.JPG
C:\DSC04869.JPG
C:\DSC04870.JPG
C:\DSC05042.JPG
C:\DSC05067.JPG
C:\DSC05068.JPG
C:\DSC05069.JPG
C:\DSC05070.JPG
C:\DSC05071.JPG
C:\DSC05072.JPG
C:\DSC05073.JPG
C:\DSC05074.JPG
C:\DSC05075.JPG
C:\DSC05076.JPG
C:\DSC05077.JPG
C:\DSC05078.JPG
C:\DSC05079.JPG
C:\DSC05080.JPG
C:\DSC05081.JPG
C:\DSC05082.JPG
C:\DSC05083.JPG
C:\DSC05084.JPG
C:\DSC05085.JPG
C:\DSC05086.JPG
C:\DSC05087.JPG
C:\DSC05088.JPG
C:\DSC05089.JPG
C:\DSC05091.JPG
C:\DSC05095.JPG
C:\DSC05096.JPG
C:\DSC05097.JPG
C:\DSC05098.JPG
C:\DSC05099.JPG
C:\DSC05100.JPG
C:\DSC05102.JPG
C:\DSC05103.JPG
C:\DSC05104.JPG
C:\DSC05105.JPG
C:\DSC05106.JPG
C:\DSC05108.JPG
C:\DSC05109.JPG
C:\DSC05110.JPG
C:\DSC05111.JPG
C:\DSC05118.JPG
C:\DSC05119.JPG
C:\DSC05120.JPG
C:\DSC05121.JPG
C:\DSC05122.JPG
C:\DSC05123.JPG
C:\DSC05124.JPG
C:\DSC05125.JPG
C:\DSC05126.JPG
C:\DSC05144.JPG
C:\DSC05145.JPG
C:\DSC05146.JPG
C:\DSC05147.JPG
C:\DSC05148.JPG
C:\DSC05149.JPG
C:\DSC05153.JPG
C:\DSCF0001.JPG
C:\DSCF0002.JPG
C:\DSCF0007.JPG
C:\DSCF0008.JPG
C:\DSCF0009.JPG
C:\DSCF0163.JPG
C:\DSCF0164.JPG
C:\DSCF0165.JPG
C:\DSCF0166.JPG
C:\DSCF0167.JPG
C:\DSCF0168.JPG
C:\DSCF0169.JPG
C:\DSCF0170.JPG
C:\DSCF0171.JPG
C:\DSCF0172.JPG
C:\DSCF0173.JPG
C:\DSCF0174.JPG
C:\DSCF0175.JPG
C:\DSCF0177.JPG
C:\DSCF0178.JPG
C:\DSCF0179.JPG
C:\DSCF0180.JPG
C:\DSCF0181.JPG
C:\DSCF0182.JPG
C:\DSCF0183.JPG
C:\DSCF0187.JPG
C:\DSCF0188.JPG
C:\DSCF0189.JPG
C:\DSCF0190.JPG
C:\DSCF0191.JPG
C:\DSCF0192.JPG
C:\DSCF0193.JPG
C:\DSCF0194.JPG
C:\DSCF0195.JPG
C:\DSCF0196.JPG
C:\DSCF0197.JPG
C:\DSCF0198.JPG
C:\DSCF0237.JPG
C:\DSCF0239.JPG
C:\DSCF0247.JPG
C:\DSCF0248.JPG
C:\DSCF0250.JPG
C:\DSCF0252.JPG
C:\DSCF0253.JPG
C:\DSCF0254.JPG
C:\DSCF0336.JPG
C:\DSCF0357.JPG
C:\DSCF0549.JPG
C:\DSCF0550.JPG
C:\DSCF0551.JPG
C:\DSCF0552.JPG
C:\DSCF0553.JPG
C:\DSCF0554.JPG
C:\DSCF0555.JPG
C:\DSCF0556.JPG
C:\DSCF0564.JPG
C:\DSCF0565.JPG
C:\DSCF0566.JPG
C:\DSCF0567.JPG
C:\DSCF0568.JPG
C:\DSCF0569.JPG
C:\DSCF0570.JPG
C:\DSCF0571.JPG
C:\DSCF0572.JPG
C:\DSCF0963.JPG
C:\DSCF0964.JPG
C:\DSCF0965.JPG
C:\DSCF0966.JPG
C:\DSCF0967.JPG
C:\DSCF0968.JPG
C:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-03-22 to 2013-04-22 )))))))))))))))))))))))))))))))
.
.
2013-04-19 23:38 . 2013-04-19 23:38 -------- d-----w- c:\documents and settings\Robert\Application Data\Malwarebytes
2013-04-19 23:37 . 2013-04-19 23:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2013-04-19 23:37 . 2013-04-19 23:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-04-19 23:37 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-16 16:00 . 2013-04-16 16:00 -------- d-----w- c:\documents and settings\Robert\Application Data\PowerISO
2013-04-16 15:46 . 2013-04-16 15:46 -------- d-----w- c:\documents and settings\Robert\Application Data\SwvUpdater
2013-04-16 15:46 . 2002-07-17 14:03 45056 ----a-w- c:\windows\system32\WNASPI32.DLL
2013-04-16 15:46 . 2002-07-17 12:53 16877 ----a-w- c:\windows\system32\drivers\ASPI32.SYS
2013-04-16 15:46 . 2013-04-16 15:46 -------- d-----w- c:\program files\Conduit
2013-04-16 15:46 . 2013-04-16 15:51 -------- d-----w- c:\documents and settings\Robert\Local Settings\Application Data\Conduit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-11 14:22 . 2011-02-20 03:03 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-04-11 14:22 . 2011-02-19 04:40 770384 ----a-w- c:\windows\system32\msvcr100.dll
2013-02-19 00:58 . 2013-02-19 00:58 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-19 00:58 . 2011-10-28 15:14 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-21 01:14 . 2013-04-12 13:38 303416 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
2013-04-12 13:38 . 2013-04-12 13:37 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-08-23 7630848]
"nwiz "= "nwiz.exe" [2006-08-23 1617920]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-08-23 86016]
"SigmatelSysTrayApp "= "stsystra.exe" [2006-07-27 282624]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"dldtmon.exe "= "c:\program files\Dell V305\dldtmon.exe" [2008-06-24 668912]
"dldtamon "= "c:\program files\Dell V305\dldtamon.exe" [2008-06-24 16624]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-11-13 421736]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-24 926896]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Constant Guard.lnk - c:\program files\Constant Guard Protection Suite\IDVault.exe [N/A]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Dell V305\\dldtamon.exe "=
"c:\\Program Files\\Dell V305\\frun.exe "=
"c:\\Program Files\\Dell V305\\dldtmon.exe "=
"c:\\WINDOWS\\system32\\dldtcfg.exe "=
"c:\\WINDOWS\\system32\\dldtcoms.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldtpswx.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldttime.exe "=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldtjswx.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Dell V305\\dldtlscn.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0502020.003\symds.sys [7/16/2012 4:16 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0502020.003\symefa.sys [7/16/2012 4:16 PM 744568]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20130412.001\BHDrvx86.sys [4/12/2013 7:53 PM 1000024]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0502020.003\ironx86.sys [7/16/2012 4:16 PM 136312]
R2 dldt_device;dldt_device;c:\windows\system32\dldtcoms.exe -service --> c:\windows\system32\dldtcoms.exe -service [?]
R2 IDVaultSvc;CGPS Service;c:\program files\Constant Guard Protection Suite\IDVaultSvc.exe [8/30/2012 10:01 AM 62064]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [4/19/2013 7:37 PM 418376]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [4/19/2013 7:37 PM 701512]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\5.2.2.3\ccsvchst.exe [7/16/2012 4:16 PM 130008]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/9/2012 2:50 PM 106656]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20130419.001\IDSXpx86.sys [4/19/2013 5:57 PM 373728]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [4/19/2013 7:37 PM 22856]
S2 dldtCATSCustConnectService;dldtCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dldtserv.exe [10/28/2011 1:48 PM 99568]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\documents and settings\Robert\Application Data\Mozilla\Firefox\Profiles\xt7ojczo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&CUI=UN25537841211507552&UM=2&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - WhiteSmoke New Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN25537841211507552&UM=2&q=
FF - ExtSQL: !HIDDEN! 2011-11-05 03:05; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-22 07:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath "= "\ "c:\program files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe\" /s \ "N360\" /m \ "c:\program files\Norton Security Suite\Engine\5.2.2.3\diMaster.dll\" /prefetch:1 "
.
Completion time: 2013-04-22 07:50:15
ComboFix-quarantined-files.txt 2013-04-22 11:50
.
Pre-Run: 109,458,698,240 bytes free
Post-Run: 109,639,254,016 bytes free
.
- - End Of File - - 5E5FBC6F32FA588270262F9ADE2BAC95

