Solved Posting Log Files as instructed to rid of virus

[Resolved] Posting Log Files as instructed to rid of virus

Hi,
I am posting the four files you requested in my previous posting.
Thank you for any help you can provide.

Jean

MALWAREBYTES

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6273

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/5/2011 4:43:29 AM
mbam-log-2011-04-05 (04-43-29).txt

Scan type: Quick scan
Objects scanned: 159514
Time elapsed: 3 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-05 11:15:46
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e SAMSUNG_HD080HJ rev.WT100-33
Running: 05q74xhv.exe; Driver: C:\DOCUME~1\Peter\LOCALS~1\Temp\pgdyapoc.sys


---- Kernel code sections - GMER 1.0.15 ----

init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF78BBF80]

---- Devices - GMER 1.0.15 ----

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

---- EOF - GMER 1.0.15 ----

MBRCheck

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 173):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xF89F5000 \WINDOWS\system32\KDCOM.DLL
0xF8905000 \WINDOWS\system32\BOOTVID.dll
0xF83C6000 ACPI.sys
0xF89F7000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF83B5000 pci.sys
0xF84F5000 isapnp.sys
0xF8ABD000 pciide.sys
0xF8775000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF89F9000 aliide.sys
0xF89FB000 cmdide.sys
0xF89FD000 toside.sys
0xF89FF000 viaide.sys
0xF8A01000 intelide.sys
0xF8505000 MountMgr.sys
0xF8396000 ftdisk.sys
0xF877D000 PartMgr.sys
0xF8515000 VolSnap.sys
0xF8909000 cpqarray.sys
0xF837E000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
0xF8366000 atapi.sys
0xF890D000 aha154x.sys
0xF8785000 sparrow.sys
0xF8911000 symc810.sys
0xF8525000 aic78xx.sys
0xF8915000 dac960nt.sys
0xF8535000 ql10wnt.sys
0xF8919000 amsint.sys
0xF878D000 asc.sys
0xF891D000 asc3550.sys
0xF8795000 mraid35x.sys
0xF879D000 i2omp.sys
0xF8921000 ini910u.sys
0xF8545000 ql1240.sys
0xF8555000 aic78u2.sys
0xF87A5000 symc8xx.sys
0xF87AD000 sym_hi.sys
0xF87B5000 sym_u3.sys
0xF87BD000 ABP480N5.SYS
0xF87C5000 asc3350p.sys
0xF8A03000 cd20xrnt.sys
0xF8565000 ultra.sys
0xF834D000 adpu160m.sys
0xF87CD000 dpti2o.sys
0xF8575000 ql1080.sys
0xF8585000 ql1280.sys
0xF8595000 ql12160.sys
0xF87D5000 perc2.sys
0xF8A05000 perc2hib.sys
0xF87DD000 hpn.sys
0xF8925000 cbidf2k.sys
0xF8321000 dac2w2k.sys
0xF85A5000 disk.sys
0xF85B5000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF8301000 fltmgr.sys
0xF82EF000 sr.sys
0xF82DA000 drvmcdb.sys
0xF85C5000 PxHelp20.sys
0xF82C3000 KSecDD.sys
0xF8236000 Ntfs.sys
0xF8209000 NDIS.sys
0xF85D5000 sisagp.sys
0xF85E5000 viaagp.sys
0xF81EF000 Mup.sys
0xF85F5000 agp440.sys
0xF8605000 alim1541.sys
0xF8615000 amdagp.sys
0xF8625000 agpCPQ.sys
0xF810F000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF7BAB000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xF7B97000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF88E5000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7B73000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF88ED000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7B3F000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys
0xF7B1C000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7A1D000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
0xF7976000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xF88F5000 \SystemRoot\System32\Drivers\Modem.SYS
0xF794E000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xF790E000 \SystemRoot\system32\drivers\smwdm.sys
0xF78EA000 \SystemRoot\system32\drivers\portcls.sys
0xF80FF000 \SystemRoot\system32\drivers\drmk.sys
0xF7837000 \SystemRoot\system32\drivers\senfilt.sys
0xF80EF000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF88FD000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF87ED000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7823000 \SystemRoot\system32\DRIVERS\parport.sys
0xF80DF000 \SystemRoot\system32\DRIVERS\serial.sys
0xF89F1000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF8645000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF8A21000 \SystemRoot\system32\drivers\sscdbhk5.sys
0xF8655000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF8665000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF8AD3000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF8675000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF81C7000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF780C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF8685000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF8695000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF8805000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF77FB000 \SystemRoot\system32\DRIVERS\psched.sys
0xF86A5000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF880D000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF8815000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF86B5000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF8A23000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF779D000 \SystemRoot\system32\DRIVERS\update.sys
0xF81BB000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF881D000 \SystemRoot\system32\DRIVERS\omci.sys
0xF86D5000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF86E5000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF8A25000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF8197000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF89C5000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF8835000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xAA5AE000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xF8A63000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8BA7000 \SystemRoot\System32\Drivers\Null.SYS
0xF8A65000 \SystemRoot\System32\Drivers\Beep.SYS
0xF8865000 \SystemRoot\system32\drivers\ssrtln.sys
0xF886D000 \SystemRoot\System32\drivers\vga.sys
0xF8A67000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8A69000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF8875000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF887D000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7795000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAA52B000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAA4D2000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAA4AA000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF778D000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xAA488000 \SystemRoot\System32\drivers\afd.sys
0xF7D4A000 \SystemRoot\system32\DRIVERS\netbios.sys
0xAA45D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAA3C5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7D3A000 \SystemRoot\System32\Drivers\Fips.SYS
0xAA39F000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7D2A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xAA2DB000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xAA654000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8895000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8B3C000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBF15A000 \SystemRoot\System32\ATMFD.DLL
0xAA38F000 \SystemRoot\system32\drivers\drvnddm.sys
0xF8C08000 \SystemRoot\system32\dla\tfsndres.sys
0xAA225000 \SystemRoot\system32\dla\tfsnifs.sys
0xAA2A7000 \SystemRoot\system32\dla\tfsnopio.sys
0xF8A93000 \SystemRoot\system32\dla\tfsnpool.sys
0xF88C5000 \SystemRoot\system32\dla\tfsnboio.sys
0xAA37F000 \SystemRoot\system32\dla\tfsncofs.sys
0xF8C09000 \SystemRoot\system32\dla\tfsndrct.sys
0xAA20C000 \SystemRoot\system32\dla\tfsnudf.sys
0xAA1F3000 \SystemRoot\system32\dla\tfsnudfa.sys
0xAA14F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9D06000 \SystemRoot\system32\drivers\wdmaud.sys
0xA9E6B000 \SystemRoot\system32\drivers\sysaudio.sys
0xA9B93000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xA9F2B000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA9DE3000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA9A73000 \SystemRoot\system32\DRIVERS\srv.sys
0xA9582000 \SystemRoot\System32\Drivers\HTTP.sys
0xA9246000 \??\C:\DOCUME~1\Peter\LOCALS~1\Temp\pgdyapoc.sys
0xF88CD000 \??\c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C783FA79-1365-4A51-AECD-C858F42114C7}\MpKslf44a044c.sys
0xF884D000 \??\C:\DOCUME~1\Peter\LOCALS~1\Temp\mbr.sys
0xA921B000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll

Processes (total 29):
0 System Idle Process
4 System
572 C:\WINDOWS\SYSTEM32\smss.exe
620 csrss.exe
644 C:\WINDOWS\SYSTEM32\winlogon.exe
688 C:\WINDOWS\SYSTEM32\services.exe
700 C:\WINDOWS\SYSTEM32\lsass.exe
888 C:\WINDOWS\SYSTEM32\svchost.exe
956 svchost.exe
1052 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
1088 C:\WINDOWS\SYSTEM32\svchost.exe
1212 svchost.exe
1308 svchost.exe
1524 C:\WINDOWS\SYSTEM32\LEXBCES.EXE
1568 C:\WINDOWS\SYSTEM32\spoolsv.exe
1588 C:\WINDOWS\SYSTEM32\LEXPPS.EXE
1784 C:\WINDOWS\explorer.exe
1860 C:\Program Files\Microsoft Security Client\msseces.exe
1892 C:\WINDOWS\SYSTEM32\ctfmon.exe
144 svchost.exe
216 C:\WINDOWS\SYSTEM32\cisvc.exe
240 C:\Program Files\Java\jre6\bin\jqs.exe
384 C:\Program Files\Dell Support Center\bin\sprtsvc.exe
492 C:\WINDOWS\SYSTEM32\svchost.exe
2700 alg.exe
752 C:\WINDOWS\SYSTEM32\svchost.exe
1700 C:\Program Files\Windows NT\Accessories\wordpad.exe
476 MpCmdRun.exe
2140 C:\Documents and Settings\Peter\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHD080HJ, Rev: WT100-33

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Dell MBR code detected
SHA1: 84B95CE8A54B7C5C3AAF149934FC46FB70FF8365


Done!

DDS (2 logs)

