Solved Redirects, Fake Malware Program, System Restore Disabled

[Resolved] Redirects, Fake Malware Program, System Restore Disabled

I have the following problems:

1. IE and Chrome redirects me to different sites
2. Fake Malware program automatically runs
3. Files and programs hidden
4. Task Manager changed and doesn't have the tabs on the top
5. System Restore doesn't work.
6. Open hidden browser detected by SPYbot Immunize feature
   
   I had to boot to safe mode and run Malwarebytes and Spybot and I manually unhide the files and programs. These actions corrected issues 2 and 3 but the others still exist. I ran these programs before I found this forum so I didn't document the viruses the programs removed.
   
   Next I disconnect the computer from the internet, booted the computer in normal mode and ran the programs suggested by this forum. Below are the log files.
   
   Malwarebytes' Anti-Malware 1.50.1.1100
   www.malwarebytes.org
   
   Database version: 5363
   
   Windows 5.1.2600 Service Pack 3
   Internet Explorer 8.0.6001.18702
   
   5/25/2011 11:46:55 PM
   mbam-log-2011-05-25 (23-46-55).txt
   
   Scan type: Quick scan
   Objects scanned: 159543
   Time elapsed: 5 minute(s), 22 second(s)
   
   Memory Processes Infected: 0
   Memory Modules Infected: 0
   Registry Keys Infected: 0
   Registry Values Infected: 0
   Registry Data Items Infected: 0
   Folders Infected: 0
   Files Infected: 0
   
   Memory Processes Infected:
   (No malicious items detected)
   
   Memory Modules Infected:
   (No malicious items detected)
   
   Registry Keys Infected:
   (No malicious items detected)
   
   Registry Values Infected:
   (No malicious items detected)
   
   Registry Data Items Infected:
   (No malicious items detected)
   
   Folders Infected:
   (No malicious items detected)
   
   Files Infected:
   (No malicious items detected)
   
   
   GMER 1.0.15.15627 - http://www.gmer.net
   Rootkit scan 2011-05-26 00:33:33
   Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e SAMSUNG_HD080HJ/P rev.ZH100-34
   Running: e6itvl4h.exe; Driver: C:\DOCUME~1\Robert\LOCALS~1\Temp\uwlyapog.sys
   
   
   ---- Kernel code sections - GMER 1.0.15 ----
   
   INITc VolSnap.sys F7529BD0 4 Bytes [B0, A5, 53, 80]
   INITc VolSnap.sys F7529BF8 4 Bytes [B8, A1, 4F, 80]
   INITc VolSnap.sys F7529C20 4 Bytes [B6, AE, 4F, 80]
   INITc VolSnap.sys F7529C48 4 Bytes [30, FF, 4F, 80]
   INITc VolSnap.sys F7529C70 4 Bytes [7A, A8, 4F, 80]
   INITc ...
   
   ---- Threads - GMER 1.0.15 ----
   
   Thread System [4:120] 83725E7A
   Thread System [4:124] 83728008
   
   ---- EOF - GMER 1.0.15 ----
   
   
   MBRCheck, version 1.2.3
   (c) 2010, AD
   
   Command-line:
   Windows Version: Windows XP Home Edition
   Windows Information: Service Pack 3 (build 2600)
   Logical Drives Mask: 0x0000001c
   
   Kernel Drivers (total 110):
   0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
   0x806E5000 \WINDOWS\system32\hal.dll
   0xF79FE000 \WINDOWS\system32\KDCOM.DLL
   0xF790E000 \WINDOWS\system32\BOOTVID.dll
   0xF73CF000 ACPI.sys
   0xF7A00000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
   0xF73BE000 pci.sys
   0xF74FE000 isapnp.sys
   0xF7AC6000 pciide.sys
   0xF777E000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
   0xF7A02000 intelide.sys
   0xF750E000 MountMgr.sys
   0xF739F000 ftdisk.sys
   0xF7786000 PartMgr.sys
   0xF751E000 VolSnap.sys
   0xF7387000 atapi.sys
   0xF752E000 disk.sys
   0xF753E000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
   0xF7367000 fltmgr.sys
   0xF7355000 sr.sys
   0xF778E000 PxHelp20.sys
   0xF733E000 KSecDD.sys
   0xF72B1000 Ntfs.sys
   0xF7284000 NDIS.sys
   0xF726A000 Mup.sys
   0xF770E000 \SystemRoot\system32\DRIVERS\intelppm.sys
   0xF6D8E000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
   0xF6D7A000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
   0xF6D52000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
   0xF783E000 \SystemRoot\system32\DRIVERS\usbuhci.sys
   0xF6D2E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
   0xF7846000 \SystemRoot\system32\DRIVERS\usbehci.sys
   0xF6D08000 \SystemRoot\system32\DRIVERS\e100b325.sys
   0xF771E000 \SystemRoot\system32\DRIVERS\cdrom.sys
   0xF772E000 \SystemRoot\system32\DRIVERS\redbook.sys
   0xF6CE5000 \SystemRoot\system32\DRIVERS\ks.sys
   0xF7C4E000 \SystemRoot\system32\DRIVERS\audstub.sys
   0xF773E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
   0xF7219000 \SystemRoot\system32\DRIVERS\ndistapi.sys
   0xF6CCE000 \SystemRoot\system32\DRIVERS\ndiswan.sys
   0xF774E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
   0xF775E000 \SystemRoot\system32\DRIVERS\raspptp.sys
   0xF784E000 \SystemRoot\system32\DRIVERS\TDI.SYS
   0xF6CBD000 \SystemRoot\system32\DRIVERS\psched.sys
   0xF755E000 \SystemRoot\system32\DRIVERS\msgpc.sys
   0xF7856000 \SystemRoot\system32\DRIVERS\ptilink.sys
   0xF785E000 \SystemRoot\system32\DRIVERS\raspti.sys
   0xF756E000 \SystemRoot\system32\DRIVERS\termdd.sys
   0xF7866000 \SystemRoot\system32\DRIVERS\kbdclass.sys
   0xF786E000 \SystemRoot\system32\DRIVERS\mouclass.sys
   0xF7A2C000 \SystemRoot\system32\DRIVERS\swenum.sys
   0xF6C5F000 \SystemRoot\system32\DRIVERS\update.sys
   0xF7211000 \SystemRoot\system32\DRIVERS\mssmbios.sys
   0xF75EE000 \SystemRoot\System32\Drivers\NDProxy.SYS
   0xF761E000 \SystemRoot\system32\DRIVERS\usbhub.sys
   0xF7A3E000 \SystemRoot\system32\DRIVERS\USBD.SYS
   0xAA41F000 \SystemRoot\system32\drivers\sthda.sys
   0xAA3FB000 \SystemRoot\system32\drivers\portcls.sys
   0xF767E000 \SystemRoot\system32\drivers\drmk.sys
   0xF79D2000 \SystemRoot\System32\Drivers\i2omgmt.SYS
   0xF7A64000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
   0xF7C06000 \SystemRoot\System32\Drivers\Null.SYS
   0xF7A66000 \SystemRoot\System32\Drivers\Beep.SYS
   0xF77DE000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
   0xF77E6000 \SystemRoot\System32\drivers\vga.sys
   0xF7A68000 \SystemRoot\System32\Drivers\mnmdd.SYS
   0xF7A6A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
   0xF78EE000 \SystemRoot\System32\Drivers\Msfs.SYS
   0xF78F6000 \SystemRoot\System32\Drivers\Npfs.SYS
   0xF79DA000 \SystemRoot\system32\DRIVERS\rasacd.sys
   0xA94AE000 \SystemRoot\system32\DRIVERS\ipsec.sys
   0xA9455000 \SystemRoot\system32\DRIVERS\tcpip.sys
   0xA942D000 \SystemRoot\system32\DRIVERS\netbt.sys
   0xA9407000 \SystemRoot\system32\DRIVERS\ipnat.sys
   0xF6B92000 \SystemRoot\system32\DRIVERS\wanarp.sys
   0xA93E5000 \SystemRoot\System32\drivers\afd.sys
   0xF6B82000 \SystemRoot\system32\DRIVERS\netbios.sys
   0xA931A000 \SystemRoot\system32\DRIVERS\rdbss.sys
   0xA92AA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
   0xF6B52000 \SystemRoot\System32\Drivers\Fips.SYS
   0xF7816000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
   0xAA5F0000 \SystemRoot\system32\DRIVERS\hidusb.sys
   0xA93D5000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
   0xAA5EC000 \SystemRoot\system32\DRIVERS\mouhid.sys
   0xAA5E0000 \SystemRoot\system32\DRIVERS\kbdhid.sys
   0x9FABD000 \SystemRoot\System32\Drivers\Fastfat.SYS
   0x9FAAC000 \SystemRoot\System32\Drivers\Udfs.SYS
   0x9FA94000 \SystemRoot\System32\Drivers\dump_atapi.sys
   0xA0583000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
   0xBF800000 \SystemRoot\System32\win32k.sys
   0xA0523000 \SystemRoot\System32\drivers\Dxapi.sys
   0x9FE64000 \SystemRoot\System32\watchdog.sys
   0xBF000000 \SystemRoot\System32\drivers\dxg.sys
   0x9FCD7000 \SystemRoot\System32\drivers\dxgthk.sys
   0xBF020000 \SystemRoot\System32\ialmdnt5.dll
   0xBF012000 \SystemRoot\System32\ialmrnt5.dll
   0xBF042000 \SystemRoot\System32\ialmdev5.DLL
   0xBF077000 \SystemRoot\System32\ialmdd5.DLL
   0xBF15A000 \SystemRoot\System32\ATMFD.DLL
   0xF79AE000 \SystemRoot\system32\DRIVERS\ndisuio.sys
   0x9FA67000 \SystemRoot\system32\DRIVERS\mrxdav.sys
   0x9FA2A000 \SystemRoot\system32\drivers\wdmaud.sys
   0xF6B32000 \SystemRoot\system32\drivers\sysaudio.sys
   0xA0456000 \SystemRoot\System32\Drivers\ASCTRM.SYS
   0xA02E7000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
   0x9F83C000 \SystemRoot\system32\DRIVERS\srv.sys
   0x9F5F3000 \SystemRoot\System32\Drivers\HTTP.sys
   0x9EEB1000 \??\C:\DOCUME~1\Robert\LOCALS~1\Temp\uwlyapog.sys
   0x9EE86000 \SystemRoot\system32\drivers\kmixer.sys
   0x7C900000 \WINDOWS\system32\ntdll.dll
   