 

The computer is running just fine.
As always, I thank you for the time you afforded me in helping me resolve this issue.
Thank you,
Brimis

 

Results from AdwCleaner and JRT.

# AdwCleaner v2.300 - Logfile created 05/03/2013 at 07:56:23
# Updated 28/04/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Robert - MISBRI
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Robert\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

File Found : C:\Documents and Settings\Marissa\Application Data\Mozilla\Firefox\Profiles\zm64jt5u.default\searchplugins\safesearch.xml
File Found : C:\Documents and Settings\Patty\Application Data\Mozilla\Firefox\Profiles\foqmyw8d.default\searchplugins\safesearch.xml
File Found : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\xt7ojczo.default\searchplugins\Conduit.xml
File Found : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\xt7ojczo.default\searchplugins\safesearch.xml
Folder Found : C:\Documents and Settings\Robert\Application Data\SwvUpdater
Folder Found : C:\Documents and Settings\Robert\Local Settings\Application Data\Conduit
Folder Found : C:\Program Files\Conduit

***** [Registry] *****

Key Found : HKCU\Software\ConduitSearchScopes
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3289847
Key Found : HKLM\Software\Conduit
Key Found : HKU\S-1-5-21-1417001333-1547161642-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Found : HKU\S-1-5-21-1417001333-1547161642-839522115-1004\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\xt7ojczo.default\prefs.js

Found : user_pref( "CT3289847.FF19Solved ", "true ");
Found : user_pref( "CT3289847.UserID ", "UN25537841211507552 ");
Found : user_pref( "CT3289847.browser.search.defaultthis.engineName ", "true ");
Found : user_pref( "CT3289847.installDate ", "16/4/2013 11:45:49 ");
Found : user_pref( "CT3289847.installerVersion ", "1.3.7.3 ");
Found : user_pref( "CT3289847.keyword ", "true ");
Found : user_pref( "Smartbar.ConduitHomepagesList ", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT328984[...]
Found : user_pref( "Smartbar.SearchFromAddressBarSavedUrl ", " ");
Found : user_pref( "browser.search.defaultthis.engineName ", "WhiteSmoke New Customized Web Search ");
Found : user_pref( "browser.search.defaulturl ", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&CUI[...]
Found : user_pref( "browser.search.selectedEngine ", "WhiteSmoke New Customized Web Search ");
Found : user_pref( "keyword.URL ", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CU[...]
Found : user_pref( "smartbar.conduitHomepageList ", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847[...]
Found : user_pref( "smartbar.conduitSearchAddressUrlList ", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Found : user_pref( "smartbar.originalSearchAddressUrl ", " ");
Found : user_pref( "smartbar.originalSearchEngine ", " ");

File : C:\Documents and Settings\Patty\Application Data\Mozilla\Firefox\Profiles\foqmyw8d.default\prefs.js

[OK] File is clean.