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Peter at 11:37:19.32 on Tue 04/05/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.190 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Peter\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://my.yahoo.com/?_bc=1
uSearch Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language
uSEARCH PAGE = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80229
mCustomizeSearch = hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80229
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
EB: {E16DC1FE-7C34-43F2-B754-F3AD12DDF97C} - No File
EB: {FE54FA40-D68C-11D2-98FA-00C0F0318AFE} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103472 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.5; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - "http://www.gatewayarch.com/Arch/arch.fun.bld.aspx "
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAFYARgBSAEUARQAtAFYATgBKADMAMgAtAEcAMwBMAEEAQQAtAEEANAA4ADkAUgAtADkAVQBKAEsARgAtAEUASwBLADMAWAA "& "inst=NwA3AC0ANAA2ADEAMwA1ADIANAA0ADQALQBGAFAAOQArADYALQBUAEIAOQArADEALQBGAEwAKwA5AC0AWABPADMANgArADEALQBGADkATQA3AEMAKwA1AC0ARgA5AE0AMQAwAEIAKwAxAA "& "prod=90 "& "ver=9.0.894
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {556DDE35-E955-11D0-A707-000000521957} - hxxp://www.xblock.com/download/xclean_micro.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKslf44a044c;MpKslf44a044c;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c783fa79-1365-4a51-aecd-c858f42114c7}\MpKslf44a044c.sys [2011-4-5 28752]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\lavasoft\ad-aware\kernexplorer.sys --> c:\program files\lavasoft\ad-aware\KernExplorer.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
.
=============== Created Last 30 ================
.
2011-04-05 15:27:03 28752 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{c783fa79-1365-4a51-aecd-c858f42114c7}\MpKslf44a044c.sys
2011-04-05 15:26:18 6792528 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{c783fa79-1365-4a51-aecd-c858f42114c7}\mpengine.dll
2011-04-05 08:26:05 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-05 08:26:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-05 03:08:44 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-04-05 03:05:09 -------- d-----w- c:\program files\Microsoft Security Client
2011-04-05 02:40:17 -------- dc----w- C:\e114926840db1570eca7
2011-04-05 01:00:42 6144 ----a-w- c:\windows\system32\kbd106.dll
2011-04-05 01:00:42 6144 ----a-w- c:\windows\system32\dllcache\kbd106.dll
2011-04-05 00:56:35 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-03-14 16:27:10 -------- d--h--w- c:\docume~1\alluse~1\applic~1\Common Files
.
==================== Find3M ====================
.
2011-04-05 15:16:23 56 --sh--r- c:\windows\system32\C62336B294.sys
2011-04-05 15:16:23 1682 --sha-w- c:\windows\system32\KGyGaAvL.sys
2011-02-09 13:53:52 270848 ---ha-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 ---ha-w- c:\windows\system32\encdec.dll
2011-02-02 07:58:35 2067456 ---ha-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57:06 677888 ---ha-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44:37 439296 ---ha-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09:02 290048 ---ha-w- c:\windows\system32\atmfd.dll
.
============= FINISH: 11:38:20.89 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 8/15/2005 8:40:47 PM
System Uptime: 4/5/2011 9:11:38 AM (2 hours ago)
.
Motherboard: Dell Inc. | | 0M3918
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 71 GiB total, 54.418 GiB free.
D: is CDROM ()
E: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP449: 2/5/2011 8:06:17 AM - Software Distribution Service 3.0
RP450: 2/5/2011 11:06:55 AM - Software Distribution Service 3.0
RP451: 2/5/2011 1:21:27 PM - Software Distribution Service 3.0
RP452: 2/6/2011 11:49:34 AM - Software Distribution Service 3.0
RP453: 2/7/2011 12:18:32 PM - System Checkpoint
RP454: 2/7/2011 3:00:17 PM - Software Distribution Service 3.0
RP455: 2/7/2011 9:56:39 PM - Software Distribution Service 3.0
RP456: 2/10/2011 4:49:03 PM - System Checkpoint
RP457: 2/10/2011 6:31:43 PM - Software Distribution Service 3.0
RP458: 2/11/2011 5:13:27 PM - Software Distribution Service 3.0
RP459: 2/12/2011 11:15:23 AM - Software Distribution Service 3.0
RP460: 2/12/2011 2:48:48 PM - Software Distribution Service 3.0
RP461: 2/13/2011 10:26:41 AM - Software Distribution Service 3.0
RP462: 2/13/2011 1:30:54 PM - Software Distribution Service 3.0
RP463: 2/14/2011 2:46:33 PM - Software Distribution Service 3.0
RP464: 2/14/2011 3:00:19 PM - Software Distribution Service 3.0
RP465: 2/14/2011 3:52:39 PM - Software Distribution Service 3.0
RP466: 2/15/2011 9:38:44 AM - Software Distribution Service 3.0
RP467: 2/15/2011 3:31:31 PM - Software Distribution Service 3.0
RP468: 2/15/2011 4:35:00 PM - Software Distribution Service 3.0
RP469: 2/16/2011 3:00:29 PM - Software Distribution Service 3.0
RP470: 2/16/2011 7:29:58 PM - Software Distribution Service 3.0
RP471: 2/17/2011 2:00:50 PM - Software Distribution Service 3.0
RP472: 2/18/2011 2:10:58 PM - System Checkpoint
RP473: 2/18/2011 3:00:20 PM - Software Distribution Service 3.0
RP474: 2/18/2011 4:11:17 PM - Software Distribution Service 3.0
RP475: 2/18/2011 5:50:28 PM - Software Distribution Service 3.0
RP476: 2/18/2011 6:58:08 PM - Software Distribution Service 3.0
RP477: 2/18/2011 7:05:56 PM - Software Distribution Service 3.0
RP478: 2/19/2011 1:31:34 PM - Software Distribution Service 3.0
RP479: 2/20/2011 1:43:25 PM - System Checkpoint
RP480: 2/20/2011 3:00:21 PM - Software Distribution Service 3.0
RP481: 2/20/2011 6:53:36 PM - Software Distribution Service 3.0
RP482: 2/21/2011 11:29:14 AM - Software Distribution Service 3.0
RP483: 2/21/2011 7:38:23 PM - Software Distribution Service 3.0
RP484: 2/22/2011 1:02:11 PM - Software Distribution Service 3.0
RP485: 2/22/2011 5:36:26 PM - Software Distribution Service 3.0
RP486: 2/23/2011 2:52:24 PM - Software Distribution Service 3.0
RP487: 2/24/2011 9:33:58 AM - Software Distribution Service 3.0
RP488: 2/24/2011 3:00:20 PM - Software Distribution Service 3.0
RP489: 2/24/2011 6:58:32 PM - Software Distribution Service 3.0
RP490: 2/25/2011 4:03:25 PM - Software Distribution Service 3.0
RP491: 2/25/2011 6:11:55 PM - Software Distribution Service 3.0
RP492: 2/26/2011 2:25:53 PM - Software Distribution Service 3.0
RP493: 2/27/2011 2:33:00 PM - System Checkpoint
RP494: 2/27/2011 3:00:16 PM - Software Distribution Service 3.0
RP495: 2/27/2011 3:36:14 PM - Software Distribution Service 3.0
RP496: 3/1/2011 4:18:26 PM - System Checkpoint
RP497: 3/1/2011 6:55:59 PM - Software Distribution Service 3.0
RP498: 3/2/2011 3:00:23 PM - Software Distribution Service 3.0
RP499: 3/2/2011 4:03:44 PM - Software Distribution Service 3.0
RP500: 3/3/2011 3:00:19 PM - Software Distribution Service 3.0
RP501: 3/3/2011 4:34:48 PM - Software Distribution Service 3.0
RP502: 3/4/2011 6:19:46 PM - Software Distribution Service 3.0
RP503: 3/5/2011 2:21:55 PM - Software Distribution Service 3.0
RP504: 3/7/2011 9:57:48 AM - System Checkpoint
RP505: 3/7/2011 10:44:01 AM - Software Distribution Service 3.0
RP506: 3/7/2011 7:37:19 PM - Software Distribution Service 3.0
RP507: 3/7/2011 7:58:18 PM - Software Distribution Service 3.0
RP508: 3/8/2011 10:14:42 AM - Software Distribution Service 3.0