   Processes (total 32):
   0 System Idle Process
   4 System
   568 C:\WINDOWS\system32\smss.exe
   616 csrss.exe
   640 C:\WINDOWS\system32\winlogon.exe
   684 C:\WINDOWS\system32\services.exe
   700 C:\WINDOWS\system32\lsass.exe
   872 C:\WINDOWS\system32\svchost.exe
   960 svchost.exe
   1000 C:\WINDOWS\system32\svchost.exe
   1088 svchost.exe
   1120 svchost.exe
   1272 C:\WINDOWS\system32\spoolsv.exe
   1372 svchost.exe
   1636 C:\WINDOWS\explorer.exe
   1684 C:\Program Files\Java\jre6\bin\jqs.exe
   1748 C:\Program Files\Common Files\Motive\McciCMService.exe
   1936 C:\WINDOWS\system32\svchost.exe
   2036 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
   1572 C:\Program Files\Java\jre6\bin\jusched.exe
   1440 alg.exe
   1628 C:\Program Files\Real\RealPlayer\realplay.exe
   1824 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
   1976 C:\WINDOWS\system32\igfxpers.exe
   1920 C:\WINDOWS\system32\hkcmd.exe
   1864 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
   2060 C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
   2068 C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
   2156 C:\WINDOWS\system32\ctfmon.exe
   2232 C:\WINDOWS\system32\wscntfy.exe
   2400 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
   1808 E:\Help\MBRCheck.exe
   
   \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)
   
   PhysicalDrive0 Model Number: SAMSUNGHD080HJ/P, Rev: ZH100-34
   
   Size Device Name MBR Status
   --------------------------------------------
   74 GB \\.\PhysicalDrive0 Dell MBR code detected
   SHA1: 57BDF501CE769EF2720C705B6C71C893DA31574E
   
   
   Done!
   
   
   
   DDS (Ver_11-05-19.01) - NTFSx86
   Internet Explorer: 8.0.6001.18702
   Run by Robert at 0:39:04 on 2011-05-26
   Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.758.407 [GMT -4:00]
   .
   .
   ============== Running Processes ===============
   .
   C:\WINDOWS\system32\svchost -k DcomLaunch
   svchost.exe
   C:\WINDOWS\System32\svchost.exe -k netsvcs
   svchost.exe
   svchost.exe
   C:\WINDOWS\system32\spoolsv.exe
   svchost.exe
   C:\WINDOWS\Explorer.EXE
   C:\Program Files\Java\jre6\bin\jqs.exe
   C:\Program Files\Common Files\Motive\McciCMService.exe
   C:\WINDOWS\system32\svchost.exe -k imgsvc
   C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
   C:\Program Files\Java\jre6\bin\jusched.exe
   C:\Program Files\Real\RealPlayer\RealPlay.exe
   C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
   C:\WINDOWS\system32\igfxpers.exe
   C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
   C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
   C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
   C:\WINDOWS\system32\ctfmon.exe
   C:\WINDOWS\system32\wscntfy.exe
   C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
   C:\Documents and Settings\Robert\Desktop\dds.scr
   C:\WINDOWS\system32\WSCRIPT.exe
   .
   ============== Pseudo HJT Report ===============
   .
   uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
   uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
   uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8
   uWindow Title = Windows Internet Explorer provided by Yahoo!
   uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en
   uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
   BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
   BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
   BHO: Yahooo Search Protection: {25bc7718-0bfa-40ea-b381-4b2d9732d686} - c:\program files\yahoo!\search protection\ysp.dll
   BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
   BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
   BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
   BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\googleafe\GoogleAE.dll
   BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
   BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
   BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
   TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
   TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
   uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
   uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
   uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
   uRun: [Malware Protection] c:\documents and settings\all users\application data\defender.exe
   uRun: [Google Update] "c:\documents and settings\robert\local settings\application data\google\update\GoogleUpdate.exe" /c
   uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
   mRun: [SunJavaUpdateSched] c:\program files\java\jre6\bin\jusched.exe
   mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
   mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
   mRun: [MimBoot] c:\progra~1\musicm~1\musicm~3\mimboot.exe
   mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
   mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
   mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
   mRun: [igfxtray] c:\windows\system32\igfxtray.exe
   mRun: [igfxpers] c:\windows\system32\igfxpers.exe
   mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
   mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe "
   mRun: [Corel Photo Downloader] c:\program files\corel\corel photo album 6\MediaDetect.exe
   IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
   IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
   IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
   IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
   IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
   IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
   DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
   DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1251250637203
   DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
   DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
   DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
   DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
   Notify: igfxcui - igfxdev.dll
   SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
   mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12
   Hosts: 127.0.0.1 www.spywareinfo.com
   .
   ============= SERVICES / DRIVERS ===============
   .
   S1 JAVA.EXE;JAVA.EXE;c:\windows\system32\drivers\JAVA.EXE.sys [2010-1-21 0]
   S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-15 135664]
   S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-15 135664]
   .
   =============== Created Last 30 ================
   .
   2011-05-22 20:36:54 -------- d-----w- c:\documents and settings\robert\local settings\application data\Deployment
   2011-05-17 21:53:48 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
   2011-05-17 21:53:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
   2011-05-14 12:40:12 404640 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
   .
   ==================== Find3M ====================
   .
   2011-05-23 22:34:51 4184 --sha-w- c:\windows\system32\KGyGaAvL.sys
   2011-05-23 22:34:51 104 --sh--r- c:\windows\system32\CC79A01303.sys
   2011-03-07 05:33:50 692736 ---ha-w- c:\windows\system32\inetcomm.dll
   2011-03-04 06:37:06 420864 ---ha-w- c:\windows\system32\vbscript.dll
   2011-03-03 13:21:11 1857920 ---ha-w- c:\windows\system32\win32k.sys
   .
   ============= FINISH: 0:39:35.40 ===============
   