File : C:\Documents and Settings\Marissa\Application Data\Mozilla\Firefox\Profiles\zm64jt5u.default\prefs.js

[OK] File is clean.

File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2at90lej.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R3].txt - [3784 octets] - [03/05/2013 07:56:23]

########## EOF - C:\AdwCleaner[R3].txt - [3844 octets] ##########




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.3 (04.29.2013:2)
OS: Microsoft Windows XP x86
Ran by Robert on Fri 05/03/2013 at 8:03:29.32
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1417001333-1547161642-839522115-1003\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\classes\Toolbar.CT3289847
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A6B98DB2-3EBD-430D-9983-3F78FD2E1F6B}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Robert\Application Data\swvupdater "
Successfully deleted: [Folder] "C:\Documents and Settings\Robert\Local Settings\Application Data\conduit "
Successfully deleted: [Folder] "C:\Program Files\conduit "



~~~ FireFox

Successfully deleted: [File] "C:\Program Files\Mozilla Firefox\searchplugins\safesearch.xml "
Successfully deleted: [File] C:\Documents and Settings\Robert\Application Data\mozilla\firefox\profiles\xt7ojczo.default\searchplugins\conduit.xml
Successfully deleted: [File] C:\Documents and Settings\Robert\Application Data\mozilla\firefox\profiles\xt7ojczo.default\searchplugins\safesearch.xml
Successfully deleted the following from C:\Documents and Settings\Robert\Application Data\mozilla\firefox\profiles\xt7ojczo.default\prefs.js

user_pref( "Smartbar.ConduitHomepagesList ", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&SearchSource=61&CUI=UN25537841211507552&UM=2&UP=SP735B0A88-BABC-4947-8DC4
user_pref( "Smartbar.SearchFromAddressBarSavedUrl ", " ");
user_pref( "browser.search.defaultthis.engineName ", "WhiteSmoke New Customized Web Search ");
user_pref( "browser.search.defaulturl ", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&CUI=UN25537841211507552&UM=2&SearchSource=3&q={searchTerms} ");
user_pref( "browser.search.selectedEngine ", "WhiteSmoke New Customized Web Search ");
user_pref( "keyword.URL ", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN25537841211507552&UM=2&q= ");
user_pref( "smartbar.conduitHomepageList ", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&SearchSource=61&CUI=UN25537841211507552&UM=2&UP=SP735B0A88-BABC-4947-8DC4-
user_pref( "smartbar.conduitSearchAddressUrlList ", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN25537841211507552&UM=2&q= ");
user_pref( "smartbar.originalSearchAddressUrl ", " ");
user_pref( "smartbar.originalSearchEngine ", " ");





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 05/03/2013 at 8:07:14.96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Results from OTR.TXT

OTL logfile created on: 5/3/2013 8:14:11 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Robert\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.94 Gb Total Physical Memory | 1.60 Gb Available Physical Memory | 54.46% Memory free
4.78 Gb Paging File | 3.54 Gb Available in Paging File | 74.05% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 100.67 Gb Free Space | 43.23% Space Free | Partition Type: NTFS

Computer Name: MISBRI | User Name: Robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/03 08:13:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
PRC - [2012/10/08 10:50:23 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/08/30 10:04:24 | 000,062,064 | ---- | M] (White Sky, Inc.) -- C:\Program Files\Constant Guard Protection Suite\IDVaultSvc.exe
PRC - [2012/07/03 09:04:58 | 000,507,312 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe
PRC - [2011/04/16 20:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccsvchst.exe
PRC - [2008/06/24 02:27:40 | 000,025,840 | ---- | M] () -- C:\Program Files\Dell V305\dldtmsdmon.exe
PRC - [2008/06/24 02:26:16 | 000,668,912 | ---- | M] () -- C:\Program Files\Dell V305\dldtmon.exe
PRC - [2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/02/25 12:38:12 | 000,595,184 | ---- | M] ( ) -- C:\WINDOWS\system32\dldtcoms.exe
PRC - [2006/07/27 14:19:00 | 000,282,624 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe


========== Modules (No Company Name) ==========

MOD - [2012/05/09 03:09:42 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\9080c8e8e7b6dfb502c1328673d636f8\System.Management.ni.dll
MOD - [2012/05/09 03:08:31 | 000,256,000 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\660c4d6dd69ef22bc05587e1998cd135\SMDiagnostics.ni.dll
MOD - [2012/05/09 03:08:26 | 017,403,904 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\bc254d2fa26664898ae21d45643bc194\System.ServiceModel.ni.dll
MOD - [2012/05/09 03:08:04 | 002,345,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\505e12638acd6fdb22e1fd2d4c6fc232\System.Runtime.Serialization.ni.dll
MOD - [2012/05/09 03:08:00 | 001,070,080 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\e09496ddb2bf6f3b69707924f2e6b5ff\System.IdentityModel.ni.dll
MOD - [2012/05/09 03:06:22 | 000,141,312 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\bf7d6af03e1230ccad546a8659245ae9\System.Configuration.Install.ni.dll
MOD - [2012/05/09 03:06:21 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8dc4a28c456f81ee7399da21bd9d55aa\System.ServiceProcess.ni.dll
MOD - [2012/05/09 03:06:11 | 001,840,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\3e11aea7d742b5eddbd0b6bd1012f7df\System.Web.Services.ni.dll
MOD - [2012/05/09 03:06:09 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\7861cd979ea5db3fb7d30ed94fb0edd2\System.Web.ni.dll
MOD - [2012/05/09 03:05:58 | 006,616,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\12c6fe8d4dd78f9bddf847d3b2821c03\System.Data.ni.dll
MOD - [2012/05/09 03:05:26 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\995fcf39ead2c2a53e084505c2c67d49\System.Windows.Forms.ni.dll
MOD - [2012/05/09 03:05:16 | 001,591,808 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\8ca00132a08c69697adf1cda32ebd835\System.Drawing.ni.dll
MOD - [2012/05/09 03:04:58 | 003,325,440 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\6d8bef0d008389874e55c0308f0c18e5\WindowsBase.ni.dll
MOD - [2012/05/09 03:04:50 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll
MOD - [2012/05/09 03:04:45 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll
MOD - [2012/05/09 03:04:41 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll
MOD - [2012/05/09 03:04:21 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
MOD - [2012/05/09 03:03:34 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2008/06/24 02:27:40 | 000,025,840 | ---- | M] () -- C:\Program Files\Dell V305\dldtmsdmon.exe
MOD - [2008/06/24 02:26:16 | 000,668,912 | ---- | M] () -- C:\Program Files\Dell V305\dldtmon.exe
MOD - [2008/05/26 03:05:20 | 000,036,864 | ---- | M] () -- C:\Program Files\Dell V305\app4r.monitor.core.dll
MOD - [2008/05/26 03:05:20 | 000,028,672 | ---- | M] () -- C:\Program Files\Dell V305\app4r.monitor.common.dll
MOD - [2008/05/26 03:04:06 | 000,061,440 | ---- | M] () -- C:\Program Files\Dell V305\app4r.devmons.mcmdevmon.dll
MOD - [2008/03/18 18:05:05 | 000,782,336 | ---- | M] () -- C:\Program Files\Dell V305\dldtdrs.dll