RP509: 3/9/2011 11:31:45 AM - System Checkpoint
RP510: 3/9/2011 12:17:27 PM - Software Distribution Service 3.0
RP511: 3/9/2011 7:24:38 PM - Software Distribution Service 3.0
RP512: 3/10/2011 11:05:15 AM - Software Distribution Service 3.0
RP513: 3/10/2011 12:54:42 PM - Software Distribution Service 3.0
RP514: 3/10/2011 2:56:00 PM - Software Distribution Service 3.0
RP515: 3/10/2011 3:05:13 PM - Software Distribution Service 3.0
RP516: 3/11/2011 10:37:45 AM - Software Distribution Service 3.0
RP517: 3/11/2011 12:19:08 PM - Software Distribution Service 3.0
RP518: 3/13/2011 9:05:33 AM - System Checkpoint
RP519: 3/13/2011 9:48:48 AM - Software Distribution Service 3.0
RP520: 3/13/2011 9:53:39 PM - Software Distribution Service 3.0
RP521: 3/13/2011 10:23:21 PM - Software Distribution Service 3.0
RP522: 3/14/2011 7:35:00 AM - Software Distribution Service 3.0
RP523: 3/14/2011 12:24:15 PM - Avg Update
RP524: 3/14/2011 12:26:27 PM - Avg Update
RP525: 3/14/2011 3:00:19 PM - Software Distribution Service 3.0
RP526: 3/14/2011 3:20:31 PM - Software Distribution Service 3.0
RP527: 3/14/2011 9:02:25 PM - Software Distribution Service 3.0
RP528: 3/15/2011 6:56:59 PM - Software Distribution Service 3.0
RP529: 3/16/2011 3:00:33 PM - Software Distribution Service 3.0
RP530: 3/16/2011 7:52:05 PM - Software Distribution Service 3.0
RP531: 3/19/2011 10:25:36 PM - Software Distribution Service 3.0
RP532: 3/22/2011 12:42:25 PM - System Checkpoint
RP533: 3/22/2011 3:00:21 PM - Software Distribution Service 3.0
RP534: 3/22/2011 10:22:00 PM - Software Distribution Service 3.0
RP535: 3/25/2011 8:53:45 PM - Software Distribution Service 3.0
RP536: 3/25/2011 9:30:42 PM - Software Distribution Service 3.0
RP537: 3/25/2011 9:51:39 PM - Software Distribution Service 3.0
RP538: 3/27/2011 8:34:08 PM - Software Distribution Service 3.0
RP539: 3/28/2011 3:00:29 PM - Software Distribution Service 3.0
RP540: 3/28/2011 7:10:40 PM - Software Distribution Service 3.0
RP541: 3/29/2011 9:41:44 PM - Software Distribution Service 3.0
RP542: 3/29/2011 10:33:20 PM - Software Distribution Service 3.0
RP543: 3/31/2011 7:37:08 PM - Software Distribution Service 3.0
RP544: 3/31/2011 7:50:26 PM - Software Distribution Service 3.0
RP545: 4/1/2011 9:56:59 PM - Software Distribution Service 3.0
RP546: 4/3/2011 8:15:50 AM - Software Distribution Service 3.0
RP547: 4/3/2011 9:17:47 AM - Software Distribution Service 3.0
RP548: 4/3/2011 11:26:40 AM - Software Distribution Service 3.0
RP549: 4/3/2011 8:00:11 PM - Software Distribution Service 3.0
RP550: 4/3/2011 9:09:55 PM - Software Distribution Service 3.0
RP551: 4/4/2011 8:08:47 PM - Restore Operation
RP552: 4/4/2011 8:14:27 PM - Restore Operation
RP553: 4/4/2011 8:14:50 PM - jean
RP554: 4/4/2011 8:15:12 PM - Restore Operation
RP555: 4/4/2011 8:19:00 PM - Restore Operation
RP556: 4/4/2011 10:47:25 PM - Removed AVG Free 9.0
RP557: 4/4/2011 10:50:48 PM - Installed AVG Free 9.0
RP558: 4/4/2011 11:11:11 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player 11
AOL Uninstaller
ArcSoft Panorama Maker 3
CCleaner
CleanUp!
ClientTools
Conexant D850 56K V.9x DFVc Modem
Critical Update for Windows Media Player 11 (KB959772)
Dell Driver Reset Tool
Dell Photo Printer 720
Dell Picture Studio v3.0
Dell Support 3.2.1
Dell Support Center (Support Software)
DellConnect
Digital Line Detect
EasyCleaner
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Hoyle Board Games 4
Hoyle Card Games 3 Demo
Hoyle Casino 5
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Intel(R) PROSet for Wired Connections
Internet Explorer Default Page
Jasc Paint Shop Photo Album
Jasc Paint Shop Photo Album 5
Jasc Paint Shop Pro 8 Dell Edition
Jasc Paint Shop Pro Studio, Dell Editon
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 17
Learn2 Player (Uninstall Only)
Macromedia Flash Player
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Modem Helper
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
My Way Search Assistant
NetWaiting
Nikon Message Center
PictureProject
PictureProject In Touch Downloader 1.0
Qualxserve Service Agreement
QuickBooks Simple Start Special Edition
QuickTime
Revo Uninstaller 1.91
Rhapsody Player Engine
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Sonic DLA
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
TWC Client ActiveX Controls
Ultimate Solitaire
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Verizon Yahoo! Applications
Verizon Yahoo! Music Jukebox
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebCyberCoach 3.2 Dell
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
WordPerfect Office 12
.
==== Event Viewer Messages From Past Week ========
.
4/5/2011 4:18:32 AM, error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
4/5/2011 12:24:46 AM, information: Windows File Protection [64017] - Windows File Protection file scan completed successfully.
4/5/2011 1:08:06 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd
4/4/2011 8:48:34 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
4/4/2011 8:41:19 PM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00132056CD1B has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
4/4/2011 12:31:30 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
4/4/2011 12:20:16 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip WS2IFSL
4/4/2011 12:20:16 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
4/4/2011 12:20:16 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/4/2011 12:20:16 PM, error: Service Control Manager [7001] - The Fax service depends on the Print Spooler service which failed to start because of the following error: The dependency service or group failed to start.
4/4/2011 12:20:16 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/4/2011 12:20:16 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
4/4/2011 12:20:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
4/4/2011 12:19:43 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
4/4/2011 12:19:30 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
4/4/2011 11:46:13 AM, error: Service Control Manager [7000] - The X4HSX32 service failed to start due to the following error: The system cannot find the path specified.
4/4/2011 11:46:13 AM, error: Service Control Manager [7000] - The McAfee Real-time Scanner service failed to start due to the following error: The system cannot find the path specified.
4/4/2011 11:37:42 PM, information: Windows File Protection [64016] - Windows File Protection file scan was started.
4/4/2011 10:18:26 PM, error: Service Control Manager [7034] - The SupportSoft Sprocket Service (dellsupportcenter) service terminated unexpectedly. It has done this 1 time(s).
4/4/2011 10:18:26 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
4/4/2011 10:18:26 PM, error: Service Control Manager [7034] - The AVG Free E-mail Scanner service terminated unexpectedly. It has done this 1 time(s).
4/4/2011 10:18:26 PM, error: Service Control Manager [7031] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
4/4/2011 10:18:26 PM, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
4/3/2011 9:09:57 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070003: Update for Windows XP (KB961118).
4/3/2011 11:20:36 AM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 00132056CD1B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================