   
   .
   UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
   IF REQUESTED, ZIP IT UP & ATTACH IT
   .
   DDS (Ver_11-05-19.01)
   .
   Microsoft Windows XP Home Edition
   Boot Device: \Device\HarddiskVolume2
   Install Date: 2/13/2006 7:02:27 PM
   System Uptime: 5/25/2011 11:40:15 PM (1 hours ago)
   .
   Motherboard: Dell Inc. | | 0JC474
   Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz
   .
   ==== Disk Partitions =========================
   .
   C: is FIXED (NTFS) - 71 GiB total, 62.227 GiB free.
   D: is CDROM (UDF)
   E: is Removable
   .
   ==== Disabled Device Manager Items =============
   .
   ==== System Restore Points ===================
   .
   RP1: 5/25/2011 11:42:42 PM - System Checkpoint
   .
   ==== Installed Programs ======================
   .
   Adobe Flash Player 10 ActiveX
   Adobe Reader 7.1.0
   Adobe Shockwave Player 11.5
   ATT-RC Self Support Tool
   Comcast High-Speed Internet Install Wizard
   Corel Photo Album 6
   Critical Update for Windows Media Player 11 (KB959772)
   Dell Digital Jukebox Driver
   Dell Driver Reset Tool
   Dell System Restore
   DellSupport
   Digital Content Portal
   EarthLink setup files
   Google AFE
   Google Chrome
   Google Toolbar for Internet Explorer
   Google Update Helper
   High Definition Audio Driver Package - KB835221
   Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
   Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
   Hotfix for Windows Internet Explorer 7 (KB947864)
   Hotfix for Windows Media Format 11 SDK (KB929399)
   Hotfix for Windows Media Player 11 (KB939683)
   Hotfix for Windows XP (KB2158563)
   Hotfix for Windows XP (KB2443685)
   Hotfix for Windows XP (KB952287)
   Hotfix for Windows XP (KB954550-v5)
   Hotfix for Windows XP (KB961118)
   Hotfix for Windows XP (KB970653-v3)
   Hotfix for Windows XP (KB976098-v2)
   Hotfix for Windows XP (KB979306)
   Hotfix for Windows XP (KB981793)
   Intel(R) Graphics Media Accelerator Driver
   Intel(R) PRO Network Connections Drivers
   Intel(R) PROSet for Wired Connections
   J2SE Runtime Environment 5.0 Update 10
   J2SE Runtime Environment 5.0 Update 6
   J2SE Runtime Environment 5.0 Update 9
   Java(TM) 6 Update 17
   Java(TM) 6 Update 2
   Java(TM) 6 Update 7
   Learn2 Player (Uninstall Only)
   Macromedia Flash Player
   Malwarebytes' Anti-Malware
   MCU
   Microsoft .NET Framework 1.1
   Microsoft .NET Framework 1.1 Security Update (KB2416447)
   Microsoft .NET Framework 1.1 Security Update (KB979906)
   Microsoft .NET Framework 2.0 Service Pack 2
   Microsoft .NET Framework 3.0 Service Pack 2
   Microsoft .NET Framework 3.5 SP1
   Microsoft Compression Client Pack 1.0 for Windows XP
   Microsoft Internationalized Domain Names Mitigation APIs
   Microsoft National Language Support Downlevel APIs
   Microsoft Plus! Digital Media Edition Installer
   Microsoft Plus! Photo Story 2 LE
   Microsoft User-Mode Driver Framework Feature Pack 1.0
   Microsoft Visual C++ 2005 Redistributable
   MSXML 4.0 SP2 (KB927978)
   MSXML 4.0 SP2 (KB936181)
   MSXML 4.0 SP2 (KB954430)
   MSXML 4.0 SP2 (KB973688)
   Musicmatch for Windows Media Player
   Musicmatch® Jukebox
   NetZeroInstallers
   ParetoLogic PC Health Advisor
   PowerDVD 5.5
   Qualxserve Service Agreement
   QuickBooks Simple Start Special Edition
   QuickTime
   RealPlayer Basic
   Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
   Security Update for Step By Step Interactive Training (KB898458)
   Security Update for Step By Step Interactive Training (KB923723)
   Security Update for Windows Internet Explorer 7 (KB928090)
   Security Update for Windows Internet Explorer 7 (KB929969)
   Security Update for Windows Internet Explorer 7 (KB931768)
   Security Update for Windows Internet Explorer 7 (KB933566)
   Security Update for Windows Internet Explorer 7 (KB937143)
   Security Update for Windows Internet Explorer 7 (KB938127)
   Security Update for Windows Internet Explorer 7 (KB939653)
   Security Update for Windows Internet Explorer 7 (KB942615)
   Security Update for Windows Internet Explorer 7 (KB944533)
   Security Update for Windows Internet Explorer 7 (KB950759)
   Security Update for Windows Internet Explorer 7 (KB953838)
   Security Update for Windows Internet Explorer 7 (KB956390)
   Security Update for Windows Internet Explorer 7 (KB958215)
   Security Update for Windows Internet Explorer 7 (KB960714)
   Security Update for Windows Internet Explorer 7 (KB961260)
   Security Update for Windows Internet Explorer 7 (KB963027)
   Security Update for Windows Internet Explorer 7 (KB969897)
   Security Update for Windows Internet Explorer 7 (KB972260)
   Security Update for Windows Internet Explorer 7 (KB974455)
   Security Update for Windows Internet Explorer 7 (KB976325)
   Security Update for Windows Internet Explorer 7 (KB978207)
   Security Update for Windows Internet Explorer 7 (KB982381)
   Security Update for Windows Internet Explorer 8 (KB2183461)
   Security Update for Windows Internet Explorer 8 (KB2360131)
   Security Update for Windows Internet Explorer 8 (KB2416400)
   Security Update for Windows Internet Explorer 8 (KB2482017)
   Security Update for Windows Internet Explorer 8 (KB2497640)
   Security Update for Windows Internet Explorer 8 (KB2510531)
   Security Update for Windows Internet Explorer 8 (KB971961)
   Security Update for Windows Internet Explorer 8 (KB981332)
   Security Update for Windows Internet Explorer 8 (KB982381)
   Security Update for Windows Media Player (KB2378111)
   Security Update for Windows Media Player (KB911564)
   Security Update for Windows Media Player (KB952069)
   Security Update for Windows Media Player (KB954155)
   Security Update for Windows Media Player (KB968816)
   Security Update for Windows Media Player (KB973540)
   Security Update for Windows Media Player (KB975558)
   Security Update for Windows Media Player (KB978695)
   Security Update for Windows Media Player 10 (KB911565)
   Security Update for Windows Media Player 10 (KB917734)
   Security Update for Windows Media Player 11 (KB936782)
   Security Update for Windows Media Player 11 (KB954154)
   Security Update for Windows Media Player 6.4 (KB925398)
   Security Update for Windows XP (KB2079403)
   Security Update for Windows XP (KB2115168)
   Security Update for Windows XP (KB2121546)
   Security Update for Windows XP (KB2160329)
   Security Update for Windows XP (KB2229593)
   Security Update for Windows XP (KB2259922)
   Security Update for Windows XP (KB2279986)
   Security Update for Windows XP (KB2286198)
   Security Update for Windows XP (KB2296011)
   Security Update for Windows XP (KB2296199)
   Security Update for Windows XP (KB2347290)
   Security Update for Windows XP (KB2360937)
   Security Update for Windows XP (KB2387149)
   Security Update for Windows XP (KB2393802)
   Security Update for Windows XP (KB2412687)
   Security Update for Windows XP (KB2419632)
   Security Update for Windows XP (KB2423089)
   Security Update for Windows XP (KB2436673)
   Security Update for Windows XP (KB2440591)
   Security Update for Windows XP (KB2443105)
   Security Update for Windows XP (KB2476687)
   Security Update for Windows XP (KB2478960)
   Security Update for Windows XP (KB2478971)
   Security Update for Windows XP (KB2479628)
   Security Update for Windows XP (KB2479943)
   Security Update for Windows XP (KB2481109)
   Security Update for Windows XP (KB2483185)
   Security Update for Windows XP (KB2485376)
   Security Update for Windows XP (KB2485663)
   Security Update for Windows XP (KB2491683)
   Security Update for Windows XP (KB2503658)
   Security Update for Windows XP (KB2506212)
   Security Update for Windows XP (KB2506223)
   Security Update for Windows XP (KB2507618)
   Security Update for Windows XP (KB2508272)
   Security Update for Windows XP (KB2508429)
   Security Update for Windows XP (KB2509553)
   Security Update for Windows XP (KB2511455)
   Security Update for Windows XP (KB2524375)
   Security Update for Windows XP (KB923561)
   Security Update for Windows XP (KB923689)
   Security Update for Windows XP (KB938464)
   Security Update for Windows XP (KB941569)
   Security Update for Windows XP (KB946648)
   Security Update for Windows XP (KB950760)
   Security Update for Windows XP (KB950762)
   Security Update for Windows XP (KB950974)
   Security Update for Windows XP (KB951066)
   Security Update for Windows XP (KB951376-v2)
   Security Update for Windows XP (KB951376)
   Security Update for Windows XP (KB951698)
   Security Update for Windows XP (KB951748)
   Security Update for Windows XP (KB952004)
   Security Update for Windows XP (KB952954)
   Security Update for Windows XP (KB953839)
   Security Update for Windows XP (KB954211)
   Security Update for Windows XP (KB954459)
   Security Update for Windows XP (KB954600)
   Security Update for Windows XP (KB955069)
   Security Update for Windows XP (KB956391)
   Security Update for Windows XP (KB956572)
   Security Update for Windows XP (KB956744)
   Security Update for Windows XP (KB956802)
   Security Update for Windows XP (KB956803)
   Security Update for Windows XP (KB956841)
   Security Update for Windows XP (KB956844)
   Security Update for Windows XP (KB957095)
   Security Update for Windows XP (KB957097)
   Security Update for Windows XP (KB958644)
   Security Update for Windows XP (KB958687)
   Security Update for Windows XP (KB958690)
   Security Update for Windows XP (KB958869)
   Security Update for Windows XP (KB959426)
   Security Update for Windows XP (KB960225)
   Security Update for Windows XP (KB960715)
   Security Update for Windows XP (KB960803)
   Security Update for Windows XP (KB960859)
   Security Update for Windows XP (KB961371)
   Security Update for Windows XP (KB961373)
   Security Update for Windows XP (KB961501)
   Security Update for Windows XP (KB968537)
   Security Update for Windows XP (KB969059)
   Security Update for Windows XP (KB969898)
   Security Update for Windows XP (KB969947)
   Security Update for Windows XP (KB970238)
   Security Update for Windows XP (KB970430)
   Security Update for Windows XP (KB971468)
   Security Update for Windows XP (KB971486)
   Security Update for Windows XP (KB971557)
   Security Update for Windows XP (KB971633)
   Security Update for Windows XP (KB971657)
   Security Update for Windows XP (KB971961)
   Security Update for Windows XP (KB972270)
   Security Update for Windows XP (KB973346)
   Security Update for Windows XP (KB973354)
   Security Update for Windows XP (KB973507)
   Security Update for Windows XP (KB973525)
   Security Update for Windows XP (KB973869)
   Security Update for Windows XP (KB973904)
   Security Update for Windows XP (KB974112)
   Security Update for Windows XP (KB974318)
   Security Update for Windows XP (KB974392)
   Security Update for Windows XP (KB974571)
   Security Update for Windows XP (KB975025)
   Security Update for Windows XP (KB975467)
   Security Update for Windows XP (KB975560)
   Security Update for Windows XP (KB975561)
   Security Update for Windows XP (KB975562)
   Security Update for Windows XP (KB975713)
   Security Update for Windows XP (KB977165)
   Security Update for Windows XP (KB977816)
   Security Update for Windows XP (KB977914)
   Security Update for Windows XP (KB978037)
   Security Update for Windows XP (KB978251)
   Security Update for Windows XP (KB978262)
   Security Update for Windows XP (KB978338)
   Security Update for Windows XP (KB978542)
   Security Update for Windows XP (KB978601)
   Security Update for Windows XP (KB978706)
   Security Update for Windows XP (KB979309)
   Security Update for Windows XP (KB979482)
   Security Update for Windows XP (KB979559)
   Security Update for Windows XP (KB979683)
   Security Update for Windows XP (KB979687)
   Security Update for Windows XP (KB980195)
   Security Update for Windows XP (KB980218)
   Security Update for Windows XP (KB980232)
   Security Update for Windows XP (KB980436)
   Security Update for Windows XP (KB981322)
   Security Update for Windows XP (KB981349)
   Security Update for Windows XP (KB981852)
   Security Update for Windows XP (KB981957)
   Security Update for Windows XP (KB981997)
   Security Update for Windows XP (KB982132)
   Security Update for Windows XP (KB982214)
   Security Update for Windows XP (KB982665)
   Security Update for Windows XP (KB982802)
   Spybot - Search & Destroy
   Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
   Update for Windows Internet Explorer 7 (KB976749)
   Update for Windows Internet Explorer 7 (KB980182)
   Update for Windows Internet Explorer 8 (KB976662)
   Update for Windows Internet Explorer 8 (KB982632)
   Update for Windows XP (KB2141007)
   Update for Windows XP (KB2345886)
   Update for Windows XP (KB2467659)
   Update for Windows XP (KB951072-v2)
   Update for Windows XP (KB951978)
   Update for Windows XP (KB955759)
   Update for Windows XP (KB955839)
   Update for Windows XP (KB967715)
   Update for Windows XP (KB968389)
   Update for Windows XP (KB971029)
   Update for Windows XP (KB971737)
   Update for Windows XP (KB973687)
   Update for Windows XP (KB973815)
   Viewpoint Media Player
   WebFldrs XP
   Windows Genuine Advantage Notifications (KB905474)
   Windows Genuine Advantage v1.3.0254.0
   Windows Genuine Advantage Validation Tool (KB892130)
   Windows Internet Explorer 7
   Windows Internet Explorer 8
   Windows Media Format 11 runtime
   Windows Media Player 10
   Windows Media Player 11
   Windows XP Service Pack 3
   WordPerfect Office 12
   Yahoo! Browser Services
   Yahoo! Search Protection
   Yahoo! Software Update
   Yahoo! Toolbar
   .
   ==== Event Viewer Messages From Past Week ========
   .
   5/23/2011 6:33:37 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde
   5/23/2011 6:33:32 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
   5/23/2011 6:31:41 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
   5/23/2011 6:28:50 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm
   5/23/2011 6:24:19 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
   5/23/2011 2:54:41 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
   5/23/2011 2:54:41 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
   5/23/2011 2:54:41 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
   5/23/2011 2:54:41 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
   5/23/2011 2:54:41 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
   5/23/2011 2:54:33 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
   5/23/2011 2:54:05 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
   5/23/2011 2:54:02 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
   5/23/2011 11:27:05 PM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
   5/20/2011 12:03:31 AM, error: Dhcp [1002] - The IP address lease 192.168.251.199 for the Network Card with network address 001320C3F420 has been denied by the DHCP server 192.168.251.1 (The DHCP Server sent a DHCPNACK message).
   .
   ==== End Of File ===========================