MOD - [2008/03/18 18:04:20 | 000,380,928 | ---- | M] () -- C:\Program Files\Dell V305\dldtscw.dll
MOD - [2008/02/19 18:25:56 | 000,081,920 | ---- | M] () -- C:\Program Files\Dell V305\dldtcaps.dll
MOD - [2008/02/19 18:18:58 | 000,151,552 | ---- | M] () -- C:\Program Files\Dell V305\dldtmonr.dll
MOD - [2008/02/13 07:49:50 | 000,148,992 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtdrui.dll
MOD - [2008/02/13 07:49:17 | 000,115,200 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\dldtdrpp.dll
MOD - [2008/02/13 07:48:56 | 000,195,072 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtdr.dll
MOD - [2008/01/31 05:41:39 | 000,147,456 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtprpr.dll
MOD - [2008/01/28 16:39:09 | 001,339,392 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dldthpec.dll
MOD - [2008/01/21 22:05:12 | 000,077,906 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\DLDTcfg.dll
MOD - [2008/01/21 22:05:12 | 000,077,906 | ---- | M] () -- C:\Program Files\Dell V305\DLDTcfg.dll
MOD - [2007/11/22 04:55:48 | 000,011,776 | ---- | M] () -- C:\Program Files\Dell V305\app4r.devmons.mcmdevmon.autoplayutil.dll
MOD - [2007/11/13 15:13:09 | 000,069,632 | ---- | M] () -- C:\Program Files\Dell V305\dldtcnv4.dll
MOD - [2007/10/18 02:49:45 | 000,811,008 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtptpc.dll
MOD - [2007/05/29 03:39:08 | 000,589,824 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtdatr.dll
MOD - [2007/03/26 03:39:35 | 000,073,728 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtcats.dll
MOD - [2006/08/23 14:12:38 | 000,196,608 | ---- | M] () -- C:\WINDOWS\system32\nvapi.dll


========== Services (SafeList) ==========

SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/10/08 10:50:23 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012/08/30 10:04:24 | 000,062,064 | ---- | M] (White Sky, Inc.) [Auto | Running] -- C:\Program Files\Constant Guard Protection Suite\IDVaultSvc.exe -- (IDVaultSvc)
SRV - [2011/04/16 20:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe -- (N360)
SRV - [2008/02/25 12:38:16 | 000,099,568 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\dldtserv.exe -- (dldtCATSCustConnectService)
SRV - [2008/02/25 12:38:12 | 000,595,184 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\system32\dldtcoms.exe -- (dldt_device)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Robert\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2013/04/12 19:53:06 | 001,000,024 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20130412.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2013/01/16 01:38:24 | 001,603,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20130502.034\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/01/16 01:38:24 | 000,093,296 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20130502.034\NAVENG.SYS -- (NAVENG)
DRV - [2012/09/06 04:54:30 | 000,373,728 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20130502.001\IDSXpx86.sys -- (IDSxpx86)
DRV - [2012/08/08 22:48:22 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/08/08 22:48:22 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/10/28 13:12:08 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011/04/20 21:37:49 | 000,369,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0502020.003\symtdi.sys -- (SYMTDI)
DRV - [2011/03/30 23:00:09 | 000,516,216 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\N360\0502020.003\srtsp.sys -- (SRTSP)
DRV - [2011/03/30 23:00:09 | 000,050,168 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0502020.003\srtspx.sys -- (SRTSPX)
DRV - [2011/03/14 22:31:23 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0502020.003\symefa.sys -- (SymEFA)
DRV - [2011/01/27 02:47:10 | 000,340,088 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0502020.003\symds.sys -- (SymDS)
DRV - [2010/11/15 21:45:33 | 000,136,312 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0502020.003\ironx86.sys -- (SymIRON)
DRV - [2006/11/21 04:25:44 | 000,045,568 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/10/18 16:31:38 | 000,105,472 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)
DRV - [2006/07/27 14:24:28 | 001,171,464 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2006/06/18 23:37:34 | 000,036,864 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2002/07/17 08:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (Aspi32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {A6B98DB2-3EBD-430D-9983-3F78FD2E1F6B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKLM\..\SearchScopes\{2CEEF34B-3A8C-4E75-9ABE-1E3250BC4B25}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\..\SearchScopes,DefaultScope = {A6B98DB2-3EBD-430D-9983-3F78FD2E1F6B}
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\..\SearchScopes\{2CEEF34B-3A8C-4E75-9ABE-1E3250BC4B25}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_enUS463
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=360&chn=s1122&geo=US&ver=5
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_168.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10516.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2012/02/07 22:30:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn_2011_7_13_2 [2013/04/22 08:31:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/16 11:52:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/04/12 09:38:07 | 000,000,000 | ---D | M]

[2011/11/01 16:13:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Robert\Application Data\Mozilla\Extensions
[2013/04/18 08:18:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\xt7ojczo.default\extensions
[2012/02/04 20:17:34 | 000,020,591 | ---- | M] () (No name found) -- C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\xt7ojczo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2013/04/12 09:37:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/04/12 09:38:13 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/20 21:14:42 | 000,303,416 | ---- | M] (Cisco WebEx LLC) -- C:\Program Files\mozilla firefox\plugins\ieatgpc.dll
[2012/03/20 21:14:46 | 000,215,864 | ---- | M] (Cisco WebEx LLC) -- C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2013/02/06 01:01:56 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/02/20 11:31:12 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/04/22 07:48:19 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\5.2.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Constant Guard Protection Suite (COM)) - {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\Documents and Settings\All Users\Application Data\White Sky, Inc\ID Vault\IEBHO1.1.730.1\NativeBHO.dll (WhiteSky)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [dldtamon] C:\Program Files\Dell V305\dldtamon.exe ()
O4 - HKLM..\Run: [dldtmon.exe] C:\Program Files\Dell V305\dldtmon.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKU\S-1-5-21-1417001333-1547161642-839522115-1004..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil32_11_6_602_168_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Constant Guard.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1417001333-1547161642-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1417001333-1547161642-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\NPJPI150_11.dll (Sun Microsystems, Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/...ls/en/x86/client/wuweb_site.cab?1319813260218 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FB4F921-0E71-4114-88AA-FF727A58AE16}: DhcpNameServer = 75.75.75.75 75.75.76.76