 

OK, I downloaded and ran Combo Fix and I'm attaching the C:\Combo Fix here. (By the way, I now noticed that I have the "All Programs" files and folders back and also down in the taskbar I noticed that the Icons on the left, "Quick Launch" are back so we are indeed making progress.

Please let me know what the next step is that I should take. YOU ARE A GENIUS!!!

ComboFix 11-04-05.02 - Peter 04/05/2011 21:57:56.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.211 [GMT -4:00]
Running from: c:\documents and settings\Peter\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Peter\Application Data\PriceGong
c:\documents and settings\Peter\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Peter\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Peter\Desktop\Windows Repair.lnk
c:\documents and settings\Peter\GoToAssistDownloadHelper.exe
c:\documents and settings\Peter\Start Menu\Programs\Windows Repair
c:\documents and settings\Peter\Start Menu\Programs\Windows Repair\Uninstall Windows Repair.lnk
c:\documents and settings\Peter\Start Menu\Programs\Windows Repair\Windows Repair.lnk
c:\documents and settings\Peter\WINDOWS
c:\windows\MailSwitch.ocx
c:\windows\system32\bszip.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-03-06 to 2011-04-06 )))))))))))))))))))))))))))))))
.
.
2011-04-06 01:20 . 2011-04-06 01:20 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C783FA79-1365-4A51-AECD-C858F42114C7}\MpKsl12088261.sys
2011-04-05 15:26 . 2011-03-23 14:11 6792528 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C783FA79-1365-4A51-AECD-C858F42114C7}\mpengine.dll
2011-04-05 08:26 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-05 08:26 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-05 03:08 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-04-05 03:05 . 2011-04-05 03:05 -------- d-----w- c:\program files\Microsoft Security Client
2011-04-05 02:40 . 2011-04-05 02:50 -------- dc----w- C:\e114926840db1570eca7
2011-04-05 01:00 . 2008-04-13 23:09 6144 ----a-w- c:\windows\system32\kbd106.dll
2011-04-05 01:00 . 2008-04-13 23:09 6144 ----a-w- c:\windows\system32\dllcache\kbd106.dll
2011-04-05 00:56 . 2011-04-05 00:56 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-04-05 00:40 . 2011-04-05 05:03 -------- dc----w- c:\windows\system32\DRVSTORE
2011-04-05 00:37 . 2011-04-05 05:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2011-03-14 16:27 . 2011-03-14 16:27 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-03-08 00:37 . 2011-03-08 00:37 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2004-08-04 10:00 270848 ---ha-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 10:00 186880 ---ha-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2004-08-04 10:00 2067456 ---ha-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2004-08-04 10:00 677888 ---ha-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-04 10:00 439296 ---ha-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2004-08-04 10:00 290048 ---ha-w- c:\windows\system32\atmfd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL "= "start http:" [X]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ymetray.lnk
backup=c:\windows\pss\ymetray.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^DING!.lnk]
path=c:\documents and settings\Peter\Start Menu\Programs\Startup\DING!.lnk
backup=c:\windows\pss\DING!.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^TrueAssistant.lnk]
path=c:\documents and settings\Peter\Start Menu\Programs\Startup\TrueAssistant.lnk
backup=c:\windows\pss\TrueAssistant.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\A Verizon App
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\SYSTEM32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2009-05-21 14:55 206064 ---ha-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-12-06 06:05 127035 ---ha-w- c:\windows\SYSTEM32\dla\tfswctrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2007-11-15 14:24 16384 ---ha-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-10-14 18:46 77824 ---ha-w- c:\windows\SYSTEM32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-10-14 18:46 77824 ---ha-w- c:\windows\SYSTEM32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-10-14 18:50 114688 ---ha-w- c:\windows\SYSTEM32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-10-14 18:49 94208 ---ha-w- c:\windows\SYSTEM32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 21:50 221184 ---ha-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 ---ha-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-01-16 03:09 282624 ---ha-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2004-10-14 19:42 1404928 ---ha-w- c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-08-14 17:55 198160 ---ha-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE "=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe "=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP "= 5985:TCP:*isabled:Windows Remote Management
.
R1 MpKsl12088261;MpKsl12088261;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C783FA79-1365-4A51-AECD-C858F42114C7}\MpKsl12088261.sys [4/5/2011 9:20 PM 28752]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/4/2004 6:00 AM 14336]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL12088261
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-06 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 16:26]
.
2011-04-05 c:\windows\Tasks\User_Feed_Synchronization-{546C69B3-0C87-4256-8808-D5787683C218}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.yahoo.com/?_bc=1
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: internet
Trusted Zone: mcafee.com
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe
AddRemove-Hoyle Board Games 4 - c:\sierra\Hoyle Board Games 4\Uninst.isu
AddRemove-Hoyle Card Games 3 Demo - c:\sierra\HCG3DEMO\Uninst.isu
AddRemove-Hoyle Casino 5 - c:\sierra\Hoyle Casino 5\Uninst.isu
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-05 22:04
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-04-05 22:07:11
ComboFix-quarantined-files.txt 2011-04-06 02:07
.
Pre-Run: 58,357,903,360 bytes free
Post-Run: 58,338,287,616 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - EA9C93D911EF658E8AF41F9FAF5C399E

 

OK, I will now post the OTL.txt here that was created from the scan.
I will post again the Extras as it said both were too much to handle at this posting.
Thank you again for your help.
Jean

OTL.txt

OTL logfile created on: 4/5/2011 10:44:00 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.00 Mb Total Physical Memory | 126.00 Mb Available Physical Memory | 25.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 54.33 Gb Free Space | 76.03% Space Free | Partition Type: NTFS
Drive E: | 121.39 Mb Total Space | 2.49 Mb Free Space | 2.05% Space Free | Partition Type: FAT32

Computer Name: D6PPL481 | User Name: Peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/05 22:42:17 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\OTL.exe
PRC - [2010/11/30 13:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/04/05 22:42:17 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\OTL.exe
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Disabled | Stopped] -- -- (AppMgmt)
SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/04/16 10:03:12 | 000,386,424 | ---- | M] (SupportSoft, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe -- (SupportSoft RemoteAssist)
SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)


========== Driver Services (SafeList) ==========

DRV - [2011/04/05 21:20:06 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C783FA79-1365-4A51-AECD-C858F42114C7}\MpKsl12088261.sys -- (MpKsl12088261)
DRV - [2008/04/13 14:56:49 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\usb8023.sys -- (USB_RNDIS_XP)
DRV - [2006/01/10 12:07:58 | 000,004,864 | ---- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2004/09/17 10:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys -- (senfilt)
DRV - [2004/03/24 11:12:44 | 000,004,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\bvrp_pci.sys -- (bvrp_pci)
DRV - [2003/11/17 16:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 16:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 16:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\HSF_DP.sys -- (HSF_DP)
DRV - [2002/11/08 14:45:06 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/cus.../sbcydsl/*http://www.yahoo.com/search/ie.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/mywaybiz
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/mywaybiz
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555



IE - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/?_bc=1
IE - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial "


FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/08/14 13:55:38 | 000,000,000 | ---D | M]

[2010/03/10 14:46:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions
[2011/02/16 15:40:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\joj8bgxn.default\extensions
[2008/03/12 14:59:00 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\joj8bgxn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/03/12 15:03:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2008/03/12 14:09:58 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2011/04/05 22:04:15 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O15 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-1103691938-995534090-3200003103-1006\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} http://www.xblock.com/download/xclean_micro.exe (Reg Error: Value error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - http://img0.gmodules.com/ig/cache/45/69/4569c518462eadd5f06e1056b81398cd-thm.png
O24 - Desktop Components:1 () - https://s.yimg.com/lq/lib/uh/15/uh_sprites_1.5-1.0.3.png
O24 - Desktop Components:2 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave - C:\WINDOWS\System32\SERWVDRV.DLL (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/05 22:42:17 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\OTL.exe
[2011/04/05 21:56:46 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/04/05 21:53:01 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/04/05 21:53:01 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/04/05 21:53:01 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/04/05 21:53:01 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/04/05 21:52:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/04/05 21:52:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/04/05 04:26:05 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/04/05 04:26:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/04/05 04:26:00 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/05 04:24:43 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Peter\Desktop\scanner.exe
[2011/04/04 23:05:09 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2011/04/04 22:40:17 | 000,000,000 | ---D | C] -- C:\e114926840db1570eca7
[2011/04/04 22:28:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Peter\Desktop\downloads 2
[2011/04/04 22:17:48 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\TFC.exe
[2011/04/04 22:12:13 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Peter\Recent
[2011/04/04 20:56:35 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/04/04 20:40:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2011/04/04 20:37:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2011/03/14 12:27:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files