 

Update

I installed Avast. While the program was scanning the hard drive, a popup message from Avast indicating that it had blocked a malicious url - explorer.exe

The Avast scan detected 4 infected files:
Popp(1),htm JS:AdClicker-A
Lunderx(1).htm Downloader-KV
Index(1).htm Downloader-LF
Utsyel(1) pdfka-gen
I had Avast delete the files

Avast then ran a boot-time scan detected and deleted the following files:
Scan results globalas.class is infected by Malware-gen deleted
Manuals.class is infected by Malware-gen deleted
Support.class is infected by Java Jade-C deleted
Server1.class is infected by Jave Agene-BG deleted
Server2.class infected by Jade-C
Update.class infected by Malware-gen
Checklist.class infected by Agent-if
Constant.class infected by Agent-I
J2ee.class infectected by Agent-ig
Template.class Agent-im
Seopack.class Malware-gen
Email.class agent-ct
Fufaservice.class agent-by
Customclass.class jade-8
Customeclassloaderrepository.class Malware-gen

Root Unhooker Logs
RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2154496 bytes
0x804D7000 RAW 2154496 bytes
0x804D7000 WMIxWDM 2154496 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF6E69000 C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 1306624 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xAA486000 C:\WINDOWS\system32\drivers\sthda.sys 991232 bytes (SigmaTel, Inc., NDRC)
0xBF077000 C:\WINDOWS\System32\ialmdd5.DLL 929792 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0xF72B1000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xA92AE000 C:\WINDOWS\System32\Drivers\aswSnx.SYS 458752 bytes (AVAST Software, avast! Virtualization Driver)
0xA940B000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF6D3A000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xA95C9000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA459D000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xA931E000 C:\WINDOWS\System32\Drivers\aswSP.SYS 303104 bytes (AVAST Software, avast! self protection module)
0xBF15A000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA423C000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xBF042000 C:\WINDOWS\System32\ialmdev5.DLL 217088 bytes (Intel Corporation, Component GHAL Driver)
0xF73CF000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA461D000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF7284000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xA947B000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF6E2D000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xA957B000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF6DE3000 C:\WINDOWS\system32\DRIVERS\e100b325.sys 155648 bytes (Intel Corporation, Intel(R) PRO/100 Adapter NDIS 5.1 driver)
0xA95A3000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xA5296000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xAA462000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF6E09000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF6DC0000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xA9559000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xBF020000 C:\WINDOWS\System32\ialmdnt5.dll 139264 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0x806E5000 ACPI_HAL 134400 bytes
0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF7367000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF739F000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF726A000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF7387000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xA526D000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xA518E000 C:\WINDOWS\System32\Drivers\aswMon2.SYS 94208 bytes (AVAST Software, avast! File System Filter Driver for Windows XP)
0xF733E000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF6DA9000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA4858000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF6E55000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xA9622000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF7355000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF73BE000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF6D98000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xA5285000 C:\WINDOWS\System32\Drivers\Udfs.SYS 69632 bytes (Microsoft Corporation, UDF File System Driver)
0xF760E000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF758E000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF761E000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA4925000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF757E000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xF753E000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF763E000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF751E000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF765E000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF6C25000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF750E000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF764E000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF75EE000 C:\WINDOWS\System32\Drivers\aswTdi.SYS 40960 bytes (AVAST Software, avast! TDI Filter Driver)
0xF74FE000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF76FE000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF767E000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF752E000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xAA68E000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF75FE000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF766E000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF6C55000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA431D000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF774E000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF780E000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF786E000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF7806000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF777E000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7856000 C:\WINDOWS\System32\Drivers\Aavmker4.SYS 24576 bytes (AVAST Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP)
0xF788E000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF7896000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF7866000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF77F6000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF782E000 C:\WINDOWS\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver)
0xF77FE000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF7786000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF787E000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF778E000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF7886000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF7876000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xA93D3000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xA93E7000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF6FB0000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA51F9000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xA928E000 C:\WINDOWS\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver)
0xF790E000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF79CA000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xA93FF000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF79FA000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xA93FB000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF6FB8000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF7231000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF7A2C000 C:\WINDOWS\System32\Drivers\ASCTRM.SYS 8192 bytes (Windows (R) 2000 DDK provider, TR Manager)
0xF7A74000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7A7E000 C:\WINDOWS\system32\DRIVERS\dsunidrv.sys 8192 bytes (Gteko Ltd., GUniDriver)
0xF7A28000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7A72000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7A02000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF79FE000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7A76000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF7A78000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF7A36000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF7A5C000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7A00000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7B7E000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7BDE000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7B54000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7AC6000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
0x83720A91 Unknown page with executable code, 1391 bytes
0x8371F288 Unknown page with executable code, 3448 bytes
0x83721191 Unknown page with executable code, 3695 bytes
0xF751E000 WARNING: Virus alike driver modification [VolSnap.sys], 53248 bytes
0x83723E7A Unknown thread object [ ETHREAD 0x8376F6C8 ] TID: 120, 600 bytes
0x83726008 Unknown thread object [ ETHREAD 0x8376F450 ] TID: 124, 600 bytes
0x837250DE Unknown thread object [ ETHREAD 0x8376F1D8 ] , 600 bytes
0x83723B45 Unknown thread object [ ETHREAD 0x8375D020 ] , 600 bytes
0x83725CDC Unknown page with executable code, 804 bytes

Un installed Avast and ran ComboFix
ComboFix 11-05-27.01 - Robert 05/27/2011 23:32:41.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.758.372 [GMT -4:00]
Running from: c:\documents and settings\Robert\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Robert\Application Data\PCPrivacyCleaner
c:\documents and settings\Robert\Application Data\PCPrivacyCleaner\Logs\scns.log
c:\documents and settings\Robert\Local Settings\Application Data\{1EC4BA69-2CB7-492E-ABE8-569731C31E59}
c:\documents and settings\Robert\Local Settings\Application Data\{1EC4BA69-2CB7-492E-ABE8-569731C31E59}\chrome.manifest
c:\documents and settings\Robert\Local Settings\Application Data\{1EC4BA69-2CB7-492E-ABE8-569731C31E59}\chrome\content\_cfg.js
c:\documents and settings\Robert\Local Settings\Application Data\{1EC4BA69-2CB7-492E-ABE8-569731C31E59}\chrome\content\overlay.xul
c:\documents and settings\Robert\Local Settings\Application Data\{1EC4BA69-2CB7-492E-ABE8-569731C31E59}\install.rdf
c:\program files\Shared
c:\windows\system32\bszip.dll
.
Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((( Files Created from 2011-04-28 to 2011-05-28 )))))))))))))))))))))))))))))))
.
.
2011-05-27 09:57 . 2011-05-28 03:00 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-05-27 09:57 . 2011-05-27 09:57 -------- d-----w- c:\program files\AVAST Software
2011-05-22 20:36 . 2011-05-22 20:37 -------- d-----w- c:\documents and settings\Robert\Local Settings\Application Data\Deployment
2011-05-17 22:06 . 2011-05-17 22:06 -------- d-----w- c:\documents and settings\Administrator
2011-05-17 21:53 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-17 21:53 . 2011-05-17 22:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-14 12:40 . 2011-05-14 12:40 404640 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-07 05:33 . 2004-08-10 19:02 692736 ---ha-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-10 18:51 420864 ---ha-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-10 18:51 1857920 ---ha-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr "= "c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-15 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-12-27 149280]
"RealTray "= "c:\program files\Real\RealPlayer\RealPlay.exe" [2006-01-31 26112]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2006-01-31 98304]
"MimBoot "= "c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe" [2005-09-09 8192]
"ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup "= "c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"igfxtray "= "c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxpers "= "c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"DVDLauncher "= "c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"Corel Photo Downloader "= "c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe" [2005-11-17 106496]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\English\\setup.exe "=
.
S1 JAVA.EXE;JAVA.EXE;c:\windows\system32\drivers\JAVA.EXE.sys [1/21/2010 11:25 PM 0]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2010 6:23 PM 135664]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2010 6:23 PM 135664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 ---ha-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2010-07-18 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-10 00:12]
.
2011-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-15 22:23]
.
2011-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-15 22:23]
.
2011-05-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2586179840-2599477267-1880732869-1006Core.job
- c:\documents and settings\Robert\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-22 20:37]
.
2011-05-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2586179840-2599477267-1880732869-1006UA.job
- c:\documents and settings\Robert\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-22 20:37]
.
2011-05-23 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-10-12 05:01]
.
2010-09-21 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-10-12 05:01]
.
2010-09-21 c:\windows\Tasks\PC Health Advisor Defrag.job
- c:\program files\ParetoLogic\PCHA\PCHA.exe [2010-08-24 22:47]
.
2010-09-21 c:\windows\Tasks\PC Health Advisor.job
- c:\program files\ParetoLogic\PCHA\PCHA.exe [2010-08-24 22:47]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Malware Protection - c:\documents and settings\All Users\Application Data\defender.exe
SafeBoot-CnPk23
SafeBoot-CnPk23.sys
SafeBoot-JAVA.EXE
AddRemove-Malwarebytes' Anti-Malware_is1 - e:\malwarebytes' anti-malware\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-27 23:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-05-27 23:39:21
ComboFix-quarantined-files.txt 2011-05-28 03:39
.
Pre-Run: 66,221,977,600 bytes free
Post-Run: 66,255,564,800 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - B940DBE90DCE545EB46CCAD0D5161A5B


Reinstalled Avast. Everything appears to be working correctly. I accessed the internet and the redirects were gone. I know I'm not done but do want to say thanks.

 

I forgot to mention in my previous post that I have an icon on my desktop that looks like a shield named "Malware Protection ". It points to a file named defender.exe. I this program safe? I have not launched it.

 

Update 2

Fresh RkUnhooker Log

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2154496 bytes
0x804D7000 RAW 2154496 bytes
0x804D7000 WMIxWDM 2154496 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF70D2000 C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 1306624 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xAA6CE000 C:\WINDOWS\system32\drivers\sthda.sys 991232 bytes (SigmaTel, Inc., NDRC)
0xBF077000 C:\WINDOWS\System32\ialmdd5.DLL 929792 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0xF72B1000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xAA16F000 C:\WINDOWS\System32\Drivers\aswSnx.SYS 458752 bytes (AVAST Software, avast! Virtualization Driver)
0xAA371000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF6FA3000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xAA504000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA8F9B000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xAA2F1000 C:\WINDOWS\System32\Drivers\aswSP.SYS 303104 bytes (AVAST Software, avast! self protection module)
0xBF15A000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA8CB2000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xBF042000 C:\WINDOWS\System32\ialmdev5.DLL 217088 bytes (Intel Corporation, Component GHAL Driver)
0xF73CF000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA901B000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF7284000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xAA3E1000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF7096000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xAA47B000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF704C000 C:\WINDOWS\system32\DRIVERS\e100b325.sys 155648 bytes (Intel Corporation, Intel(R) PRO/100 Adapter NDIS 5.1 driver)
0xAA4A3000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xAA6AA000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF7072000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF7029000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xAA40C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xBF020000 C:\WINDOWS\System32\ialmdnt5.dll 139264 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0x806E5000 ACPI_HAL 134400 bytes
0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF7367000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF739F000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF726A000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF7387000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xA9ACA000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xA9833000 C:\WINDOWS\System32\Drivers\aswMon2.SYS 94208 bytes (AVAST Software, avast! File System Filter Driver for Windows XP)
0xF733E000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF7012000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA9256000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF70BE000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xAA55D000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF7355000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF73BE000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF7001000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF764E000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF76DE000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF755E000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF76EE000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA9423000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF776E000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xF753E000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF76FE000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF751E000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF771E000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF761E000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF750E000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF770E000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF75BE000 C:\WINDOWS\System32\Drivers\aswTdi.SYS 40960 bytes (AVAST Software, avast! TDI Filter Driver)
0xF74FE000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF774E000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF773E000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF752E000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF75DE000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF76CE000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF772E000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF75EE000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA8A9A000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF75CE000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF78CE000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF7876000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF78B6000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF777E000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7906000 C:\WINDOWS\System32\Drivers\Aavmker4.SYS 24576 bytes (AVAST Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP)
0xF7896000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF789E000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF786E000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF78BE000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF78E6000 C:\WINDOWS\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver)
0xF78C6000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF7786000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF7886000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF778E000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF788E000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF787E000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF779E000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF79C2000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF79DE000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA99CA000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xA9ABA000 C:\WINDOWS\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver)
0xF790E000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xAA245000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF7996000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF7221000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xF79A6000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF79D2000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF7219000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF7A60000 C:\WINDOWS\System32\Drivers\ASCTRM.SYS 8192 bytes (Windows (R) 2000 DDK provider, TR Manager)
0xF7A36000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7A68000 C:\WINDOWS\system32\DRIVERS\dsunidrv.sys 8192 bytes (Gteko Ltd., GUniDriver)
0xF7A4E000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7A34000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7A02000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF79FE000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7A38000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF7A3A000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF7A2A000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF7A2C000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7A00000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7BD9000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7BE2000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7AF5000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7AC6000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================


aswMBR Log


aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-28 06:12:36
-----------------------------
06:12:36.734 OS Version: Windows 5.1.2600 Service Pack 3
06:12:36.734 Number of processors: 2 586 0x409
06:12:36.734 ComputerName: DHQNPC91 UserName: Robert
06:12:37.125 Initialize success
06:12:43.765 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
06:12:43.765 Disk 0 Vendor: SAMSUNG_HD080HJ/P ZH100-34 Size: 76293MB BusType: 3
06:12:45.812 Disk 0 MBR read successfully
06:12:45.812 Disk 0 MBR scan
06:12:45.812 Disk 0 unknown MBR code
06:12:47.828 Disk 0 scanning sectors +156232125
06:12:47.843 Disk 0 scanning C:\WINDOWS\system32\drivers
06:12:52.937 Service scanning
06:12:54.015 Disk 0 trace - called modules:
06:12:54.031 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
06:12:54.031 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8379cab8]
06:12:54.031 3 CLASSPNP.SYS[f753efd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x83765b00]
06:12:54.031 Scan finished successfully
06:14:03.515 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Robert\Desktop\MBR.dat "
06:14:03.515 The log file has been saved successfully to "C:\Documents and Settings\Robert\Desktop\aswMBR log.txt "

 

OTL Log

OTL Log


OTL logfile created on: 5/28/2011 10:07:44 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Robert\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

758.07 Mb Total Physical Memory | 452.57 Mb Available Physical Memory | 59.70% Memory free
1.06 Gb Paging File | 0.85 Gb Available in Paging File | 79.75% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.36 Gb Total Space | 61.37 Gb Free Space | 86.01% Space Free | Partition Type: NTFS

Computer Name: DHQNPC91 | User Name: Robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/28 22:03:23 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
PRC - [2011/05/10 08:10:58 | 003,459,712 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/05/10 08:10:57 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/01/31 17:26:49 | 000,026,112 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\realplay.exe
PRC - [2005/11/16 20:08:40 | 000,106,496 | ---- | M] (Corel, Inc.) -- C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
PRC - [2005/09/08 21:20:46 | 000,464,384 | ---- | M] (Musicmatch, Inc.) -- C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
PRC - [2005/09/08 21:20:46 | 000,102,400 | ---- | M] (Musicmatch, Inc.) -- C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe


========== Modules (SafeList) ==========

MOD - [2011/05/28 22:03:23 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
MOD - [2011/05/10 08:10:55 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\snxhk.dll
MOD - [2010/08/23 12:12:02 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/05/10 08:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)


========== Driver Services (SafeList) ==========

DRV - [2011/05/10 08:03:54 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/05/10 08:03:44 | 000,307,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/05/10 08:02:37 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/05/10 08:02:25 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/05/10 07:59:56 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/05/10 07:59:37 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/05/10 07:59:35 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/01/21 23:25:33 | 000,000,000 | -H-- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\JAVA.EXE.sys -- (JAVA.EXE)
DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/01/31 17:26:52 | 000,008,552 | -H-- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2005/08/17 08:41:08 | 001,022,040 | -H-- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com [binary data]


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0



IE - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
IE - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0


[2011/01/05 16:09:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Robert\Application Data\Mozilla\Extensions

O1 HOSTS File: ([2011/05/27 23:37:02 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll (Google)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe (Corel, Inc.)
O4 - HKLM..\Run: [MimBoot] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1251250637203 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56027131116781568)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/28 22:03:20 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
[2011/05/28 06:12:18 | 000,589,632 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Robert\Desktop\aswMBR.exe
[2011/05/27 23:43:50 | 000,019,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/05/27 23:43:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2011/05/27 23:43:49 | 000,307,928 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/05/27 23:43:45 | 000,025,432 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/05/27 23:43:44 | 000,049,240 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/05/27 23:43:43 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/05/27 23:43:42 | 000,102,616 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/05/27 23:43:42 | 000,096,344 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/05/27 23:43:42 | 000,030,808 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/05/27 23:43:22 | 000,040,112 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/05/27 23:43:21 | 000,199,304 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/05/27 23:31:25 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/05/27 23:28:54 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/05/27 23:28:54 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/05/27 23:28:54 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/05/27 23:28:54 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/05/27 23:25:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/05/27 23:25:32 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/05/27 06:00:56 | 004,296,381 | R--- | C] (Swearware) -- C:\Documents and Settings\Robert\Desktop\ComboFix.exe
[2011/05/27 05:57:13 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011/05/27 05:57:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/05/26 00:39:04 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Robert\My Documents\My Videos
[2011/05/26 00:39:04 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Robert\Start Menu\Programs\Administrative Tools
[2011/05/26 00:38:54 | 000,606,738 | R--- | C] (Swearware) -- C:\Documents and Settings\Robert\Desktop\dds.scr
[2011/05/22 16:38:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert\Start Menu\Programs\Google Chrome
[2011/05/22 16:36:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert\Local Settings\Application Data\Deployment
[2011/05/17 18:03:55 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Robert\Recent
[2011/05/17 17:53:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/17 17:53:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/17 17:53:43 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/14 16:45:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Robert\Start Menu\Programs\Windows XP Recovery
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/28 22:03:23 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
[2011/05/28 22:01:27 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/28 22:01:03 | 000,000,882 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/28 22:00:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/28 22:00:49 | 794,972,160 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/28 06:14:03 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\MBR.dat
[2011/05/28 06:12:22 | 000,589,632 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Robert\Desktop\aswMBR.exe
[2011/05/28 06:06:55 | 000,025,560 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\Fresh rkunhooker Report
[2011/05/28 06:01:02 | 000,000,886 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/27 23:43:50 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/05/27 23:42:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2586179840-2599477267-1880732869-1006UA.job
[2011/05/27 23:37:02 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/05/27 23:31:31 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/05/27 23:28:16 | 004,296,381 | R--- | M] (Swearware) -- C:\Documents and Settings\Robert\Desktop\ComboFix.exe
[2011/05/27 22:48:36 | 000,027,000 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\Rootkit unhooker Report
[2011/05/27 20:59:57 | 000,002,293 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\Google Chrome.lnk
[2011/05/27 20:59:57 | 000,002,271 | ---- | M] () -- C:\Documents and Settings\Robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/05/27 05:55:04 | 001,007,108 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\rkill.com
[2011/05/27 05:53:42 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\RKUnhookerLE.EXE
[2011/05/26 00:37:16 | 000,606,738 | R--- | M] (Swearware) -- C:\Documents and Settings\Robert\Desktop\dds.scr
[2011/05/25 23:39:06 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/05/23 18:34:51 | 000,004,184 | -HS- | M] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2011/05/23 18:34:51 | 000,000,104 | RHS- | M] () -- C:\WINDOWS\System32\CC79A01303.sys
[2011/05/23 18:24:19 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malware Protection.lnk
[2011/05/23 18:00:00 | 000,000,446 | -H-- | M] () -- C:\WINDOWS\tasks\ParetoLogic Registration3.job
[2011/05/22 16:42:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2586179840-2599477267-1880732869-1006Core.job
[2011/05/20 17:03:55 | 026,719,645 | ---- | M] () -- C:\Documents and Settings\Robert\My Documents\SpyBot - Search & Destroy 1.6.2.46 Final.rar
[2011/05/18 23:02:51 | 000,000,780 | ---- | M] () -- C:\WINDOWS\orun32.ini
[2011/05/17 18:18:34 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/17 18:12:08 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\Robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/05/17 18:12:08 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/14 16:45:05 | 000,000,144 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~17424164r
[2011/05/14 16:45:05 | 000,000,128 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~17424164
[2011/05/14 16:44:55 | 000,000,344 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\17424164
[2011/05/10 08:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/05/10 08:10:55 | 000,199,304 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/05/10 08:03:54 | 000,441,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/05/10 08:03:44 | 000,307,928 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/05/10 08:02:37 | 000,049,240 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/05/10 08:02:25 | 000,102,616 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/05/10 08:02:22 | 000,096,344 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/05/10 07:59:56 | 000,025,432 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/05/10 07:59:37 | 000,030,808 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/05/10 07:59:35 | 000,019,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/28 06:14:03 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Robert\Desktop\MBR.dat
[2011/05/28 06:06:55 | 000,025,560 | ---- | C] () -- C:\Documents and Settings\Robert\Desktop\Fresh rkunhooker Report
[2011/05/27 23:43:50 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/05/27 23:31:31 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/05/27 23:31:28 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/05/27 23:28:54 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/05/27 23:28:54 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/05/27 23:28:54 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/05/27 23:28:54 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/05/27 23:28:54 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/05/27 22:48:36 | 000,027,000 | ---- | C] () -- C:\Documents and Settings\Robert\Desktop\Rootkit unhooker Report
[2011/05/27 06:01:22 | 001,007,108 | ---- | C] () -- C:\Documents and Settings\Robert\Desktop\rkill.com
[2011/05/27 06:00:40 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\Robert\Desktop\RKUnhookerLE.EXE
[2011/05/23 23:28:51 | 794,972,160 | -HS- | C] () -- C:\hiberfil.sys
[2011/05/23 18:24:19 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malware Protection.lnk
[2011/05/22 16:38:44 | 000,002,293 | ---- | C] () -- C:\Documents and Settings\Robert\Desktop\Google Chrome.lnk
[2011/05/22 16:38:44 | 000,002,271 | ---- | C] () -- C:\Documents and Settings\Robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/05/22 16:37:18 | 000,000,982 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2586179840-2599477267-1880732869-1006UA.job
[2011/05/22 16:37:17 | 000,000,930 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2586179840-2599477267-1880732869-1006Core.job
[2011/05/20 17:03:55 | 026,719,645 | ---- | C] () -- C:\Documents and Settings\Robert\My Documents\SpyBot - Search & Destroy 1.6.2.46 Final.rar
[2011/05/17 18:12:08 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\Robert\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/05/17 18:12:08 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/17 18:11:12 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/14 16:45:05 | 000,000,144 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~17424164r
[2011/05/14 16:45:04 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~17424164
[2011/05/14 16:44:55 | 000,000,344 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\17424164
[2011/01/22 21:14:47 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2010/09/25 01:12:34 | 000,000,087 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/09/23 21:47:39 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Wkisanuvazij.dat
[2010/09/23 21:47:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Klakivuf.bin
[2010/04/03 10:40:32 | 000,014,568 | -HS- | C] () -- C:\Documents and Settings\Robert\Local Settings\Application Data\XORQ
[2010/04/03 10:40:32 | 000,014,568 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\XORQ
[2010/01/22 21:18:14 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Robert\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/22 00:10:05 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\NetBT_Tcpip_{2810EB22-763D-4D0C-9450-64BBD1758685}.sys
[2010/01/21 23:25:33 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\JAVA.EXE.sys
[2008/10/04 22:54:51 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/12/14 19:07:48 | 000,004,184 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/12/14 19:07:48 | 000,000,104 | RHS- | C] () -- C:\WINDOWS\System32\CC79A01303.sys
[2006/04/16 20:48:20 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Robert\Application Data\PFP120JPR.{PB
[2006/04/16 20:48:20 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Robert\Application Data\PFP120JCM.{PB
[2006/01/31 17:42:40 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/01/31 17:33:19 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2006/01/31 17:25:50 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/01/31 17:00:26 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006/01/31 17:00:04 | 000,000,392 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 15:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 15:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/10 15:02:15 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 15:01:18 | 000,001,793 | -H-- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 14:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 14:57:15 | 000,189,792 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 14:51:21 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 14:51:20 | 000,442,466 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 14:51:20 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 14:51:20 | 000,071,732 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 14:51:20 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 14:51:18 | 000,004,627 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 14:51:17 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 14:51:16 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 14:51:12 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 14:51:11 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 14:51:05 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 14:50:56 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2011/05/27 23:43:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/09/21 10:47:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2011/05/01 18:58:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2008/02/28 18:11:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2006/01/31 17:27:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/11/24 11:03:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore
[2010/09/21 10:47:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\DriverCure
[2010/09/21 10:47:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\ParetoLogic
[2011/01/06 23:21:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\PCHC
[2007/02/03 10:32:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Robert\Application Data\Viewpoint
[2010/07/18 02:01:00 | 000,000,262 | -H-- | M] () -- C:\WINDOWS\Tasks\Disk Cleanup.job
[2011/05/23 18:00:00 | 000,000,446 | -H-- | M] () -- C:\WINDOWS\Tasks\ParetoLogic Registration3.job
[2010/09/21 10:47:07 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\ParetoLogic Update Version3.job
[2010/09/21 10:47:13 | 000,000,378 | -H-- | M] () -- C:\WINDOWS\Tasks\PC Health Advisor Defrag.job
[2010/09/21 10:47:12 | 000,000,360 | -H-- | M] () -- C:\WINDOWS\Tasks\PC Health Advisor.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/10/02 09:21:23 | 000,000,013 | ---- | M] () -- C:\alrt_200.data
[2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2011/05/25 23:39:06 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/05/27 23:31:31 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/05/27 23:39:21 | 000,008,198 | ---- | M] () -- C:\ComboFix.txt
[2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/01/31 17:07:18 | 000,005,138 | R--- | M] () -- C:\dell.sdr
[2011/05/28 22:00:49 | 794,972,160 | -HS- | M] () -- C:\hiberfil.sys
[2006/02/14 21:15:58 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\IO.SYS
[2006/01/31 17:27:14 | 000,000,829 | ---- | M] () -- C:\IPH.PH
[2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\MSDOS.SYS
[2008/12/11 17:09:21 | 000,000,951 | ---- | M] () -- C:\net_save.dna
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/07/29 07:19:59 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/05/28 22:00:48 | 390,070,272 | -HS- | M] () -- C:\pagefile.sys
[2011/05/22 17:11:00 | 000,000,408 | ---- | M] () -- C:\rkill.log
[2006/01/31 17:27:27 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
[2007/08/04 15:45:39 | 000,000,146 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 15:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 08:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 14:56:48 | 000,094,208 | -H-- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 14:56:46 | 000,634,880 | -H-- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 14:56:46 | 000,872,448 | -H-- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2011/05/28 06:12:22 | 000,589,632 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Robert\Desktop\aswMBR.exe
[2011/05/27 23:28:16 | 004,296,381 | R--- | M] (Swearware) -- C:\Documents and Settings\Robert\Desktop\ComboFix.exe
[2011/05/28 22:03:23 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert\Desktop\OTL.exe
[2011/05/27 05:53:42 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\Robert\Desktop\RKUnhookerLE.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 07:00:00 | 000,000,791 | -H-- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2006/02/13 20:03:39 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Robert\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/12/12 13:41:48 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Robert\Cookies\desktop.ini
[2011/05/28 22:15:01 | 000,114,688 | ---- | M] () -- C:\Documents and Settings\Robert\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 03:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 03:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 20:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 03:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 03:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 03:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 03:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 03:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0E799D7F

< End of report >

 

Extras Log

Extras Log

OTL Extras logfile created on: 5/28/2011 10:07:44 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Robert\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

758.07 Mb Total Physical Memory | 452.57 Mb Available Physical Memory | 59.70% Memory free
1.06 Gb Paging File | 0.85 Gb Available in Paging File | 79.75% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.36 Gb Total Space | 61.37 Gb Free Space | 86.01% Space Free | Partition Type: NTFS

Computer Name: DHQNPC91 | User Name: Robert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNetisabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNetisabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNetisabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNetisabledxpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English\setup.exe" = C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup -- (Kaspersky Lab)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = Qualxserve Service Agreement
"{14374619-0900-4056-BA06-C87C900AF9E6}" = QuickBooks Simple Start Special Edition
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers
"{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}" = ParetoLogic PC Health Advisor
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Google AFE
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE}" = EarthLink setup files
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel(R) PROSet for Wired Connections
"{85D3CC30-8859-481A-9654-FD9B74310BEF}" = Musicmatch® Jukebox
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{8A9B8148-DDD7-448F-BD6C-358386D32354}" = Corel Photo Album 6
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B702CCCE-3176-4DBF-B932-D1B8F402F330}" = Digital Content Portal
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ATT-RC" = ATT-RC Self Support Tool
"avast" = avast! Free Antivirus
"ComcastHSI" = Comcast High-Speed Internet Install Wizard
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel(R) PRO Network Connections Drivers
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer Basic
"StreetPlugin" = Learn2 Player (Uninstall Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2586179840-2599477267-1880732869-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/18/2011 10:19:05 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 2/18/2011 10:19:08 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 3/24/2011 7:53:17 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1002
Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/24/2011 7:53:21 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1001
Description = Fault bucket 1116954496.

Error - 5/1/2011 10:04:26 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1002
Description = Hanging application wpwin12.exe, version 12.0.0.389, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/1/2011 10:04:40 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1001
Description = Fault bucket 210449248.

Error - 5/1/2011 10:10:27 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1002
Description = Hanging application wpwin12.exe, version 12.0.0.389, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/1/2011 10:10:31 AM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1001
Description = Fault bucket 210449248.

Error - 5/27/2011 10:59:33 PM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1002
Description = Hanging application ComboFix.exe, version 11.5.26.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/27/2011 11:22:53 PM | Computer Name = DHQNPC91 | Source = Application Hang | ID = 1002
Description = Hanging application ComboFix.exe, version 11.5.26.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 5/23/2011 11:21:15 PM | Computer Name = DHQNPC91 | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
failed to start because of the following error: %%31

Error - 5/23/2011 11:21:15 PM | Computer Name = DHQNPC91 | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 5/23/2011 11:21:15 PM | Computer Name = DHQNPC91 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip

Error - 5/23/2011 11:24:18 PM | Computer Name = DHQNPC91 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 5/23/2011 11:24:31 PM | Computer Name = DHQNPC91 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 5/23/2011 11:25:00 PM | Computer Name = DHQNPC91 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 5/23/2011 11:27:05 PM | Computer Name = DHQNPC91 | Source = Service Control Manager | ID = 7031
Description = The DCOM Server Process Launcher service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.

Error - 5/25/2011 11:41:58 PM | Computer Name = DHQNPC91 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 5/27/2011 8:57:08 PM | Computer Name = DHQNPC91 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.251.199 for the Network Card with network
address 001320C3F420 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 5/28/2011 6:01:12 AM | Computer Name = DHQNPC91 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.


< End of report >

 

OTL Log

All processes killed
========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-21-2586179840-2599477267-1880732869-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
C:\Documents and Settings\Robert\Start Menu\Programs\Windows XP Recovery folder moved successfully.
C:\WINDOWS\002689_.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET38.tmp deleted successfully.
C:\WINDOWS\System32\SET3A.tmp deleted successfully.
C:\WINDOWS\System32\SET46.tmp deleted successfully.
C:\WINDOWS\System32\SET48.tmp deleted successfully.
C:\WINDOWS\System32\SET4E.tmp deleted successfully.
C:\WINDOWS\System32\SET4F.tmp deleted successfully.
C:\WINDOWS\System32\SET50.tmp deleted successfully.
C:\WINDOWS\System32\SET51.tmp deleted successfully.
C:\WINDOWS\System32\SET54.tmp deleted successfully.
C:\WINDOWS\System32\SET89.tmp deleted successfully.
C:\WINDOWS\System32\SET8B.tmp deleted successfully.
C:\WINDOWS\System32\SET8E.tmp deleted successfully.
C:\WINDOWS\system32\CC79A01303.sys moved successfully.
C:\Documents and Settings\All Users\Application Data\~17424164r moved successfully.
C:\Documents and Settings\All Users\Application Data\~17424164 moved successfully.
C:\Documents and Settings\All Users\Application Data\17424164 moved successfully.
C:\Documents and Settings\Robert\Local Settings\Application Data\XORQ moved successfully.
C:\Documents and Settings\All Users\Application Data\XORQ moved successfully.
C:\WINDOWS\system32\drivers\JAVA.EXE.sys moved successfully.
C:\Documents and Settings\All Users\Application Data\RegCure folder moved successfully.
C:\Documents and Settings\Robert\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\Robert\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\Robert\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\Robert\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\Robert\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\Robert\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\Robert\Application Data\Viewpoint folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:0E799D7F deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 3157599 bytes
->Temporary Internet Files folder emptied: 59084 bytes

User: Administrator.DHQNPC91
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 111826 bytes
->Flash cache emptied: 9734 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Owner
->Temp folder emptied: 0 bytes

User: Robert
->Temp folder emptied: 10722614 bytes
->Temporary Internet Files folder emptied: 17268481 bytes
->Java cache emptied: 63449937 bytes
->Google Chrome cache emptied: 6414704 bytes
->Flash cache emptied: 573769 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 70218376 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 164.00 mb


[EMPTYFLASH]

User: Administrator

User: Administrator.DHQNPC91

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner

User: Robert
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.23.0 log created on 06012011_061104

Files\Folders moved on Reboot...
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\YK18Q56J\00b42e3a-b809-49b2-b433-cc45b2bc89d33rd_party_BBS[1].htm moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\YK18Q56J\99117-active-redirects-fake-malware-program-system-restore-disabled[1].html moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\YK18Q56J\audmeasure[1].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\YK18Q56J\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\Y2VVOFJ7\audmeasure[1].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\Y2VVOFJ7\ddc[1].htm moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\Y2VVOFJ7\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\PL63CM99\B5199104[1].htm moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\F4T0LJFX\ads[2].htm moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\F4T0LJFX\audmeasure[1].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\F4T0LJFX\audmeasure[2].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\F4T0LJFX\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\F4T0LJFX\p-01-0VIaSjnOLg[2].gif moved successfully.
C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

 

Checkup.txt

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
Spybot - Search & Destroy
Java(TM) 6 Update 25
Java(TM) 6 Update 2
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player
Adobe Reader 7.1.0
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastUI.exe
``````````End of Log````````````

 

Online Scanner

The Online Scanner was still running when I left for work so I will load the results later this evening.

Robert

 

Removed Java 6 update 2
Updated Adobe Reader

Could not find Java 6 update 7 as an installed version in control panel "add or remove programs" (show updates) or in Java control panel.

ESET Online Scan Results

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0000522.sys Win32/Olmasco.E trojan
C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\36\4ba76d24-4c150951 a variant of Java/TrojanDownloader.OpenStream.NAO trojan

 

I left the computer on after I ran the ESET Scan you told me to run two posts ago. Virus protection was still disabled. The browser was left open on the ESET page and the windowsbbs page. When I got home from work a program called Pareto Logic PC Health Advisor was open on the screen indicating that it ran a scan of the computer. I closed the program, enabled virus protection and ran a Avast quick scan and then the boot scan. The boot scan was clean but I posted the results of the quick scan below.

I began to complete the steps in your last email up to step 6 and decided to stop an describe the following before proceeding.

1st OTL completed (log below)

1) 2nd OTL completed (log below)

2) OTL Cleanup completed

3) Windows Update not completed. Windows says I need to change the security settings by enabling Userdata persistence. I make this change but I still get the same message to make the change. Therefore, Windows has not been updated.

4) Completed

5) Completed

6) Malwarebytes would not run. Reinstalled it and ran a quick scan. Everything was clean.

 

Avast Log

C:\System Volume Information\...\A0000522.sys Threat: Win32:Alureon-PS

 

OTL Logs

First OTL Log

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\WINDOWS\system32\config\systemprofile\Application Data\Sun\Java\Deployment\cache\6.0\36\4ba76d24-4c150951 moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Administrator.DHQNPC91
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56466 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 0 bytes

User: Robert
->Temp folder emptied: 80332 bytes
->Temporary Internet Files folder emptied: 13894674 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 560 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 14.00 mb


[EMPTYFLASH]

User: Administrator

User: Administrator.DHQNPC91

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner

User: Robert
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.23.0 log created on 06032011_062307

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found!

Registry entries deleted on Reboot...



Second OTL Log

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Administrator.DHQNPC91
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Owner
->Temp folder emptied: 0 bytes

User: Robert
->Temp folder emptied: 679 bytes
->Temporary Internet Files folder emptied: 2028048 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 560 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 2.00 mb


[EMPTYFLASH]

User: Administrator

User: Administrator.DHQNPC91

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner

User: Robert
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.23.0 log created on 06032011_062756

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...