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Robert\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Robert\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/10/28 08:28:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/03 08:13:05 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
[2013/05/03 08:03:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/03 08:03:03 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/02 08:36:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert\My Documents\2012 Taxes
[2013/05/01 18:30:20 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Robert\Recent
[2013/04/28 20:13:19 | 000,000,000 | ---D | C] -- C:\Fish
[2013/04/24 08:47:27 | 000,000,000 | ---D | C] -- C:\04232013
[2013/04/22 08:51:19 | 000,000,000 | ---D | C] -- C:\logs
[2013/04/22 08:35:57 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2013/04/21 09:25:16 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2013/04/21 09:22:54 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2013/04/21 09:22:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2013/04/21 09:22:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2013/04/21 09:22:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2013/04/21 09:22:33 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/04/21 09:22:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2013/04/20 10:10:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert\Desktop\RK_Quarantine
[2013/04/19 19:38:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert\Application Data\Malwarebytes
[2013/04/19 19:37:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/19 19:37:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2013/04/19 19:37:53 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/04/19 19:37:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/04/16 12:00:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert\Application Data\PowerISO
[2013/04/16 11:46:52 | 000,045,056 | ---- | C] (Adaptec) -- C:\WINDOWS\System32\WNASPI32.DLL
[2013/04/16 11:46:52 | 000,016,877 | ---- | C] (Adaptec) -- C:\WINDOWS\System32\drivers\ASPI32.SYS
[2013/04/16 11:45:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Real
[2013/04/16 11:44:13 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Robert\Start Menu\Programs\Administrative Tools
[2013/04/12 09:37:59 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/04/04 08:19:37 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox.bak
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/03 08:13:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
[2013/05/03 07:17:36 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\Microsoft Office Outlook 2003.lnk
[2013/05/03 07:04:56 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/05/01 18:07:08 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\Microsoft Office Word 2003.lnk
[2013/04/30 16:55:57 | 000,353,704 | ---- | M] () -- C:\TakamineEG340.JPG
[2013/04/28 20:35:44 | 000,158,720 | ---- | M] () -- C:\Documents and Settings\Robert\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/04/26 19:33:27 | 000,581,571 | ---- | M] () -- C:\GirlsGymBest.jpg
[2013/04/26 09:11:23 | 000,151,375 | ---- | M] () -- C:\pre calc.JPG
[2013/04/23 13:59:34 | 003,880,222 | ---- | M] () -- C:\DSC05178.JPG
[2013/04/23 13:53:36 | 004,418,361 | ---- | M] () -- C:\DSC05176.JPG
[2013/04/23 13:53:06 | 004,323,849 | ---- | M] () -- C:\DSC05175.JPG
[2013/04/23 13:52:56 | 004,487,880 | ---- | M] () -- C:\DSC05174.JPG
[2013/04/23 13:51:54 | 004,219,599 | ---- | M] () -- C:\DSC05173.JPG
[2013/04/23 13:51:44 | 004,132,724 | ---- | M] () -- C:\DSC05172.JPG
[2013/04/23 13:51:24 | 004,276,750 | ---- | M] () -- C:\DSC05171.JPG
[2013/04/23 13:51:14 | 004,418,272 | ---- | M] () -- C:\DSC05170.JPG
[2013/04/23 13:50:56 | 004,306,298 | ---- | M] () -- C:\DSC05169.JPG
[2013/04/23 13:50:48 | 004,136,663 | ---- | M] () -- C:\DSC05168.JPG
[2013/04/23 13:08:48 | 004,572,111 | ---- | M] () -- C:\DSC05166.JPG
[2013/04/23 13:08:36 | 004,426,650 | ---- | M] () -- C:\DSC05165.JPG
[2013/04/23 13:08:20 | 004,018,206 | ---- | M] () -- C:\DSC05164.JPG
[2013/04/23 00:05:29 | 000,081,191 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2013/04/23 00:05:23 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/04/22 12:40:20 | 000,005,560 | ---- | M] () -- C:\ill.php.png
[2013/04/22 08:30:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/04/22 07:48:19 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/04/21 09:25:21 | 000,000,339 | RHS- | M] () -- C:\boot.ini
[2013/04/20 18:13:38 | 000,023,128 | ---- | M] () -- C:\Nnh_front.svg.png
[2013/04/18 17:56:36 | 004,262,549 | ---- | M] () -- C:\DSC05159.JPG
[2013/04/18 17:56:22 | 004,224,355 | ---- | M] () -- C:\DSC05158.JPG
[2013/04/18 17:55:42 | 004,289,916 | ---- | M] () -- C:\DSC05157.JPG
[2013/04/06 08:42:09 | 000,436,026 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/04/06 08:42:09 | 000,068,796 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/04/05 12:33:46 | 000,281,386 | ---- | M] () -- C:\RPS Insurance Form.JPG
[2013/04/05 11:47:06 | 000,042,344 | ---- | M] () -- C:\fee79709-99c2-e111-9075-002655e6c126_original.jpg
[2013/04/05 11:46:50 | 000,089,687 | ---- | M] () -- C:\125383094.JIPm1SkR.GirlsJavelin0841.jpg
[2013/04/05 11:46:42 | 000,061,667 | ---- | M] () -- C:\140603_full.jpg
[2013/04/05 11:43:30 | 000,007,765 | ---- | M] () -- C:\10th_IAAF_World_Championships_in_Athletics_5euro_Reverse.JPG
[2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/30 16:55:56 | 000,353,704 | ---- | C] () -- C:\TakamineEG340.JPG
[2013/04/26 19:33:27 | 000,581,571 | ---- | C] () -- C:\GirlsGymBest.jpg
[2013/04/26 09:11:23 | 000,151,375 | ---- | C] () -- C:\pre calc.JPG
[2013/04/24 08:46:14 | 004,289,916 | ---- | C] () -- C:\DSC05157.JPG
[2013/04/24 08:46:13 | 004,418,361 | ---- | C] () -- C:\DSC05176.JPG
[2013/04/24 08:46:13 | 003,880,222 | ---- | C] () -- C:\DSC05178.JPG
[2013/04/24 08:46:12 | 004,487,880 | ---- | C] () -- C:\DSC05174.JPG
[2013/04/24 08:46:12 | 004,323,849 | ---- | C] () -- C:\DSC05175.JPG
[2013/04/24 08:46:12 | 004,219,599 | ---- | C] () -- C:\DSC05173.JPG
[2013/04/24 08:46:11 | 004,276,750 | ---- | C] () -- C:\DSC05171.JPG
[2013/04/24 08:46:11 | 004,132,724 | ---- | C] () -- C:\DSC05172.JPG
[2013/04/24 08:46:10 | 004,418,272 | ---- | C] () -- C:\DSC05170.JPG
[2013/04/24 08:46:10 | 004,306,298 | ---- | C] () -- C:\DSC05169.JPG
[2013/04/24 08:46:09 | 004,572,111 | ---- | C] () -- C:\DSC05166.JPG
[2013/04/24 08:46:09 | 004,136,663 | ---- | C] () -- C:\DSC05168.JPG
[2013/04/24 08:46:08 | 004,426,650 | ---- | C] () -- C:\DSC05165.JPG
[2013/04/24 08:46:08 | 004,018,206 | ---- | C] () -- C:\DSC05164.JPG
[2013/04/24 08:46:07 | 004,262,549 | ---- | C] () -- C:\DSC05159.JPG
[2013/04/24 08:46:07 | 004,224,355 | ---- | C] () -- C:\DSC05158.JPG