========== Files - Modified Within 30 Days ==========

[2011/04/05 22:42:17 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\OTL.exe
[2011/04/05 22:04:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2011/04/05 21:56:50 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
[2011/04/05 21:48:41 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/04/05 21:45:04 | 000,000,424 | ---- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/04/05 21:34:22 | 004,315,129 | R--- | M] () -- C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2011/04/05 21:20:28 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/04/05 21:19:52 | 526,536,704 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/05 21:19:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/04/05 14:49:51 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Peter\Desktop\MBRCheck.exe
[2011/04/05 14:46:31 | 000,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI
[2011/04/05 12:31:13 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{546C69B3-0C87-4256-8808-D5787683C218}.job
[2011/04/05 11:33:02 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Peter\Desktop\dds.scr
[2011/04/05 11:16:23 | 000,001,682 | -HS- | M] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2011/04/05 11:16:23 | 000,000,056 | RHS- | M] () -- C:\WINDOWS\System32\C62336B294.sys
[2011/04/05 09:21:41 | 000,301,568 | ---- | M] () -- C:\Documents and Settings\Peter\Desktop\05q74xhv.exe
[2011/04/05 04:26:05 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/05 04:24:50 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Peter\Desktop\scanner.exe
[2011/04/04 23:06:39 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/04/04 22:17:41 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\TFC.exe
[2011/04/04 22:15:24 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/04/04 21:42:18 | 000,036,018 | ---- | M] () -- C:\Documents and Settings\Peter\My Documents\dateqtrsp.exe
[2011/04/04 20:56:29 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/04/03 20:47:45 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20307764
[2011/04/03 20:47:44 | 000,000,120 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20307764r
[2011/04/03 20:47:39 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\20307764
[2011/03/25 21:29:04 | 000,000,593 | ---- | M] () -- C:\WINDOWS\dellstat.ini
[2011/03/13 08:39:11 | 000,442,466 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2011/03/13 08:39:11 | 000,071,732 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT

========== Files Created - No Company Name ==========

[2011/04/05 21:56:49 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/04/05 21:56:48 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/04/05 21:53:01 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/04/05 21:53:01 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/04/05 21:53:01 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/04/05 21:53:01 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/04/05 21:53:01 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/04/05 21:45:04 | 000,000,424 | ---- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/04/05 21:34:17 | 004,315,129 | R--- | C] () -- C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2011/04/05 14:49:57 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Peter\Desktop\MBRCheck.exe
[2011/04/05 14:46:31 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2011/04/05 11:32:59 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Peter\Desktop\dds.scr
[2011/04/05 09:21:35 | 000,301,568 | ---- | C] () -- C:\Documents and Settings\Peter\Desktop\05q74xhv.exe
[2011/04/05 04:26:05 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/04 23:06:39 | 000,001,945 | ---- | C] () -- C:\WINDOWS\epplauncher.mif
[2011/04/04 23:05:21 | 000,001,680 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/04/04 22:11:22 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/04/04 21:42:17 | 000,036,018 | ---- | C] () -- C:\Documents and Settings\Peter\My Documents\dateqtrsp.exe
[2011/04/04 20:24:28 | 526,536,704 | -HS- | C] () -- C:\hiberfil.sys
[2011/04/03 20:47:44 | 000,000,120 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~20307764r
[2011/04/03 20:47:44 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~20307764
[2011/04/03 20:47:39 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\20307764
[2010/04/13 14:50:47 | 000,107,688 | ---- | C] () -- C:\WINDOWS\TrueInstall.exe
[2009/08/10 15:43:41 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Peter\Local Settings\Application Data\fusioncache.dat
[2008/10/05 19:31:40 | 000,000,586 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/01/15 23:15:54 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2008/01/15 23:11:00 | 000,000,268 | R--- | C] () -- C:\Documents and Settings\All Users\Application Data\Solid Colors
[2008/01/15 23:11:00 | 000,000,268 | R--- | C] () -- C:\Documents and Settings\Peter\Application Data\Scripts Menu
[2008/01/15 23:11:00 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
[2007/05/02 13:56:52 | 000,165,120 | ---- | C] () -- C:\Program Files\Mc
[2007/01/13 14:38:24 | 000,000,067 | ---- | C] () -- C:\WINDOWS\GPlrLanc.dat
[2006/11/30 20:45:19 | 000,000,041 | ---- | C] () -- C:\WINDOWS\qtw.ini
[2006/07/21 20:39:09 | 000,022,293 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/04/05 16:57:02 | 000,000,047 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006/03/20 17:11:40 | 000,000,557 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2006/03/17 16:54:03 | 000,000,126 | ---- | C] () -- C:\WINDOWS\%2f%2fdesktopfw.weather.com%2fservices%2fdesktopfw%2factimes.rfsh
[2006/03/17 16:26:46 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2006/03/07 22:46:04 | 000,000,028 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/03/01 17:49:26 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2006/03/01 17:15:54 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2005/11/02 08:34:20 | 000,001,682 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005/11/02 08:34:20 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\C62336B294.sys
[2005/10/06 15:21:39 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Peter\Application Data\PFP120JPR.{PB
[2005/10/06 15:21:39 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Peter\Application Data\PFP120JCM.{PB
[2005/09/24 11:22:04 | 000,000,228 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2005/08/30 21:07:32 | 000,013,312 | ---- | C] () -- C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/08/22 21:41:16 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\instlsp.exe
[2005/08/17 16:23:01 | 000,000,593 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2005/08/15 21:52:11 | 000,004,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2005/08/10 15:06:17 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/08/10 15:01:36 | 000,000,047 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/08/10 14:58:54 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/08/10 14:46:56 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2005/08/10 14:46:14 | 000,442,466 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2005/08/10 14:46:14 | 000,071,732 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2005/08/10 14:32:04 | 000,000,370 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/04/09 13:04:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/02/23 15:05:34 | 000,049,152 | ---- | C] () -- C:\WINDOWS\SETPWRCG.EXE
[2004/08/10 14:13:12 | 000,000,882 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2004/08/10 14:08:08 | 000,203,328 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 14:03:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 14:02:16 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 11:08:26 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/10 11:08:26 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/04 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2004/08/04 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2004/08/04 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2004/08/04 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2004/08/04 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2004/08/04 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\SECUPD.DAT
[2004/08/04 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\FXSPERF.INI
[2004/08/04 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2004/02/10 16:08:00 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini
[2003/05/31 20:43:00 | 000,005,632 | ---- | C] () -- C:\WINDOWS\TrueProcess.exe
[2003/03/27 16:28:44 | 000,004,955 | ---- | C] () -- C:\WINDOWS\System32\DProg.ini
[2002/11/13 16:40:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll

========== LOP Check ==========

[2010/04/14 00:14:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2007/10/08 09:55:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2011/03/14 12:27:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2008/01/15 23:15:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2007/01/13 14:38:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Exetender
[2009/05/13 14:04:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2008/01/15 23:11:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nikon
[2008/01/15 23:11:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Radio Sounds
[2007/11/26 11:25:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2008/01/15 23:15:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2007/03/15 20:04:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/03/01 17:51:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
[2010/04/13 17:32:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Peter\Application Data\IObit
[2005/08/15 22:05:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Peter\Application Data\Leadertech
[2009/05/13 14:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Peter\Application Data\muvee Technologies
[2008/01/15 23:34:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Peter\Application Data\Nikon
[2007/11/16 13:54:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Peter\Application Data\Registry Cleaner
[2010/08/26 19:28:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Peter\Application Data\W Photo Studio Viewer
[2005/09/19 22:14:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Peter\Application Data\Walgreens
[2011/04/05 21:45:04 | 000,000,424 | ---- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/04/05 12:31:13 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{546C69B3-0C87-4256-8808-D5787683C218}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011/04/04 23:36:30 | 000,001,600 | ---- | M] () -- C:\aaw7boot.log
[2005/12/05 20:28:50 | 000,010,920 | ---- | M] () -- C:\aolconnfix.exe
[2005/12/05 20:28:50 | 000,001,039 | ---- | M] () -- C:\aolconnfix.txt
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2011/04/05 21:48:41 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/04/05 21:56:50 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/04/05 22:07:12 | 000,013,253 | ---- | M] () -- C:\ComboFix.txt
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2005/08/10 14:35:28 | 000,004,999 | R--- | M] () -- C:\DELL.SDR
[2011/04/05 21:19:52 | 526,536,704 | -HS- | M] () -- C:\hiberfil.sys
[2006/03/04 16:17:32 | 000,000,066 | ---- | M] () -- C:\ICSYSINF.log
[2004/08/10 14:14:36 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2011/02/16 15:40:00 | 000,000,000 | ---- | M] () -- C:\install.rdf
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\IO.SYS
[2006/03/07 22:54:20 | 000,000,630 | ---- | M] () -- C:\IPH.PH
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/11/23 20:34:51 | 000,250,048 | RHS- | M] () -- C:\NTLDR
[2011/04/05 21:19:51 | 792,723,456 | -HS- | M] () -- C:\pagefile.sys
[2011/01/22 21:06:46 | 000,000,395 | ---- | M] () -- C:\rkill.log
[2010/03/23 10:48:09 | 000,005,709 | ---- | M] () -- C:\scramble.log
[2005/08/10 15:00:10 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
[2007/12/08 13:47:13 | 000,000,150 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 14:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\DESKTOP.INI

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2003/07/29 10:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\DLBCPP5C.DLL
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2007/05/02 13:56:52 | 000,165,120 | ---- | M] () -- C:\Program Files\Mc

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 13:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
[2004/08/10 13:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
[2004/08/10 13:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/11/23 20:42:30 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/08/15 20:41:52 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
[2004/08/10 14:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/04/05 09:21:41 | 000,301,568 | ---- | M] () -- C:\Documents and Settings\Peter\Desktop\05q74xhv.exe
[2010/04/14 16:16:47 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\Peter\Desktop\ATF-Cleaner.exe
[2011/04/05 21:34:22 | 004,315,129 | R--- | M] () -- C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2011/04/05 14:49:51 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Peter\Desktop\MBRCheck.exe
[2011/04/05 22:42:17 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\OTL.exe
[2011/04/05 04:24:50 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Peter\Desktop\scanner.exe
[2011/04/04 22:17:41 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Peter\Desktop\TFC.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2011/04/04 21:42:18 | 000,036,018 | ---- | M] () -- C:\Documents and Settings\Peter\My Documents\dateqtrsp.exe

< %USERPROFILE%\*.exe >
[2007/08/19 11:33:42 | 000,389,120 | ---- | M] (Citrix Online) -- C:\Documents and Settings\Peter\GoToAssist_phone__268_en.exe
[2008/05/06 19:23:40 | 000,557,056 | ---- | M] (Citrix Online) -- C:\Documents and Settings\Peter\GoToAssist_phone__317_en.exe
[2008/05/22 13:47:05 | 000,557,056 | ---- | M] (Citrix Online) -- C:\Documents and Settings\Peter\GoToAssist_phone__319_en.exe
[2008/06/05 18:32:32 | 000,557,056 | ---- | M] (Citrix Online) -- C:\Documents and Settings\Peter\GoToAssist_phone__320_en.exe
[2006/10/11 10:12:03 | 000,389,120 | ---- | M] (Citrix Online) -- C:\Documents and Settings\Peter\remote.exe

< %systemroot%\ADDINS\*.* >
[2004/08/04 06:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\FXSEXT.ECF

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2005/08/15 20:41:52 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Peter\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/04/05 22:41:26 | 000,131,072 | -HS- | M] () -- C:\Documents and Settings\Peter\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\INF\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 02:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\LOGOWIN.GIF
[2004/08/04 02:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\LVBACK.GIF
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 20:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 02:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\NEWALERT.WAV
[2004/08/04 02:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\NEWEMAIL.WAV
[2004/08/04 02:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\ONLINE.WAV
[2004/08/04 02:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\TYPE.WAV
[2004/08/04 02:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\XPMSGR.CHM

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >

 

Here is the Extras.txt:

Extras.txt

OTL Extras logfile created on: 4/5/2011 10:44:00 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.00 Mb Total Physical Memory | 126.00 Mb Available Physical Memory | 25.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 54.33 Gb Free Space | 76.03% Space Free | Partition Type: NTFS
Drive E: | 121.39 Mb Total Space | 2.49 Mb Free Space | 2.05% Space Free | Partition Type: FAT32

Computer Name: D6PPL481 | User Name: Peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1 "
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*isabled:Windows Remote Management

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Yahoo!\Yahoo! Music Engine\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Engine\YahooMusicEngine.exe:*:Enabled:Verizon Yahoo! Music Jukebox -- (Yahoo! Inc.)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = Qualxserve Service Agreement
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{14374619-0900-4056-BA06-C87C900AF9E6}" = QuickBooks Simple Start Special Edition
"{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel(R) PROSet for Wired Connections
"{18525F55-9B32-4D49-BF03-D53B17A49D97}" = DellConnect
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}" = Rhapsody Player Engine
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4192EAC0-6B36-4723-B216-D0E86E7757AC}" = Jasc Paint Shop Photo Album 5
"{433AF48D-1FB7-47DD-9784-93E7291C85AE}" = Verizon Yahoo! Music Jukebox
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{78C496B9-5A6B-4692-8C2E-AFFFC34E4961}" = Jasc Paint Shop Pro Studio, Dell Editon
"{78D944D7-A97B-4004-AB0A-B5AD06839940}" = My Way Search Assistant
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8 Dell Edition
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5F68DC8-0278-4AD8-B413-861509B5F25B}" = ArcSoft Panorama Maker 3
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF06CAE4-C134-44B1-B699-14FBDB63BD37}" = Dell Picture Studio v3.0
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C21D5524-A970-42FA-AC8A-59B8C7CDCA31}" = QuickTime
"{C7DACB79-D0BE-477B-B63F-4BBF33F39B7A}" = TWC Client ActiveX Controls
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E4375AC9-EDE1-4943-A0E3-801CEB7041DF}" = Dell Support 3.2.1
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F4A4E6B2-D45F-4EB1-8C3A-6EB8D45A31C9}" = ClientTools
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"AOL Uninstaller" = AOL Uninstaller
"CCleaner" = CCleaner
"CleanUp!" = CleanUp!
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"Dell Photo Printer 720" = Dell Photo Printer 720
"ie8" = Windows Internet Explorer 8
"InstallShield_{C21D5524-A970-42FA-AC8A-59B8C7CDCA31}" = QuickTime
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"PictureProject In Touch Downloader" = PictureProject In Touch Downloader 1.0
"PROSet" = Intel(R) PRO Network Connections Drivers
"Revo Uninstaller" = Revo Uninstaller 1.91
"StreetPlugin" = Learn2 Player (Uninstall Only)
"Ultimate_Solitaire" = Ultimate Solitaire
"Verizon Yahoo! Applications" = Verizon Yahoo! Applications
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/5/2011 4:43:06 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 4/5/2011 4:43:06 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 4/5/2011 4:43:06 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 4/5/2011 4:43:06 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 4/5/2011 4:43:09 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 4/5/2011 4:43:09 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 4/5/2011 4:43:10 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 4/5/2011 4:43:10 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 4/5/2011 4:43:10 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 4/5/2011 4:43:10 AM | Computer Name = D6PPL481 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

[ System Events ]
Error - 4/5/2011 4:18:33 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/5/2011 4:18:33 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7034
Description = The SupportSoft Sprocket Service (dellsupportcenter) service terminated
unexpectedly. It has done this 1 time(s).

Error - 4/5/2011 4:19:50 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7000
Description = The X4HSX32 service failed to start due to the following error: %%3

Error - 4/5/2011 4:19:56 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 4/5/2011 4:45:18 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7000
Description = The X4HSX32 service failed to start due to the following error: %%3

Error - 4/5/2011 4:45:24 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 4/5/2011 9:12:17 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7000
Description = The X4HSX32 service failed to start due to the following error: %%3

Error - 4/5/2011 9:12:23 AM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 4/5/2011 9:20:08 PM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7000
Description = The X4HSX32 service failed to start due to the following error: %%3

Error - 4/5/2011 9:20:09 PM | Computer Name = D6PPL481 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd


< End of report >

 

Results of RunFix:

All processes killed
========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-21-1103691938-995534090-3200003103-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ not found.
Registry key HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//@install.mar@\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//@mail.mar@\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\internet\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafee.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1103691938-995534090-3200003103-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafee.com\ not found.
Starting removal of ActiveX control {556DDE35-E955-11D0-A707-000000521957}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{556DDE35-E955-11D0-A707-000000521957}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{556DDE35-E955-11D0-A707-000000521957}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{556DDE35-E955-11D0-A707-000000521957}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{556DDE35-E955-11D0-A707-000000521957}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{556DDE35-E955-11D0-A707-000000521957}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\Documents and Settings\All Users\Application Data\~20307764 moved successfully.
C:\Documents and Settings\All Users\Application Data\~20307764r moved successfully.
C:\Documents and Settings\All Users\Application Data\20307764 moved successfully.
C:\WINDOWS\SYSTEM32\C62336B294.sys moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome\BH00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
C:\Documents and Settings\Peter\Application Data\Registry Cleaner\Backups folder moved successfully.
C:\Documents and Settings\Peter\Application Data\Registry Cleaner folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: Peter
->Temp folder emptied: 10178599 bytes
->Temporary Internet Files folder emptied: 4368173 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 757 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 14336 bytes

Total Files Cleaned = 14.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Peter
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04052011_233351

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

 

Results of Security Check:

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
EasyCleaner
Java(TM) 6 Update 24
Java 2 Runtime Environment, SE v1.4.2_03
Out of date Java installed!
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
``````````End of Log````````````

 

Updated Adobe Reader
There were no threats with the ESETScan software.

One problem, I dried to Uninstall Java 2 Runtime Environment, SE v1.4.2_03 through the control panel but I got an error message which is:

The feature you are trying to install is on a network resource which is unavailable.
Click ok to try again or enter an alternate path to a folder containing the installation package Java 2 Runtime Environment, SE v1.4.2_03.msi in the box below. "

I didn't know what to try to put in the box. I searched the name and came up with a file as follows:

C:\windows\system32\config\systemprofile\local settings\Application data\\{7148f0A6--6813-11d6-A77B-00B0142030}

I don't know how to uninstall this so maybe you can help me with this problem.

I must go to bed now and will resume in the morning. It is way past my bedtime here in Florida (1:15 AM).

Thank you for all your help and I hope we can resolve the Java problem.

Jean

 

Broni,
Good Morning!!

1. When I turned the computer on this morning I got an error message saying:
jusched.exe has encountered a problem and needs to close. We are sorry for the inconvenience." I also got the same message another time while downloading Windows Update.

I have followed your instructions:

2 Ran OIL - all okay there

3 Ran Windows Update - It had one update but said:

Some updates cannot be installed:
Update for Windows XP –(KB961118)

I wonder why it won't install. Also there is a yellow shield in the taskbar, I guess because the update won't install.


4 Downloaded WOT

5 Installed Secunia Personal Inspector.

6 Installed File Hippo Update Checker

I must keep all this information and load some of these programs on my own computer and run them once a week.

I do help the senor citizens with their computer here in our small area so I will try to pass on some of this information to them to help them maintain their computers.

The problem with this man, Pete, is that he is about 82 years old and clicks on some sexy or **** sites. Even though I have warned him repeatedly not to go on these sites he obviously didn't listen. Maybe with the new programs you suggested running it will help him be more protected.

One more question, is it necessary to have Super AntiSpyware on his computer also?

Jean

P.S. I'll try to get Pete to send in a donation. You certainly deserve it.

 

Broni,

What can I say. I can't thank you enough to help me erase this terrible malware from my friend's computer. I will definitely give him a list of programs to run weekly as you advised. Hopefully he will do this but, if, in the future he does have problems, I will refuse to go through this again. He will have to just take it somewhere to be reformatted.

His computer is working good now so let's hope it stays that way.

I did also download the Super AntiSpyware and will instruct him to run that once a week too.

Again, you are a genius and extremely patient in guiding me through this very complicated process.

We need more people in the world like you.

Jean

P.S. I will be sure to close out this problem next.