[2013/04/22 12:39:39 | 000,005,560 | ---- | C] () -- C:\ill.php.png
[2013/04/21 09:25:19 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2013/04/21 09:22:54 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/04/21 09:22:53 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/04/21 09:22:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/04/21 09:22:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/04/21 09:22:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2013/04/20 18:13:37 | 000,023,128 | ---- | C] () -- C:\Nnh_front.svg.png
[2013/04/05 12:22:00 | 000,281,386 | ---- | C] () -- C:\RPS Insurance Form.JPG
[2013/04/05 11:47:06 | 000,042,344 | ---- | C] () -- C:\fee79709-99c2-e111-9075-002655e6c126_original.jpg
[2013/04/05 11:46:50 | 000,089,687 | ---- | C] () -- C:\125383094.JIPm1SkR.GirlsJavelin0841.jpg
[2013/04/05 11:46:42 | 000,061,667 | ---- | C] () -- C:\140603_full.jpg
[2013/04/05 11:43:30 | 000,007,765 | ---- | C] () -- C:\10th_IAAF_World_Championships_in_Athletics_5euro_Reverse.JPG
[2012/05/09 03:20:09 | 000,251,544 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/03/20 20:02:12 | 000,051,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\atnt40k.sys
[2012/02/15 23:51:29 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/04 13:38:17 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2011/11/21 07:42:25 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/11/05 18:58:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/10/28 13:48:37 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dldtvs.dll
[2011/10/28 13:48:29 | 000,360,448 | ---- | C] () -- C:\WINDOWS\System32\dldtcoin.dll
[2011/10/28 13:48:05 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\dldtdrs.dll
[2011/10/28 13:48:05 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\dldtcaps.dll
[2011/10/28 13:48:04 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\dldtcnv4.dll
[2011/10/28 13:45:49 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\dldtwupd.dll
[2011/10/28 13:45:49 | 000,017,648 | ---- | C] () -- C:\WINDOWS\System32\dldtwupd.exe
[2011/10/28 13:45:31 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\DLDThcp.dll
[2011/10/28 13:45:31 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\DLDTinst.dll
[2011/10/28 13:45:30 | 001,105,920 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtserv.dll
[2011/10/28 13:45:30 | 000,843,776 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtusb1.dll
[2011/10/28 13:45:30 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\dldtutil.dll
[2011/10/28 13:45:30 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtinpa.dll
[2011/10/28 13:45:30 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtiesc.dll
[2011/10/28 13:45:29 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtpmui.dll
[2011/10/28 13:45:29 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtlmpm.dll
[2011/10/28 13:45:29 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\dldtjswr.dll
[2011/10/28 13:45:29 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtprox.dll
[2011/10/28 13:45:28 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\dldthbn3.dll
[2011/10/28 13:45:28 | 000,320,752 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtih.exe
[2011/10/28 13:45:28 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\dldtgrd.dll
[2011/10/28 13:45:28 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\dldtinsb.dll
[2011/10/28 13:45:28 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\dldtins.dll
[2011/10/28 13:45:28 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dldtinsr.dll
[2011/10/28 13:45:27 | 000,851,968 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtcomc.dll
[2011/10/28 13:45:27 | 000,595,184 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtcoms.exe
[2011/10/28 13:45:27 | 000,376,832 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtcomm.dll
[2011/10/28 13:45:27 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dldtcub.dll
[2011/10/28 13:45:27 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\dldtcu.dll
[2011/10/28 13:45:27 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dldtcur.dll
[2011/10/28 13:45:26 | 000,365,808 | ---- | C] ( ) -- C:\WINDOWS\System32\dldtcfg.exe
[2011/10/28 13:45:26 | 000,077,906 | ---- | C] () -- C:\WINDOWS\System32\DLDTcfg.dll
[2011/10/28 11:27:00 | 000,158,720 | ---- | C] () -- C:\Documents and Settings\Robert\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/28 11:00:47 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/10/28 09:57:11 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2011/10/28 09:57:11 | 001,617,920 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2011/10/28 09:57:11 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2011/10/28 09:57:10 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2011/10/28 09:57:09 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2011/10/28 09:57:09 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2011/10/28 09:57:09 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2011/10/28 09:57:09 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2011/10/28 09:57:08 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2011/10/28 09:57:08 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2011/10/28 09:57:07 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2011/10/28 08:30:23 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/10/28 08:25:44 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/10/28 04:16:53 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/10/28 04:15:54 | 000,192,976 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2011/10/28 10:17:23 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 06:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 06:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2011/10/28 10:41:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\ID Vault
[2011/10/28 10:22:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IsolatedStorage
[2013/02/06 12:42:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2011/10/28 10:16:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\White Sky, Inc
[2011/11/15 21:31:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/12/06 22:21:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Britni\Application Data\ID Vault
[2011/11/19 16:38:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\ID Vault
[2012/07/30 14:03:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marissa\Application Data\ID Vault
[2012/08/29 13:47:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patty\Application Data\ID Vault
[2012/09/08 21:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\ID Vault
[2013/04/18 08:13:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\Juniper Networks
[2013/04/16 12:00:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\PowerISO
[2012/12/07 13:05:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\webex

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Robert\My Documents\atomic+number.bmp:Roxio EMC Stream

< End of report >

 

Results from Extras.TXT
OTL Extras logfile created on: 5/3/2013 8:14:11 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Robert\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.94 Gb Total Physical Memory | 1.60 Gb Available Physical Memory | 54.46% Memory free
4.78 Gb Paging File | 3.54 Gb Available in Paging File | 74.05% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 100.67 Gb Free Space | 43.23% Space Free | Partition Type: NTFS

Computer Name: MISBRI | User Name: Robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1417001333-1547161642-839522115-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-1417001333-1547161642-839522115-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Dell V305\dldtamon.exe" = C:\Program Files\Dell V305\dldtamon.exe:*:Enabledell Device Monitor -- ()
"C:\Program Files\Dell V305\frun.exe" = C:\Program Files\Dell V305\frun.exe:*:Enabledell Imaging Toolbox -- ()
"C:\Program Files\Dell V305\dldtmon.exe" = C:\Program Files\Dell V305\dldtmon.exe:*:Enabledrinter Device Monitor -- ()
"C:\WINDOWS\system32\dldtcfg.exe" = C:\WINDOWS\system32\dldtcfg.exe:*:Enabledrinter Communication System -- ( )
"C:\WINDOWS\system32\dldtcoms.exe" = C:\WINDOWS\system32\dldtcoms.exe:*:Enabled:Lexmark Communications System -- ( )
"C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtpswx.exe:*:Enabledrinter Status Window Interface -- ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\dldttime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\dldttime.exe:*:Enabled:Time Executable -- ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\dldtjswx.exe:*:Enabled:Job Status Window Interface -- ()
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Dell V305\dldtlscn.exe" = C:\Program Files\Dell V305\dldtlscn.exe:*:Enabled: -- ()
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2764CA82-DFB9-4498-AF85-719340BF5305}" = Dell Resource CD
"{3127F76D-5335-4AC7-BD1E-2F5247A23C24}" = iTunes
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{33A4E9B6-6952-4F81-B997-03852D71CBD6}" = Reel Deal Slot Mysteries Pyramid Conspiracy
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{378AA12C-D409-49A9-80DF-20F035B38D9A}" = Cisco WebEx Meeting Center for Firefox or Chrome
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612B9183-67A9-4B44-9877-2F059E35B86A}" = Broadcom 440x 10/100 Integrated Controller
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9D0F85-5658-4A5E-95A9-65F7DB2916EE}" = Broadcom 440x 10/100 Integrated Controller
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI
"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{CE2121C6-C94D-4A73-8EA4-6943F33EE335}" = Music Transfer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime
"{FB64BF25-3593-4E4E-AA85-84AEF1D1475F}" = Broadcom Management Programs
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"ActiveTouchMeetingClient" = Cisco WebEx Meetings
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Dell V305" = Dell V305
"Fast Video Converter_is1" = Fast Video Converter 1.0
"ID Vault" = Constant Guard Protection Suite
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"N360" = Norton Security Suite
"NVIDIA Drivers" = NVIDIA Drivers
"WIC" = Windows Imaging Component
"Windows XP Service Pack" = Windows XP Service Pack 3
"XP Codec Pack" = XP Codec Pack
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 4/16/2013 11:52:38 AM | Computer Name = MISBRI | Source = CltMngSvc | ID = 1000
Description =

Error - 4/17/2013 10:06:22 PM | Computer Name = MISBRI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x04277e30.

Error - 4/18/2013 7:57:40 AM | Computer Name = MISBRI | Source = Microsoft Office 11 | ID = 1000
Description =

Error - 4/19/2013 8:33:35 AM | Computer Name = MISBRI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x052f7e30.

Error - 4/21/2013 3:05:04 PM | Computer Name = MISBRI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x08217e30.

Error - 4/23/2013 6:33:29 PM | Computer Name = MISBRI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x03967e30.

Error - 4/27/2013 6:51:54 AM | Computer Name = MISBRI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x038e7e30.

Error - 4/28/2013 5:39:00 PM | Computer Name = MISBRI | Source = Microsoft Office 11 | ID = 1000
Description =

Error - 4/29/2013 12:37:13 PM | Computer Name = MISBRI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x03d97e30.

Error - 5/1/2013 6:13:47 PM | Computer Name = MISBRI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x041d7e30.

[ System Events ]
Error - 4/17/2013 8:38:26 PM | Computer Name = MISBRI | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk6\D, has a bad block.

Error - 4/17/2013 8:38:30 PM | Computer Name = MISBRI | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk6\D, has a bad block.

Error - 4/17/2013 8:38:33 PM | Computer Name = MISBRI | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk6\D, has a bad block.

Error - 4/18/2013 8:22:40 AM | Computer Name = MISBRI | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dldtCATSCustConnectService
service to connect.

Error - 4/18/2013 8:22:40 AM | Computer Name = MISBRI | Source = Service Control Manager | ID = 7000
Description = The dldtCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 4/21/2013 9:33:01 AM | Computer Name = MISBRI | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dldtCATSCustConnectService
service to connect.

Error - 4/21/2013 9:33:01 AM | Computer Name = MISBRI | Source = Service Control Manager | ID = 7000
Description = The dldtCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 4/22/2013 8:31:16 AM | Computer Name = MISBRI | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dldtCATSCustConnectService
service to connect.

Error - 4/22/2013 8:31:16 AM | Computer Name = MISBRI | Source = Service Control Manager | ID = 7000
Description = The dldtCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 5/1/2013 6:05:38 PM | Computer Name = MISBRI | Source = Print | ID = 6161
Description = The document Microsoft Word - Document2 owned by Robert failed to
print on printer Dell V305. Data type: LEMF. Size of the spool file in bytes: 26662.
Number of bytes printed: 26662. Total number of pages in the document: 1. Number
of pages printed: 0. Client machine: \\MISBRI. Win32 error code returned by the
print processor: 0 (0x0).


< End of report >

 

Scan results:

Farbar Service Scanner Version: 14-04-2013
Ran by Robert (administrator) on 03-05-2013 at 18:15:16
Running from "C:\Documents and Settings\Robert\Desktop "
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall "=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(3) IPSec(5) NetBT(6) PSched(7) SYMTDI(8) Tcpip(4)
0x080000000500000001000000020000000300000004000000080000000600000007000000
IpSec Tag value is correct.

**** End of log ****

Results of screen317's Security Check version 0.99.63
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
Please wait while WMIC compiles updated MOF files.d
i
s
p
l
a
y
N
a
m
e
ECHO is off.
N
o
r
t
o
n
ECHO is off.
S
e
c
u
r
i
t
y
ECHO is off.
S
u
i
t
e
ECHO is off.
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 7
Java version out of Date!
Adobe Flash Player 11.6.602.168
Adobe Reader XI
Mozilla Firefox (Meeting.)
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 0%
````````````````````End of Log``````````````````````


All processes killed
========== OTL ==========
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service USBAAPL stopped successfully!
Service USBAAPL deleted successfully!
File System32\Drivers\usbaapl.sys not found.
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service Changer stopped successfully!
Service Changer deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\DOCUME~1\Robert\LOCALS~1\Temp\catchme.sys not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1417001333-1547161642-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Constant Guard.lnk moved successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1417001333-1547161642-839522115-1004\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
ADS C:\Documents and Settings\Robert\My Documents\atomic+number.bmp:Roxio EMC Stream deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
->FireFox cache emptied: 26562615 bytes
->Flash cache emptied: 456 bytes

User: All Users

User: Britni
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 469 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56475 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Marissa
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 469 bytes
->FireFox cache emptied: 1091759404 bytes
->Flash cache emptied: 8274366 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Patty
->Temp folder emptied: 2846 bytes
->Temporary Internet Files folder emptied: 44783 bytes
->FireFox cache emptied: 69412379 bytes
->Flash cache emptied: 124279 bytes

User: Robert
->Temp folder emptied: 177710 bytes
->Temporary Internet Files folder emptied: 8765480 bytes
->FireFox cache emptied: 702522775 bytes
->Flash cache emptied: 8339664 bytes

%systemdrive% .tmp files removed: 722794 bytes
%systemroot% .tmp files removed: 2162283 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16823 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1133994815 bytes

Total Files Cleaned = 2,912.00 mb


[EMPTYJAVA]

User: Administrator

User: All Users

User: Britni

User: Default User

User: LocalService

User: Marissa

User: NetworkService

User: Patty

User: Robert

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Britni
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: Marissa
->Flash cache emptied: 0 bytes

User: NetworkService

User: Patty
->Flash cache emptied: 0 bytes

User: Robert
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 05032013_174746

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Patty\Local Settings\Temp\AdobeARM.log not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_25c.dat not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

Sorry man.

C:\Britni USB Drive 010312\World History.lnk Win32/Dorkbot.D worm cleaned by deleting - quarantined
C:\Documents and Settings\Robert\My Documents\Britnis Backup\Britni\Documents\Incomplete\T-5088466-stevie ray.snd a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined