TechSpot

About to throw computer out window. Trojan problem I believe

By tcb
Apr 3, 2012
  1. Hello.

    Last Thursday I was infected with what Symantec called a Trojan.Gen.2. Since that time my computer has been slow and crashing.

    I have run symantec and Avast and Malawarebytesa among others but they are all coming up clean.

    MBAM keeps blocking ingoing and outgoing IP's of malicious sites.

    Neither GMER or DDS will run properly. DDS doesn't complete within 3 minutes and GMER options are greyed out.

    Please help.
     
  2. tcb

    tcb TS Rookie Topic Starter Posts: 25

    MBAM logs

    Malwarebytes Anti-Malware (Trial) 1.60.1.1000
    www.malwarebytes.org

    Database version: v2012.04.03.05

    Windows XP Service Pack 3 x86 NTFS (Safe Mode)
    Internet Explorer 8.0.6001.18702
    Staff :: BRIAN7 [administrator]

    Protection: Disabled

    03/04/2012 11:10:33 AM
    mbam-log-2012-04-03 (11-10-33).txt

    Scan type: Flash scan
    Scan options enabled: Memory | Startup | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: Registry | File System | P2P
    Objects scanned: 175130
    Time elapsed: 31 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)

    2012/04/03 00:05:35 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:05:39 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:05:45 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:05:57 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:06:00 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:06:06 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:07:28 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:07:31 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:07:37 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:07:49 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:07:52 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:07:58 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:09:39 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:09:42 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:09:48 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:10:00 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:10:03 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:10:09 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:16:42 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:16:45 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:16:51 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:17:04 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:17:06 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:17:12 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:18:44 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:18:47 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:18:53 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:19:05 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:19:09 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:19:15 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:20:43 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:20:46 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:20:52 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:21:05 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:21:08 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:21:14 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:27:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:27:59 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:28:05 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:28:17 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:28:20 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:28:26 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:29:52 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:29:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:30:01 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:30:13 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:30:16 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:30:22 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 00:38:58 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:39:01 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:39:07 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:39:19 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:39:23 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:39:29 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:40:49 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:40:52 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:40:58 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:41:10 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:41:13 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:41:19 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:42:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:42:58 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:43:04 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:43:16 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:43:19 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:43:25 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:50:04 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:50:08 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:50:14 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:50:26 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:50:29 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:50:35 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 00:51:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:51:59 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:52:05 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:52:17 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:52:20 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:52:26 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 00:53:59 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:54:02 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:54:08 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:54:20 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:54:23 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 00:54:29 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:01:03 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:01:06 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:01:12 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:01:25 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:01:28 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:01:34 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:05:14 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:05:17 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:05:23 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:05:35 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:05:38 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:05:44 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 01:25:45 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 01:25:48 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 01:25:54 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 01:26:06 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 01:26:09 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 01:26:15 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 02:35:36 -0700 BRIAN7 Staff MESSAGE Executing scheduled update: Daily | Silent
    2012/04/03 02:35:50 -0700 BRIAN7 Staff MESSAGE Starting database refresh
    2012/04/03 02:35:50 -0700 BRIAN7 Staff MESSAGE Scheduled update executed successfully: database updated from version v2012.04.02.03 to version v2012.04.03.05
    2012/04/03 02:35:50 -0700 BRIAN7 Staff MESSAGE Stopping IP protection
    2012/04/03 02:35:50 -0700 BRIAN7 Staff MESSAGE IP Protection stopped
    2012/04/03 02:35:55 -0700 BRIAN7 Staff MESSAGE Database refreshed successfully
    2012/04/03 02:35:55 -0700 BRIAN7 Staff MESSAGE Starting IP protection
    2012/04/03 02:35:57 -0700 BRIAN7 Staff MESSAGE IP Protection started successfully
    2012/04/03 04:30:00 -0700 BRIAN7 Staff MESSAGE Executing scheduled scan: Full Scan | Daily | -remove
    2012/04/03 04:30:00 -0700 BRIAN7 Staff MESSAGE Scheduled scan executed successfully
    2012/04/03 08:28:52 -0700 BRIAN7 Staff MESSAGE Starting protection
    2012/04/03 08:29:04 -0700 BRIAN7 Staff MESSAGE Protection started successfully
    2012/04/03 08:29:07 -0700 BRIAN7 Staff MESSAGE Starting IP protection
    2012/04/03 08:29:15 -0700 BRIAN7 Staff MESSAGE IP Protection started successfully
    2012/04/03 08:29:15 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: incoming)
    2012/04/03 08:29:18 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 08:29:18 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: incoming)
    2012/04/03 08:29:24 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 08:29:24 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: incoming)
    2012/04/03 08:29:36 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 08:29:36 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: incoming)
    2012/04/03 08:29:39 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 08:29:45 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 08:29:52 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 08:29:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 08:30:00 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: incoming)
    2012/04/03 08:30:01 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 08:30:13 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 08:30:16 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 08:30:22 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 08:30:49 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: incoming)
    2012/04/03 08:33:29 -0700 BRIAN7 Staff IP-BLOCK 208.73.210.29 (Type: outgoing)
    2012/04/03 08:33:32 -0700 BRIAN7 Staff IP-BLOCK 208.73.210.29 (Type: outgoing)
    2012/04/03 08:33:38 -0700 BRIAN7 Staff IP-BLOCK 208.73.210.29 (Type: outgoing)
    2012/04/03 08:33:41 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 08:33:44 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 08:33:50 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 08:33:53 -0700 BRIAN7 Staff IP-BLOCK 208.73.210.29 (Type: outgoing)
    2012/04/03 08:33:59 -0700 BRIAN7 Staff IP-BLOCK 208.73.210.29 (Type: outgoing)
    2012/04/03 08:34:03 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 08:34:06 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 08:34:12 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 08:40:52 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:40:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:41:01 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:41:13 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:41:16 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:41:22 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:42:35 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:42:38 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:42:44 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:42:57 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:43:00 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:43:06 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:44:44 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:44:47 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:44:53 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:45:05 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:45:08 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:45:14 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 08:51:46 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:51:49 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:51:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:52:07 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:52:10 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 08:52:16 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 09:00:40 -0700 BRIAN7 Staff MESSAGE Starting protection
    2012/04/03 09:00:53 -0700 BRIAN7 Staff MESSAGE Protection started successfully
    2012/04/03 09:00:56 -0700 BRIAN7 Staff MESSAGE Starting IP protection
    2012/04/03 09:00:58 -0700 BRIAN7 Staff MESSAGE IP Protection started successfully
    2012/04/03 10:01:57 -0700 BRIAN7 Staff MESSAGE Starting protection
    2012/04/03 10:02:10 -0700 BRIAN7 Staff MESSAGE Protection started successfully
    2012/04/03 10:02:13 -0700 BRIAN7 Staff MESSAGE Starting IP protection
    2012/04/03 10:02:15 -0700 BRIAN7 Staff MESSAGE IP Protection started successfully
    2012/04/03 10:02:15 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 10:02:18 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 10:02:24 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 10:02:36 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 10:02:39 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 10:02:46 -0700 BRIAN7 Staff IP-BLOCK 217.23.9.196 (Type: outgoing)
    2012/04/03 10:04:28 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 10:04:31 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 10:04:37 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 10:04:49 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 10:04:53 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 10:04:59 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 11:14:06 -0700 BRIAN7 Staff MESSAGE Starting protection
    2012/04/03 11:14:23 -0700 BRIAN7 Staff MESSAGE Protection started successfully
    2012/04/03 11:14:26 -0700 BRIAN7 Staff MESSAGE Starting IP protection
    2012/04/03 11:14:47 -0700 BRIAN7 Staff MESSAGE IP Protection started successfully
    2012/04/03 11:18:40 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:18:43 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:18:49 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:19:01 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:19:04 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:19:10 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:29:43 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:29:46 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:29:52 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:30:04 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:30:07 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:30:13 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:38:48 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 11:38:51 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 11:38:57 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 11:39:09 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 11:39:12 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 11:39:18 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.5 (Type: outgoing)
    2012/04/03 11:47:58 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:48:01 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:48:07 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:48:19 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:48:23 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:48:29 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:49:45 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:49:48 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:49:54 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:50:07 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:50:10 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:50:16 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:52:00 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:52:03 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:52:09 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:52:21 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:52:24 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:52:31 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.3 (Type: outgoing)
    2012/04/03 11:58:55 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:58:58 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:59:04 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:59:16 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:59:19 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 11:59:25 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.2 (Type: outgoing)
    2012/04/03 12:01:03 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:01:06 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:01:12 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:01:24 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:01:27 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:01:33 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:14:11 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:14:14 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:14:20 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:14:32 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:14:35 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
    2012/04/03 12:14:41 -0700 BRIAN7 Staff IP-BLOCK 206.161.121.4 (Type: outgoing)
     
  3. tcb

    tcb TS Rookie Topic Starter Posts: 25

    I should also mention this computer is running currenty updated XP SP3.
     
  4. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  5. tcb

    tcb TS Rookie Topic Starter Posts: 25

    Step 1 - Avast and Symantec find nothing.
    Step 2 - Malwarebytes' Anti-Malware logs attached above
    Step 3 - GMER runs but doesnt produce a log and has greyed out majority of check boxes
    Step 4 - DDS doesnt run


    Thanks so much for helping.
     
  6. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    ==============================================================

    Download Bootkit Remover to your desktop.

    • Unzip downloaded file to your Desktop.
    • Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
     
  7. tcb

    tcb TS Rookie Topic Starter Posts: 25

    aswMBR does not run

    Bootkit remover

    Bootkit Remover
    (c) 2009 Esage Lab
    www.esagelab.com

    Program version: 1.2.0.1
    OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000

    Size Device Name MBR Status
    --------------------------------------------
    232 GB \\.\PhysicalDrive0 Controlled by rootkit!

    Boot code on some of your physical disks is hidden by a rootkit.
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]


    Done;
    Press any key to quit...
     
  8. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  9. tcb

    tcb TS Rookie Topic Starter Posts: 25

    TDSSKiller report

    15:40:15.0656 4860 TDSS rootkit removing tool 2.7.25.0 Apr 3 2012 13:42:32
    15:40:16.0140 4860 ============================================================
    15:40:16.0140 4860 Current date / time: 2012/04/03 15:40:16.0140
    15:40:16.0140 4860 SystemInfo:
    15:40:16.0140 4860
    15:40:16.0140 4860 OS Version: 5.1.2600 ServicePack: 3.0
    15:40:16.0140 4860 Product type: Workstation
    15:40:16.0140 4860 ComputerName: BRIAN7
    15:40:16.0140 4860 UserName: Staff
    15:40:16.0140 4860 Windows directory: C:\WINDOWS
    15:40:16.0140 4860 System windows directory: C:\WINDOWS
    15:40:16.0140 4860 Processor architecture: Intel x86
    15:40:16.0140 4860 Number of processors: 2
    15:40:16.0140 4860 Page size: 0x1000
    15:40:16.0140 4860 Boot type: Normal boot
    15:40:16.0140 4860 ============================================================
    15:40:16.0562 4860 Drive \Device\Harddisk0\DR0 - Size: 0x3A35294400 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76BA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
    15:40:16.0562 4860 \Device\Harddisk0\DR0:
    15:40:16.0562 4860 MBR used
    15:40:16.0562 4860 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1F608, BlocksNum 0x1D185971
    15:40:16.0593 4860 Initialize success
    15:40:16.0593 4860 ============================================================
    15:40:21.0406 4260 ============================================================
    15:40:21.0406 4260 Scan started
    15:40:21.0406 4260 Mode: Manual;
    15:40:21.0406 4260 ============================================================
    15:40:21.0765 4260 !SASCORE (c0393eb99a6c72c6bef9bfc4a72b33a6) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
    15:40:21.0796 4260 !SASCORE - ok
    15:40:21.0968 4260 Aavmker4 (473f97edc5a5312f3665ab2921196c0c) C:\WINDOWS\system32\drivers\Aavmker4.sys
    15:40:21.0968 4260 Aavmker4 - ok
    15:40:22.0000 4260 Abiosdsk - ok
    15:40:22.0031 4260 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
    15:40:22.0031 4260 abp480n5 - ok
    15:40:22.0093 4260 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    15:40:22.0109 4260 ACPI - ok
    15:40:22.0140 4260 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    15:40:22.0140 4260 ACPIEC - ok
    15:40:22.0218 4260 ADIHdAudAddService (de25fc7de3a464e455c0d0012757b0ac) C:\WINDOWS\system32\drivers\ADIHdAud.sys
    15:40:22.0218 4260 ADIHdAudAddService - ok
    15:40:22.0281 4260 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
    15:40:22.0281 4260 adpu160m - ok
    15:40:22.0328 4260 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    15:40:22.0328 4260 aec - ok
    15:40:22.0359 4260 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
    15:40:22.0375 4260 AFD - ok
    15:40:22.0390 4260 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
    15:40:22.0390 4260 agp440 - ok
    15:40:22.0406 4260 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
    15:40:22.0421 4260 agpCPQ - ok
    15:40:22.0437 4260 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
    15:40:22.0437 4260 Aha154x - ok
    15:40:22.0468 4260 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
    15:40:22.0468 4260 aic78u2 - ok
    15:40:22.0500 4260 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
    15:40:22.0500 4260 aic78xx - ok
    15:40:22.0531 4260 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll
    15:40:22.0531 4260 Alerter - ok
    15:40:22.0546 4260 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe
    15:40:22.0546 4260 ALG - ok
    15:40:22.0578 4260 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
    15:40:22.0578 4260 AliIde - ok
    15:40:22.0609 4260 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
    15:40:22.0609 4260 alim1541 - ok
    15:40:22.0625 4260 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
    15:40:22.0625 4260 amdagp - ok
    15:40:22.0640 4260 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
    15:40:22.0640 4260 amsint - ok
    15:40:22.0718 4260 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    15:40:22.0718 4260 Apple Mobile Device - ok
    15:40:22.0781 4260 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll
    15:40:22.0781 4260 AppMgmt - ok
    15:40:22.0828 4260 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
    15:40:22.0828 4260 asc - ok
    15:40:22.0875 4260 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
    15:40:22.0875 4260 asc3350p - ok
    15:40:22.0890 4260 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
    15:40:22.0890 4260 asc3550 - ok
    15:40:22.0953 4260 ASFIPmon (6295dd28d0ecbc4e6e450c279fef5ed9) C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    15:40:22.0953 4260 ASFIPmon - ok
    15:40:23.0062 4260 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
    15:40:23.0062 4260 aspnet_state - ok
    15:40:23.0125 4260 aswFsBlk (0ae43c6c411254049279c2ee55630f95) C:\WINDOWS\system32\drivers\aswFsBlk.sys
    15:40:23.0125 4260 aswFsBlk - ok
    15:40:23.0140 4260 aswMon2 (8c30b7ddd2f1d8d138ebe40345af2b11) C:\WINDOWS\system32\drivers\aswMon2.sys
    15:40:23.0140 4260 aswMon2 - ok
    15:40:23.0156 4260 aswRdr (da12626fd9a67f4e917e2f2fbe1e1764) C:\WINDOWS\system32\drivers\aswRdr.sys
    15:40:23.0171 4260 aswRdr - ok
    15:40:23.0187 4260 aswSnx (dcb199b967375753b5019ec15f008f53) C:\WINDOWS\system32\drivers\aswSnx.sys
    15:40:23.0203 4260 aswSnx - ok
    15:40:23.0234 4260 aswSP (b32873e5a1443c0a1e322266e203bf10) C:\WINDOWS\system32\drivers\aswSP.sys
    15:40:23.0234 4260 aswSP - ok
    15:40:23.0250 4260 aswTdi (6ff544175a9180c5d88534d3d9c9a9f7) C:\WINDOWS\system32\drivers\aswTdi.sys
    15:40:23.0250 4260 aswTdi - ok
    15:40:23.0296 4260 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    15:40:23.0296 4260 AsyncMac - ok
    15:40:23.0328 4260 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    15:40:23.0328 4260 atapi - ok
    15:40:23.0343 4260 Atdisk - ok
    15:40:23.0359 4260 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    15:40:23.0375 4260 Atmarpc - ok
    15:40:23.0406 4260 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll
    15:40:23.0406 4260 AudioSrv - ok
    15:40:23.0421 4260 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    15:40:23.0421 4260 audstub - ok
    15:40:23.0531 4260 Autodesk Licensing Service (9f29157695ee58875b06724743ce9c42) C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    15:40:23.0531 4260 Autodesk Licensing Service - ok
    15:40:23.0609 4260 avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    15:40:23.0609 4260 avast! Antivirus - ok
    15:40:23.0718 4260 b57w2k (d0692f7b8217e3b82d2bfac535816117) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
    15:40:23.0734 4260 b57w2k - ok
    15:40:23.0781 4260 BASFND (5c68ac6f3e5b3e6d6a78e97d05e42c3a) C:\Program Files\Broadcom\ASFIPMon\BASFND.sys
    15:40:23.0781 4260 BASFND - ok
    15:40:23.0859 4260 BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    15:40:23.0859 4260 BcmSqlStartupSvc - ok
    15:40:23.0937 4260 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    15:40:23.0937 4260 Beep - ok
    15:40:23.0984 4260 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll
    15:40:24.0000 4260 BITS - ok
    15:40:24.0062 4260 Bonjour Service - ok
    15:40:24.0109 4260 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll
    15:40:24.0109 4260 Browser - ok
    15:40:24.0140 4260 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
    15:40:24.0140 4260 cbidf - ok
    15:40:24.0156 4260 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    15:40:24.0156 4260 cbidf2k - ok
    15:40:24.0187 4260 CBUSB (e6de3f6a87eaafc3f5c3cc2618d8e5e6) C:\WINDOWS\system32\drivers\CBUSB.sys
    15:40:24.0187 4260 CBUSB - ok
    15:40:24.0265 4260 ccEvtMgr (8b2db91dfcd1d0418ca0ec890c059219) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    15:40:24.0265 4260 ccEvtMgr - ok
    15:40:24.0265 4260 ccSetMgr (8b2db91dfcd1d0418ca0ec890c059219) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    15:40:24.0265 4260 ccSetMgr - ok
    15:40:24.0671 4260 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
    15:40:24.0671 4260 cd20xrnt - ok
    15:40:24.0703 4260 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    15:40:24.0703 4260 Cdaudio - ok
    15:40:24.0750 4260 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    15:40:24.0750 4260 Cdfs - ok
    15:40:24.0765 4260 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    15:40:24.0765 4260 Cdrom - ok
    15:40:24.0765 4260 Changer - ok
    15:40:24.0812 4260 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe
    15:40:24.0812 4260 CiSvc - ok
    15:40:24.0828 4260 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe
    15:40:24.0843 4260 ClipSrv - ok
    15:40:24.0906 4260 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    15:40:24.0906 4260 clr_optimization_v2.0.50727_32 - ok
    15:40:25.0031 4260 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
    15:40:25.0031 4260 CmdIde - ok
    15:40:25.0078 4260 COH_Mon (86a22dff16e8ca67601044efe6825537) C:\WINDOWS\system32\Drivers\COH_Mon.sys
    15:40:25.0078 4260 COH_Mon - ok
    15:40:25.0109 4260 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
    15:40:25.0109 4260 Compbatt - ok
    15:40:25.0125 4260 COMSysApp - ok
    15:40:25.0156 4260 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
    15:40:25.0156 4260 Cpqarray - ok
    15:40:25.0187 4260 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll
    15:40:25.0187 4260 CryptSvc - ok
    15:40:25.0218 4260 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
    15:40:25.0218 4260 dac2w2k - ok
    15:40:25.0234 4260 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
    15:40:25.0234 4260 dac960nt - ok
    15:40:25.0281 4260 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
    15:40:25.0296 4260 DcomLaunch - ok
    15:40:25.0328 4260 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll
    15:40:25.0328 4260 Dhcp - ok
    15:40:25.0343 4260 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    15:40:25.0343 4260 Disk - ok
    15:40:25.0359 4260 dmadmin - ok
    15:40:25.0406 4260 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    15:40:25.0437 4260 dmboot - ok
    15:40:25.0453 4260 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
    15:40:25.0468 4260 dmio - ok
    15:40:25.0468 4260 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    15:40:25.0468 4260 dmload - ok
    15:40:25.0515 4260 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll
    15:40:25.0515 4260 dmserver - ok
    15:40:25.0531 4260 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    15:40:25.0531 4260 DMusic - ok
    15:40:25.0578 4260 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll
    15:40:25.0578 4260 Dnscache - ok
    15:40:25.0625 4260 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll
    15:40:25.0625 4260 Dot3svc - ok
    15:40:25.0656 4260 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
    15:40:25.0656 4260 dpti2o - ok
    15:40:25.0687 4260 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    15:40:25.0687 4260 drmkaud - ok
    15:40:25.0718 4260 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
    15:40:25.0718 4260 E100B - ok
    15:40:25.0765 4260 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll
    15:40:25.0765 4260 EapHost - ok
    15:40:25.0843 4260 eeCtrl (579a6b6135d32b857faf0e3a974535d8) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
    15:40:25.0843 4260 eeCtrl - ok
    15:40:25.0890 4260 EraserUtilRebootDrv (028d50f059bd0d2ccb209e9011b9a9a4) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
    15:40:25.0890 4260 EraserUtilRebootDrv - ok
    15:40:25.0968 4260 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll
    15:40:25.0968 4260 ERSvc - ok
    15:40:26.0015 4260 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
    15:40:26.0015 4260 Eventlog - ok
    15:40:26.0078 4260 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll
    15:40:26.0078 4260 EventSystem - ok
    15:40:26.0156 4260 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    15:40:26.0156 4260 Fastfat - ok
    15:40:26.0187 4260 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
    15:40:26.0203 4260 FastUserSwitchingCompatibility - ok
    15:40:26.0234 4260 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe
    15:40:26.0250 4260 Fax - ok
    15:40:26.0265 4260 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    15:40:26.0265 4260 Fdc - ok
    15:40:26.0296 4260 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    15:40:26.0296 4260 Fips - ok
    15:40:26.0375 4260 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    15:40:26.0390 4260 FLEXnet Licensing Service - ok
    15:40:26.0515 4260 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    15:40:26.0531 4260 Flpydisk - ok
    15:40:26.0578 4260 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    15:40:26.0578 4260 FltMgr - ok
    15:40:26.0687 4260 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    15:40:26.0687 4260 FontCache3.0.0.0 - ok
    15:40:26.0703 4260 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    15:40:26.0703 4260 Fs_Rec - ok
    15:40:26.0750 4260 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    15:40:26.0750 4260 Ftdisk - ok
    15:40:26.0781 4260 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
    15:40:26.0781 4260 GEARAspiWDM - ok
    15:40:26.0828 4260 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    15:40:26.0828 4260 Gpc - ok
    15:40:26.0937 4260 gupdate1c99b94d903291d (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
    15:40:26.0937 4260 gupdate1c99b94d903291d - ok
    15:40:26.0937 4260 gupdatem (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
    15:40:26.0937 4260 gupdatem - ok
    15:40:26.0984 4260 gusvc (35f4e20b8659434e3e27f501e2dde0fe) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    15:40:26.0984 4260 gusvc - ok
    15:40:27.0093 4260 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    15:40:27.0093 4260 HDAudBus - ok
    15:40:27.0140 4260 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
    15:40:27.0140 4260 helpsvc - ok
    15:40:27.0187 4260 HidBatt (748031ff4fe45ccc47546294905feab8) C:\WINDOWS\system32\DRIVERS\HidBatt.sys
    15:40:27.0187 4260 HidBatt - ok
    15:40:27.0234 4260 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll
    15:40:27.0234 4260 HidServ - ok
    15:40:27.0250 4260 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    15:40:27.0250 4260 HidUsb - ok
    15:40:27.0281 4260 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll
    15:40:27.0296 4260 hkmsvc - ok
    15:40:27.0343 4260 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
    15:40:27.0343 4260 hpn - ok
    15:40:27.0390 4260 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    15:40:27.0406 4260 HTTP - ok
    15:40:27.0421 4260 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll
    15:40:27.0421 4260 HTTPFilter - ok
    15:40:27.0453 4260 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
    15:40:27.0453 4260 i2omgmt - ok
    15:40:27.0484 4260 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
    15:40:27.0484 4260 i2omp - ok
    15:40:27.0515 4260 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    15:40:27.0515 4260 i8042prt - ok
    15:40:27.0593 4260 IAANTMON (72b53e9c8924949dec8f3799bcba2251) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    15:40:27.0593 4260 IAANTMON - ok
    15:40:27.0734 4260 iaStor (e5a0034847537eaee3c00349d5c34c5f) C:\WINDOWS\system32\drivers\iaStor.sys
    15:40:27.0734 4260 iaStor - ok
    15:40:27.0843 4260 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    15:40:27.0875 4260 idsvc - ok
    15:40:27.0953 4260 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    15:40:27.0953 4260 Imapi - ok
    15:40:27.0984 4260 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe
    15:40:28.0000 4260 ImapiService - ok
    15:40:28.0015 4260 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
    15:40:28.0031 4260 ini910u - ok
    15:40:28.0046 4260 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
    15:40:28.0046 4260 IntelIde - ok
    15:40:28.0078 4260 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    15:40:28.0078 4260 intelppm - ok
    15:40:28.0109 4260 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    15:40:28.0109 4260 Ip6Fw - ok
    15:40:28.0125 4260 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    15:40:28.0125 4260 IpFilterDriver - ok
    15:40:28.0156 4260 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    15:40:28.0156 4260 IpInIp - ok
    15:40:28.0171 4260 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    15:40:28.0171 4260 IpNat - ok
    15:40:28.0250 4260 iPod Service (ce004777b92dea56fe14ec900d20baa4) C:\Program Files\iPod\bin\iPodService.exe
    15:40:28.0265 4260 iPod Service - ok
    15:40:28.0375 4260 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    15:40:28.0375 4260 IPSec - ok
    15:40:28.0390 4260 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    15:40:28.0390 4260 IRENUM - ok
    15:40:28.0421 4260 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    15:40:28.0421 4260 isapnp - ok
    15:40:28.0515 4260 JavaQuickStarterService (5e06a9d23727daf96faa796f1135fdcd) C:\Program Files\Java\jre6\bin\jqs.exe
    15:40:28.0515 4260 JavaQuickStarterService - ok
    15:40:28.0703 4260 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    15:40:28.0703 4260 Kbdclass - ok
    15:40:28.0718 4260 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    15:40:28.0718 4260 kbdhid - ok
    15:40:28.0734 4260 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    15:40:28.0734 4260 kmixer - ok
    15:40:28.0765 4260 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    15:40:28.0781 4260 KSecDD - ok
    15:40:28.0812 4260 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll
    15:40:28.0828 4260 lanmanserver - ok
    15:40:28.0859 4260 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll
    15:40:28.0875 4260 lanmanworkstation - ok
    15:40:28.0875 4260 Lbd - ok
    15:40:28.0875 4260 lbrtfdc - ok
    15:40:29.0078 4260 LiveUpdate (8098bb044fa73ff8f9eb3ac5128d3b11) C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    15:40:29.0171 4260 LiveUpdate - ok
    15:40:29.0250 4260 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll
    15:40:29.0250 4260 LmHosts - ok
    15:40:29.0296 4260 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
    15:40:29.0296 4260 MBAMProtector - ok
    15:40:29.0359 4260 MBAMService (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    15:40:29.0359 4260 MBAMService - ok
    15:40:29.0437 4260 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll
    15:40:29.0437 4260 Messenger - ok
    15:40:29.0515 4260 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    15:40:29.0515 4260 mnmdd - ok
    15:40:29.0546 4260 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe
    15:40:29.0546 4260 mnmsrvc - ok
    15:40:29.0562 4260 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    15:40:29.0562 4260 Modem - ok
    15:40:29.0609 4260 motccgp (201bfc4ef8b33d02d133fbf6535e515b) C:\WINDOWS\system32\DRIVERS\motccgp.sys
    15:40:29.0609 4260 motccgp - ok
    15:40:29.0625 4260 motccgpfl (d0242a3832eb7c97801bb25889561e23) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
    15:40:29.0625 4260 motccgpfl - ok
    15:40:29.0671 4260 motmodem (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motmodem.sys
    15:40:29.0671 4260 motmodem - ok
    15:40:29.0718 4260 motport (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motport.sys
    15:40:29.0718 4260 motport - ok
    15:40:29.0765 4260 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    15:40:29.0765 4260 Mouclass - ok
    15:40:29.0796 4260 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    15:40:29.0812 4260 mouhid - ok
    15:40:29.0812 4260 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    15:40:29.0812 4260 MountMgr - ok
    15:40:29.0859 4260 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
    15:40:29.0859 4260 mraid35x - ok
    15:40:29.0859 4260 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    15:40:29.0875 4260 MRxDAV - ok
    15:40:29.0890 4260 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    15:40:29.0890 4260 MRxSmb - ok
    15:40:29.0921 4260 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe
    15:40:29.0921 4260 MSDTC - ok
    15:40:29.0968 4260 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    15:40:29.0968 4260 Msfs - ok
    15:40:29.0968 4260 MSIServer - ok
    15:40:29.0984 4260 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    15:40:30.0000 4260 MSKSSRV - ok
    15:40:30.0000 4260 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    15:40:30.0000 4260 MSPCLOCK - ok
    15:40:30.0015 4260 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    15:40:30.0015 4260 MSPQM - ok
    15:40:30.0062 4260 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    15:40:30.0062 4260 mssmbios - ok
    15:40:30.0156 4260 MSSQL$MSSMLBIZ - ok
    15:40:30.0218 4260 MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
    15:40:30.0218 4260 MSSQLServerADHelper - ok
    15:40:30.0328 4260 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
    15:40:30.0328 4260 Mup - ok
    15:40:30.0375 4260 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll
    15:40:30.0375 4260 napagent - ok
    15:40:30.0484 4260 NAVENG (862f55824ac81295837b0ab63f91071f) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20120402.002\NAVENG.SYS
    15:40:30.0484 4260 NAVENG - ok
    15:40:30.0546 4260 NAVEX15 (529d571b551cb9da44237389b936f1ae) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20120402.002\NAVEX15.SYS
    15:40:30.0593 4260 NAVEX15 - ok
    15:40:30.0718 4260 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    15:40:30.0718 4260 NDIS - ok
    15:40:30.0765 4260 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    15:40:30.0765 4260 NdisTapi - ok
    15:40:30.0796 4260 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    15:40:30.0796 4260 Ndisuio - ok
    15:40:30.0812 4260 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    15:40:30.0812 4260 NdisWan - ok
    15:40:30.0859 4260 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
    15:40:30.0859 4260 NDProxy - ok
    15:40:30.0875 4260 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    15:40:30.0875 4260 NetBIOS - ok
    15:40:30.0890 4260 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    15:40:30.0890 4260 NetBT - ok
    15:40:30.0937 4260 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
    15:40:30.0937 4260 NetDDE - ok
    15:40:30.0937 4260 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
    15:40:30.0937 4260 NetDDEdsdm - ok
    15:40:30.0984 4260 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
    15:40:30.0984 4260 Netlogon - ok
    15:40:31.0000 4260 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll
    15:40:31.0000 4260 Netman - ok
    15:40:31.0078 4260 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
    15:40:31.0078 4260 NetTcpPortSharing - ok
    15:40:31.0125 4260 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll
    15:40:31.0125 4260 Nla - ok
    15:40:31.0187 4260 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    15:40:31.0187 4260 Npfs - ok
    15:40:31.0203 4260 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    15:40:31.0203 4260 Ntfs - ok
    15:40:31.0250 4260 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
    15:40:31.0250 4260 NtLmSsp - ok
    15:40:31.0281 4260 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll
    15:40:31.0296 4260 NtmsSvc - ok
    15:40:31.0312 4260 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    15:40:31.0312 4260 Null - ok
    15:40:31.0500 4260 nv (11d00ba58270a128354f3ea2262587cc) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    15:40:31.0640 4260 nv - ok
    15:40:31.0687 4260 NVSvc (6a5560227f7a7597829c8073b5dc704e) C:\WINDOWS\system32\nvsvc32.exe
    15:40:31.0687 4260 NVSvc - ok
    15:40:31.0718 4260 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    15:40:31.0718 4260 NwlnkFlt - ok
    15:40:31.0734 4260 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    15:40:31.0734 4260 NwlnkFwd - ok
    15:40:31.0890 4260 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
    15:40:31.0890 4260 odserv - ok
    15:40:31.0921 4260 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    15:40:31.0921 4260 ose - ok
    15:40:32.0046 4260 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
    15:40:32.0046 4260 Parport - ok
    15:40:32.0062 4260 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    15:40:32.0062 4260 PartMgr - ok
    15:40:32.0109 4260 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    15:40:32.0109 4260 ParVdm - ok
    15:40:32.0109 4260 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    15:40:32.0109 4260 PCI - ok
    15:40:32.0125 4260 PCIDump - ok
    15:40:32.0140 4260 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    15:40:32.0140 4260 PCIIde - ok
    15:40:32.0156 4260 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
    15:40:32.0156 4260 Pcmcia - ok
    15:40:32.0156 4260 PDCOMP - ok
    15:40:32.0171 4260 PDFRAME - ok
    15:40:32.0171 4260 PDRELI - ok
    15:40:32.0187 4260 PDRFRAME - ok
    15:40:32.0203 4260 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
    15:40:32.0203 4260 perc2 - ok
    15:40:32.0234 4260 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
    15:40:32.0234 4260 perc2hib - ok
    15:40:32.0281 4260 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
    15:40:32.0296 4260 PlugPlay - ok
    15:40:32.0328 4260 Pml Driver HPZ12 (b489e534d30f95c6240c7fb6c9bf9ec5) C:\WINDOWS\system32\HPZipm12.exe
    15:40:32.0328 4260 Pml Driver HPZ12 - ok
    15:40:32.0375 4260 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
    15:40:32.0375 4260 PolicyAgent - ok
    15:40:32.0406 4260 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    15:40:32.0406 4260 PptpMiniport - ok
    15:40:32.0421 4260 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
    15:40:32.0421 4260 ProtectedStorage - ok
    15:40:32.0421 4260 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    15:40:32.0421 4260 PSched - ok
    15:40:32.0437 4260 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    15:40:32.0437 4260 Ptilink - ok
    15:40:32.0484 4260 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    15:40:32.0484 4260 PxHelp20 - ok
    15:40:32.0500 4260 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
    15:40:32.0500 4260 ql1080 - ok
    15:40:32.0531 4260 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
    15:40:32.0531 4260 Ql10wnt - ok
    15:40:32.0546 4260 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
    15:40:32.0546 4260 ql12160 - ok
    15:40:32.0562 4260 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
    15:40:32.0562 4260 ql1240 - ok
    15:40:32.0578 4260 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
    15:40:32.0578 4260 ql1280 - ok
    15:40:32.0609 4260 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    15:40:32.0609 4260 RasAcd - ok
    15:40:32.0656 4260 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll
    15:40:32.0656 4260 RasAuto - ok
    15:40:32.0671 4260 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    15:40:32.0671 4260 Rasl2tp - ok
    15:40:32.0718 4260 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll
    15:40:32.0718 4260 RasMan - ok
    15:40:32.0750 4260 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    15:40:32.0750 4260 RasPppoe - ok
    15:40:32.0765 4260 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    15:40:32.0765 4260 Raspti - ok
    15:40:32.0781 4260 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    15:40:32.0781 4260 Rdbss - ok
    15:40:32.0796 4260 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    15:40:32.0796 4260 RDPCDD - ok
    15:40:32.0812 4260 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    15:40:32.0812 4260 rdpdr - ok
    15:40:32.0843 4260 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
    15:40:32.0859 4260 RDPWD - ok
    15:40:32.0890 4260 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe
    15:40:32.0890 4260 RDSessMgr - ok
    15:40:32.0921 4260 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    15:40:32.0921 4260 redbook - ok
    15:40:32.0953 4260 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll
    15:40:32.0953 4260 RemoteAccess - ok
    15:40:32.0984 4260 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll
    15:40:32.0984 4260 RemoteRegistry - ok
    15:40:33.0015 4260 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe
    15:40:33.0015 4260 RpcLocator - ok
    15:40:33.0062 4260 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
    15:40:33.0062 4260 RpcSs - ok
    15:40:33.0109 4260 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe
    15:40:33.0109 4260 RSVP - ok
    15:40:33.0187 4260 SABProcEnum - ok
    15:40:33.0234 4260 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
    15:40:33.0234 4260 SamSs - ok
    15:40:33.0281 4260 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    15:40:33.0281 4260 SASDIFSV - ok
    15:40:33.0296 4260 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    15:40:33.0296 4260 SASKUTIL - ok
    15:40:33.0390 4260 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe
    15:40:33.0390 4260 SCardSvr - ok
    15:40:33.0437 4260 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll
    15:40:33.0453 4260 Schedule - ok
    15:40:33.0515 4260 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    15:40:33.0515 4260 Secdrv - ok
    15:40:33.0546 4260 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll
    15:40:33.0546 4260 seclogon - ok
    15:40:33.0593 4260 SenFiltService (b6a6b409fda9d9ebd3aadb838d3d7173) C:\WINDOWS\system32\drivers\Senfilt.sys
    15:40:33.0609 4260 SenFiltService - ok
    15:40:33.0640 4260 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll
    15:40:33.0640 4260 SENS - ok
    15:40:33.0687 4260 Sentinel (95a26d5d8ceda33377af627dafc2796f) C:\WINDOWS\System32\Drivers\SENTINEL.SYS
    15:40:33.0687 4260 Sentinel - ok
    15:40:33.0734 4260 SentinelKeysServer (731d9b3de4bc0a3e0830b9bf9dbce2a5) C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
    15:40:33.0734 4260 SentinelKeysServer - ok
    15:40:33.0859 4260 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    15:40:33.0859 4260 serenum - ok
    15:40:33.0875 4260 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
    15:40:33.0875 4260 Serial - ok
    15:40:33.0921 4260 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    15:40:33.0921 4260 Sfloppy - ok
    15:40:33.0953 4260 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll
    15:40:33.0953 4260 SharedAccess - ok
    15:40:33.0984 4260 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
    15:40:34.0000 4260 ShellHWDetection - ok
    15:40:34.0000 4260 Simbad - ok
    15:40:34.0031 4260 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
    15:40:34.0031 4260 sisagp - ok
    15:40:34.0187 4260 SmcService (78c10c39fd37ad30da47a3b44afa3cd6) C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
    15:40:34.0203 4260 SmcService - ok
    15:40:34.0296 4260 SNAC (d1f0648103414146847de8eefcf86cfe) C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
    15:40:34.0296 4260 SNAC - ok
    15:40:34.0406 4260 SNTNLUSB (8d4a96868ae13c3cf8425b383b59d802) C:\WINDOWS\system32\DRIVERS\SNTNLUSB.SYS
    15:40:34.0406 4260 SNTNLUSB - ok
    15:40:34.0453 4260 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
    15:40:34.0453 4260 Sparrow - ok
    15:40:34.0546 4260 SPBBCDrv (d7bb213566e16bca372e2cb517eda907) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
    15:40:34.0562 4260 SPBBCDrv - ok
    15:40:34.0671 4260 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    15:40:34.0671 4260 splitter - ok
    15:40:34.0718 4260 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
    15:40:34.0718 4260 Spooler - ok
    15:40:34.0828 4260 SQLBrowser (86ebd8b1f23e743aad21f4d5b4d40985) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    15:40:34.0828 4260 SQLBrowser - ok
    15:40:34.0875 4260 SQLWriter (d89083c4eb02daca8f944b0e05e57f9d) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    15:40:34.0875 4260 SQLWriter - ok
    15:40:34.0953 4260 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    15:40:34.0953 4260 sr - ok
    15:40:35.0000 4260 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll
    15:40:35.0000 4260 srservice - ok
    15:40:35.0046 4260 SRTSP (4d61a5c45f82e02e73019cd4b31ba6e0) C:\WINDOWS\system32\Drivers\SRTSP.SYS
    15:40:35.0046 4260 SRTSP - ok
    15:40:35.0093 4260 SRTSPL (932381c43c212901b38f30d6b1b54bf6) C:\WINDOWS\system32\Drivers\SRTSPL.SYS
    15:40:35.0093 4260 SRTSPL - ok
    15:40:35.0109 4260 SRTSPX (0fbda1995a1389ee36e5c9335c4ea3eb) C:\WINDOWS\system32\Drivers\SRTSPX.SYS
    15:40:35.0109 4260 SRTSPX - ok
    15:40:35.0156 4260 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
    15:40:35.0156 4260 Srv - ok
    15:40:35.0203 4260 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll
    15:40:35.0203 4260 SSDPSRV - ok
    15:40:35.0234 4260 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
    15:40:35.0234 4260 StillCam - ok
    15:40:35.0265 4260 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll
    15:40:35.0296 4260 stisvc - ok
    15:40:35.0312 4260 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    15:40:35.0312 4260 swenum - ok
    15:40:35.0328 4260 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    15:40:35.0328 4260 swmidi - ok
    15:40:35.0343 4260 SwPrv - ok
    15:40:35.0453 4260 Symantec AntiVirus (6d76bdbddf28a42a2b360ce4e7241602) C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
    15:40:35.0468 4260 Symantec AntiVirus - ok
    15:40:35.0578 4260 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
    15:40:35.0578 4260 symc810 - ok
    15:40:35.0625 4260 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
    15:40:35.0625 4260 symc8xx - ok
    15:40:35.0687 4260 SymEvent (c5eafb6a8c73fb26b73ee613c1a5aef6) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
    15:40:35.0687 4260 SymEvent - ok
    15:40:35.0703 4260 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
    15:40:35.0703 4260 sym_hi - ok
    15:40:35.0734 4260 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
    15:40:35.0734 4260 sym_u3 - ok
    15:40:35.0765 4260 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    15:40:35.0765 4260 sysaudio - ok
    15:40:35.0875 4260 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe
    15:40:35.0875 4260 SysmonLog - ok
    15:40:35.0890 4260 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll
    15:40:35.0906 4260 TapiSrv - ok
    15:40:35.0953 4260 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    15:40:35.0953 4260 Tcpip - ok
    15:40:36.0000 4260 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    15:40:36.0000 4260 TDPIPE - ok
    15:40:36.0015 4260 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    15:40:36.0015 4260 TDTCP - ok
    15:40:36.0062 4260 Teefer2 (0dc098cc18a974e7c1e96e6846bd06e4) C:\WINDOWS\system32\DRIVERS\teefer2.sys
    15:40:36.0062 4260 Teefer2 - ok
    15:40:36.0078 4260 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    15:40:36.0078 4260 TermDD - ok
    15:40:36.0125 4260 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll
    15:40:36.0125 4260 TermService - ok
    15:40:36.0171 4260 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
    15:40:36.0171 4260 Themes - ok
    15:40:36.0203 4260 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe
    15:40:36.0203 4260 TlntSvr - ok
    15:40:36.0234 4260 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
    15:40:36.0234 4260 TosIde - ok
    15:40:36.0281 4260 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll
    15:40:36.0281 4260 TrkWks - ok
    15:40:36.0312 4260 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    15:40:36.0312 4260 Udfs - ok
    15:40:36.0343 4260 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
    15:40:36.0343 4260 ultra - ok
    15:40:36.0359 4260 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    15:40:36.0375 4260 Update - ok
    15:40:36.0390 4260 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll
    15:40:36.0390 4260 upnphost - ok
    15:40:36.0421 4260 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe
    15:40:36.0421 4260 UPS - ok
    15:40:36.0453 4260 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\WINDOWS\system32\Drivers\usbaapl.sys
    15:40:36.0453 4260 USBAAPL - ok
    15:40:36.0500 4260 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    15:40:36.0500 4260 usbccgp - ok
    15:40:36.0546 4260 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    15:40:36.0546 4260 usbehci - ok
    15:40:36.0562 4260 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    15:40:36.0562 4260 usbhub - ok
    15:40:36.0593 4260 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    15:40:36.0593 4260 usbscan - ok
    15:40:36.0640 4260 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    15:40:36.0640 4260 USBSTOR - ok
    15:40:36.0656 4260 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    15:40:36.0656 4260 usbuhci - ok
    15:40:36.0703 4260 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
    15:40:36.0703 4260 usb_rndisx - ok
    15:40:36.0703 4260 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    15:40:36.0703 4260 VgaSave - ok
    15:40:36.0750 4260 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
    15:40:36.0750 4260 viaagp - ok
    15:40:36.0765 4260 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
    15:40:36.0765 4260 ViaIde - ok
    15:40:36.0796 4260 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    15:40:36.0796 4260 VolSnap - ok
    15:40:36.0843 4260 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe
    15:40:36.0843 4260 VSS - ok
    15:40:36.0859 4260 w32time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll
    15:40:36.0875 4260 w32time - ok
    15:40:36.0890 4260 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    15:40:36.0890 4260 Wanarp - ok
    15:40:36.0937 4260 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
    15:40:36.0937 4260 wceusbsh - ok
    15:40:36.0968 4260 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    15:40:36.0984 4260 Wdf01000 - ok
    15:40:36.0984 4260 WDICA - ok
    15:40:37.0031 4260 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    15:40:37.0031 4260 wdmaud - ok
    15:40:37.0078 4260 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll
    15:40:37.0078 4260 WebClient - ok
    15:40:37.0140 4260 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll
    15:40:37.0140 4260 winmgmt - ok
    15:40:37.0203 4260 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
    15:40:37.0203 4260 WmdmPmSN - ok
    15:40:37.0265 4260 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll
    15:40:37.0265 4260 Wmi - ok
    15:40:37.0296 4260 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe
    15:40:37.0296 4260 WmiApSrv - ok
    15:40:37.0406 4260 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe
    15:40:37.0453 4260 WMPNetworkSvc - ok
    15:40:37.0562 4260 WPS (e52098e11a66288106d1ff4951c681e5) C:\WINDOWS\system32\drivers\wpsdrvnt.sys
    15:40:37.0562 4260 WPS - ok
    15:40:37.0593 4260 WpsHelper (ff983a25ae6f7d3f87f26bf51f02a201) C:\WINDOWS\system32\drivers\WpsHelper.sys
    15:40:37.0593 4260 WpsHelper - ok
    15:40:37.0640 4260 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll
    15:40:37.0640 4260 wscsvc - ok
    15:40:37.0640 4260 WSearch - ok
    15:40:37.0687 4260 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll
    15:40:37.0687 4260 wuauserv - ok
    15:40:37.0734 4260 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    15:40:37.0734 4260 WudfPf - ok
    15:40:37.0750 4260 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    15:40:37.0750 4260 WudfRd - ok
    15:40:37.0765 4260 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
    15:40:37.0781 4260 WudfSvc - ok
    15:40:37.0812 4260 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll
    15:40:37.0828 4260 WZCSVC - ok
    15:40:37.0859 4260 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll
    15:40:37.0875 4260 xmlprov - ok
    15:40:37.0906 4260 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
    15:40:37.0921 4260 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - infected
    15:40:37.0921 4260 \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.b (0)
    15:40:37.0953 4260 Boot (0x1200) (8c7c65b8473fc37bc87774f3077c6417) \Device\Harddisk0\DR0\Partition0
    15:40:37.0953 4260 \Device\Harddisk0\DR0\Partition0 - ok
    15:40:37.0953 4260 ============================================================
    15:40:37.0953 4260 Scan finished
    15:40:37.0953 4260
     
  10. tcb

    tcb TS Rookie Topic Starter Posts: 25

    cont'd

    ============================================================
    15:40:37.0953 5688 Detected object count: 1
    15:40:37.0953 5688 Actual detected object count: 1
    15:40:51.0859 5688 \Device\Harddisk0\DR0\# - copied to quarantine
    15:40:51.0859 5688 \Device\Harddisk0\DR0 - copied to quarantine
    15:40:51.0890 5688 \Device\Harddisk0\DR0\TDLFS\mbr - copied to quarantine
    15:40:51.0890 5688 \Device\Harddisk0\DR0\TDLFS\vbr - copied to quarantine
    15:40:51.0890 5688 \Device\Harddisk0\DR0\TDLFS\bid - copied to quarantine
    15:40:51.0890 5688 \Device\Harddisk0\DR0\TDLFS\affid - copied to quarantine
    15:40:51.0890 5688 \Device\Harddisk0\DR0\TDLFS\boot - copied to quarantine
    15:40:51.0906 5688 \Device\Harddisk0\DR0\TDLFS\cmd32 - copied to quarantine
    15:40:58.0843 5688 \Device\Harddisk0\DR0\TDLFS\cmd64 - copied to quarantine
    15:40:58.0859 5688 \Device\Harddisk0\DR0\TDLFS\dbg32 - copied to quarantine
    15:40:58.0906 5688 \Device\Harddisk0\DR0\TDLFS\dbg64 - copied to quarantine
    15:40:58.0921 5688 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine
    15:40:58.0968 5688 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine
    15:40:59.0046 5688 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine
    15:40:59.0593 5688 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine
    15:40:59.0625 5688 \Device\Harddisk0\DR0\TDLFS\subid - copied to quarantine
    15:40:59.0625 5688 \Device\Harddisk0\DR0\TDLFS\info - copied to quarantine
    15:40:59.0625 5688 \Device\Harddisk0\DR0\TDLFS\main - copied to quarantine
    15:40:59.0640 5688 \Device\Harddisk0\DR0\TDLFS\mainfb.script - copied to quarantine
    15:40:59.0656 5688 \Device\Harddisk0\DR0\TDLFS\com32 - copied to quarantine
    15:40:59.0718 5688 \Device\Harddisk0\DR0\TDLFS\bbr232 - copied to quarantine
    15:40:59.0765 5688 \Device\Harddisk0\DR0\TDLFS\serf332 - copied to quarantine
    15:40:59.0828 5688 \Device\Harddisk0\DR0\TDLFS\serf_conf - copied to quarantine
    15:40:59.0875 5688 \Device\Harddisk0\DR0\TDLFS\bbr_conf - copied to quarantine
    15:40:59.0921 5688 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - will be cured on reboot
    15:40:59.0921 5688 \Device\Harddisk0\DR0 - ok
    15:40:59.0937 5688 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - User select action: Cure
    15:41:07.0218 4196 Deinitialize success
     
  11. tcb

    tcb TS Rookie Topic Starter Posts: 25

    Avast warned me and did something with regards to a trojan when TDSSKiller stopped doing its thing.
     
  12. tcb

    tcb TS Rookie Topic Starter Posts: 25

    Looks like it pulled it out of the TDSSKiller Quarantine and moved it to its "Virus Chest".
     
  13. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    See if DDS and aswMBR will run now.
     
  14. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    We posted at the same time.
    Read my previous reply.
     
  15. tcb

    tcb TS Rookie Topic Starter Posts: 25

    aswMBR

    Bootkit Remover
    (c) 2009 Esage Lab
    www.esagelab.com

    Program version: 1.2.0.1
    OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000

    Size Device Name MBR Status
    --------------------------------------------
    232 GB \\.\PhysicalDrive0 Controlled by rootkit!

    Boot code on some of your physical disks is hidden by a rootkit.
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]


    Done;
    Press any key to quit...
    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-04-03 15:56:12
    -----------------------------
    15:56:12.687 OS Version: Windows 5.1.2600 Service Pack 3
    15:56:12.687 Number of processors: 2 586 0xF0B
    15:56:12.687 ComputerName: BRIAN7 UserName: Staff
    15:56:14.843 Initialize success
    15:56:15.203 AVAST engine defs: 12040302
    15:56:40.593 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    15:56:40.593 Disk 0 Vendor: ST325031 3.AD Size: 238418MB BusType: 3
    15:56:40.609 Disk 0 MBR read successfully
    15:56:40.609 Disk 0 MBR scan
    15:56:40.609 Disk 0 Windows XP default MBR code
    15:56:40.609 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
    15:56:40.625 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 238347 MB offset 128520
    15:56:40.625 Disk 0 scanning sectors +488263545
    15:56:40.718 Disk 0 scanning C:\WINDOWS\system32\drivers
    15:56:48.781 Service scanning
    15:57:01.125 Service Teefer2 C:\WINDOWS\system32\DRIVERS\teefer2.sys **LOCKED** 32
    15:57:02.343 Service WPS C:\WINDOWS\system32\drivers\wpsdrvnt.sys **LOCKED** 32
    15:57:02.375 Service WpsHelper C:\WINDOWS\system32\drivers\WpsHelper.sys **LOCKED** 32
    15:57:03.125 Modules scanning
    15:57:08.125 Disk 0 trace - called modules:
    15:57:08.156 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
    15:57:08.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ae05ab8]
    15:57:08.156 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8ae74030]
    15:57:08.687 AVAST engine scan C:\WINDOWS
    15:57:27.625 AVAST engine scan C:\WINDOWS\system32
    15:59:40.453 AVAST engine scan C:\WINDOWS\system32\drivers
    15:59:55.687 AVAST engine scan C:\Documents and Settings\Staff
    16:00:07.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Staff\Desktop\MBR.dat"
    16:00:07.671 The log file has been saved successfully to "C:\Documents and Settings\Staff\Desktop\aswMBR.txt"
     
  16. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    ..and DDS.
     
  17. tcb

    tcb TS Rookie Topic Starter Posts: 25

    DDS.txt

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24
    Run by Staff at 16:06:39 on 2012-04-03
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2272 [GMT -7:00]
    .
    AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
    AV: Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
    FW: Symantec Endpoint Protection *Disabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
    svchost.exe
    svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
    C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\AVAST Software\Avast\avastUI.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\PROGRA~1\HEWLET~1\Toolbox\STATUS~1\STATUS~1.EXE
    C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Staff\Desktop\aswMBR.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    uSearch Page = hxxp://www.google.ca/hws/sb/dell-row-rel/en/side.html?channel=ca
    uDefault_Page_URL = hxxp://www.mtv.ca/ie8/home01
    uWindow Title = Windows Internet Explorer provided by MTV.CA
    mSearch Bar = hxxp://www.google.com/ie
    uInternet Settings,ProxyOverride = <local>;*.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    mSearchAssistant = hxxp://www.google.com/ie
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
    BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
    mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
    mRun: [<NO NAME>]
    mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
    mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
    mRun: [TomcatStartup 2.5] c:\program files\hewlett-packard\toolbox\hpbpsttp.exe
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    dRunOnce: [RunNarrator] Narrator.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoca~1.lnk - c:\program files\common files\autodesk shared\acstart16.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert link target to existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: Google Sidewiki...
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224799319011
    DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 75.153.176.9 75.153.176.1
    TCP: Interfaces\{C0DD9B08-2BC9-4A2C-A2A8-F2F2157AB2EB} : DhcpNameServer = 75.153.176.9 75.153.176.1
    Handler: jpip - {B92DD248-E3D5-4A92-B311-C9B841681455} - c:\program files\lizardtech\express view\expressview.dll
    Handler: sidlet - {B92DD248-E3D5-4A92-B311-C9B841681455} - c:\program files\lizardtech\express view\expressview.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    Hosts: 94.63.147.16 www.google.com
    Hosts: 94.63.147.17 www.bing.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\documents and settings\staff\application data\mozilla\firefox\profiles\q1hpcp3c.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
    FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
    FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-3-30 612184]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-3-30 337880]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
    R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
    R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-3-30 20696]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-3-30 44768]
    R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2009-5-20 108392]
    R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2009-5-20 108392]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-3-30 652360]
    R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\common files\safenet sentinel\sentinel keys server\sntlkeyssrvr.exe [2007-4-27 316992]
    R2 Symantec AntiVirus;Symantec Endpoint Protection;c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [2009-5-20 1768376]
    R3 CBUSB;MARX CryptoTech LP;c:\windows\system32\drivers\CBUSB.sys [2007-2-14 45136]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-4-2 106104]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-3-30 20464]
    R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20120402.002\NAVENG.SYS [2012-4-3 86136]
    R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20120402.002\NAVEX15.SYS [2012-4-3 1576312]
    S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
    S2 gupdate1c99b94d903291d;Google Update Service (gupdate1c99b94d903291d);c:\program files\google\update\GoogleUpdate.exe [2009-3-2 133104]
    S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2009-5-20 23888]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-3-2 133104]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-8-21 18688]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-8-21 8320]
    S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-6-18 23680]
    .
    =============== Created Last 30 ================
    .
    2012-04-03 22:40:51 -------- d-----w- C:\TDSSKiller_Quarantine
    2012-04-03 15:57:59 -------- d-----w- c:\documents and settings\staff\local settings\application data\NPE
    2012-04-03 15:57:59 -------- d-----w- c:\documents and settings\all users\application data\Norton
    2012-04-02 15:34:25 60800 ----a-w- c:\windows\system32\S32EVNT1.DLL
    2012-04-02 15:34:24 123952 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
    2012-04-02 15:32:58 -------- d-----w- c:\program files\Symantec
    2012-03-30 20:28:35 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2012-03-30 19:54:05 41184 ----a-w- c:\windows\avastSS.scr
    2012-03-30 19:53:50 -------- d-----w- c:\program files\AVAST Software
    2012-03-30 19:53:50 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
    2012-03-30 19:45:48 388096 ----a-r- c:\documents and settings\staff\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2012-03-30 19:45:48 -------- d-----w- c:\program files\Trend Micro
    2012-03-30 18:44:41 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-03-30 18:44:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-03-30 18:05:57 101920 ----a-w- c:\documents and settings\all users\application data\1333130424.bdinstall.bin
    2012-03-30 17:34:59 924600 ----a-w- c:\program files\mozilla firefox\firefox.exe
    2012-03-30 17:15:21 447208 ----a-w- c:\windows\system32\drivers\avckf.sys
    2012-03-30 17:13:45 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2012-03-30 17:13:45 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy
    2012-03-30 17:00:36 256843 ----a-w- c:\documents and settings\all users\application data\1333125710.bdinstall.bin
    2012-03-30 16:38:50 239271 ----a-w- c:\documents and settings\all users\application data\1333124823.bdinstall.bin
    2012-03-29 22:33:37 -------- d-----w- c:\documents and settings\staff\application data\SUPERAntiSpyware.com
    2012-03-29 22:33:08 -------- d-----w- c:\program files\SUPERAntiSpyware
    2012-03-29 22:33:08 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
    2012-03-29 18:22:56 -------- d-----w- c:\documents and settings\staff\application data\Malwarebytes
    2012-03-29 18:22:18 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
    2012-03-29 18:15:00 329753 ----a-w- c:\documents and settings\all users\application data\1333044001.bdinstall.bin
    2012-03-29 18:13:04 -------- d-----w- c:\documents and settings\all users\application data\BDLogging
    2012-03-29 18:11:29 16928 ------w- c:\windows\system32\spmsgXP_2k3.dll
    2012-03-29 18:03:50 -------- d-----w- c:\documents and settings\staff\application data\QuickScan
    2012-03-29 18:00:56 -------- d-----w- c:\program files\Bitdefender
    2012-03-29 17:59:22 -------- d-----w- c:\program files\common files\Bitdefender
    2012-03-26 21:50:49 -------- d-----w- c:\program files\iPod
    2012-03-26 21:50:44 -------- d-----w- c:\program files\iTunes
    2012-03-26 21:47:05 -------- d-----w- c:\program files\Bonjour
    2012-03-22 19:12:12 4435968 ----a-w- c:\windows\system32\GPhotos.scr
    2012-03-06 20:31:18 -------- d-----w- c:\documents and settings\staff\local settings\application data\HP
    2012-03-06 20:13:14 74752 ----a-w- c:\windows\system32\jst.dll
    2012-03-06 20:13:14 40960 ----a-w- c:\windows\system32\d4channel.dll
    2012-03-06 20:13:14 36864 ----a-w- c:\windows\system32\hpbmmjno.dll
    2012-03-06 20:13:14 32768 ----a-w- c:\windows\system32\compJNI.dll
    2012-03-06 20:13:14 102400 ----a-w- c:\windows\system32\PMLJNI.dll
    2012-03-06 20:12:35 -------- d-----w- c:\program files\Zero G Registry
    2012-03-06 20:08:10 -------- d-----w- c:\program files\common files\Hewlett-Packard
    2012-03-06 20:02:57 94208 ----a-w- c:\windows\system32\HPZipt12.dll
    2012-03-06 20:02:57 61440 ----a-w- c:\windows\system32\HPZinw12.exe
    2012-03-06 20:02:57 57344 ----a-w- c:\windows\system32\HPZisn12.dll
    2012-03-06 19:58:45 -------- d-----w- C:\Temp
    2012-03-06 19:57:36 -------- d-----w- c:\program files\HP
    2012-03-06 19:56:07 -------- d-----w- c:\program files\common files\SWF Studio
    .
    ==================== Find3M ====================
    .
    2012-03-26 22:05:53 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-03-20 16:09:24 59 ----a-w- c:\windows\wpd99.drv
    2012-02-22 18:13:19 376832 ----a-w- c:\windows\system32\MPIWIN32.DLL
    2012-02-16 18:41:32 45136 ----a-w- c:\windows\system32\drivers\CBUSB.sys
    2012-02-15 18:01:50 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
    2012-02-15 18:01:50 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2012-02-03 09:22:18 1860096 ----a-w- c:\windows\system32\win32k.sys
    2012-01-11 19:06:47 3072 ------w- c:\windows\system32\iacenc.dll
    2012-01-09 16:20:25 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    .
    ============= FINISH: 16:07:50.46 ===============
     
  18. tcb

    tcb TS Rookie Topic Starter Posts: 25

    DDS Attach.txt

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 23/10/2008 3:00:29 PM
    System Uptime: 03/04/2012 3:44:53 PM (1 hours ago)
    .
    Motherboard: Dell Inc. | | 0TP412
    Processor: Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz | CPU | 2327/1333mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 233 GiB total, 182.073 GiB free.
    D: is CDROM ()
    R: is NetworkDisk (NTFS) - 439 GiB total, 198.144 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Installed Programs ======================
    .
    Acrobat.com
    Adobe Acrobat 9 Pro
    Adobe Acrobat 9 Pro - English, Français, Deutsch
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader 9
    Adobe SVG Viewer 3.0
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Arcv2CAD 5.0
    AutoCAD 2005 - English
    Autodesk DWF Viewer
    avast! Free Antivirus
    Bonjour
    Broadcom ASF Management Applications
    Broadcom Management Programs
    Browser Address Error Redirector
    Business Contact Manager for Outlook 2007 SP2
    Dell ETS Factory Installation
    DivX Setup
    EasyGPS 4.18
    FieldGenius 2008 - Tablet Edition
    FieldGenius 2008 for Pocket PC
    ForeSight DXM
    FTP Commander
    Garmin USB Drivers
    Garmin WebUpdater
    Google Chrome
    Google Earth
    Google Toolbar for Internet Explorer
    Google Update Helper
    GPS1200 Simulation
    GPSBabel 1.4.2
    GPSU version 5.11
    GSAK 7.7.0.109 (Final)
    High Definition Audio Driver Package - KB835221
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB2570791)
    Hotfix for Windows XP (KB2633952)
    Hotfix for Windows XP (KB915800-v4)
    Hotfix for Windows XP (KB946554)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HP Color LaserJet 2820/2830/2840 2.0
    hppCLJ2800
    hppDustDevil
    hppFaxDrv
    hppFonts
    hppIOFiles
    hppManuals2800
    hppscan2800
    hppScanTo
    hppSendFax
    hppTooCool
    Intel(R) Matrix Storage Manager
    Ipswitch WS_FTP LE
    IrfanView (remove only)
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 24
    Java(TM) 6 Update 7
    LEICA Geo Office
    Leica pcE RunTime 1.3.1.5287
    LiveUpdate 3.3 (Symantec Corporation)
    Lizardtech Express View Browser Plug-in
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2656353)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft ActiveSync
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
    Microsoft Office 2003 Web Components
    Microsoft Office 2007 Primary Interop Assemblies
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Small Business 2007
    Microsoft Office Small Business Connectivity Components
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 12
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft Works 6-9 Converter
    Microsoft XML Parser
    MicroSurvey CAD 2010
    Mozilla Firefox 11.0 (x86 en-US)
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6 Service Pack 2 (KB954459)
    NVIDIA Drivers
    Oxelon Media Converter 1.1
    Paint.NET v3.36
    Pdf995
    PDLCONF Dealer Version
    Picasa 3
    PointCloud CAD 2010
    PowerDVD
    Quantum GIS Wroclaw 1.7.3 Wroclaw
    QuickTime
    Scan
    SearchAssist
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
    Security Update for Microsoft Windows (KB2564958)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB2530548)
    Security Update for Windows Internet Explorer 8 (KB2544521)
    Security Update for Windows Internet Explorer 8 (KB2559049)
    Security Update for Windows Internet Explorer 8 (KB2586448)
    Security Update for Windows Internet Explorer 8 (KB2618444)
    Security Update for Windows Internet Explorer 8 (KB2647516)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player (KB979402)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows Search 4 - KB963093
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476490)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2479943)
    Security Update for Windows XP (KB2481109)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2491683)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2503665)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2507938)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB2535512)
    Security Update for Windows XP (KB2536276-v2)
    Security Update for Windows XP (KB2536276)
    Security Update for Windows XP (KB2544893-v2)
    Security Update for Windows XP (KB2544893)
    Security Update for Windows XP (KB2555917)
    Security Update for Windows XP (KB2562937)
    Security Update for Windows XP (KB2566454)
    Security Update for Windows XP (KB2567053)
    Security Update for Windows XP (KB2567680)
    Security Update for Windows XP (KB2570222)
    Security Update for Windows XP (KB2570947)
    Security Update for Windows XP (KB2584146)
    Security Update for Windows XP (KB2585542)
    Security Update for Windows XP (KB2592799)
    Security Update for Windows XP (KB2598479)
    Security Update for Windows XP (KB2603381)
    Security Update for Windows XP (KB2618451)
    Security Update for Windows XP (KB2619339)
    Security Update for Windows XP (KB2620712)
    Security Update for Windows XP (KB2621440)
    Security Update for Windows XP (KB2624667)
    Security Update for Windows XP (KB2631813)
    Security Update for Windows XP (KB2633171)
    Security Update for Windows XP (KB2639417)
    Security Update for Windows XP (KB2641653)
    Security Update for Windows XP (KB2646524)
    Security Update for Windows XP (KB2647518)
    Security Update for Windows XP (KB2660465)
    Security Update for Windows XP (KB2661637)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Segoe UI
    Sentinel Protection Installer 7.4.0
    Shape2Earth Engine 1.0.0
    Spelling Dictionaries Support For Adobe Reader 9
    SportTracks 3.0
    StarNet
    StarNet Converter
    SUPERAntiSpyware
    Symantec Endpoint Protection Client
    TextPad 5
    TPS1200 Simulation
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
    Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
    Update for Microsoft Office 2007 suites (KB2597970) 32-Bit Edition
    Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
    Update for Windows Internet Explorer 8 (KB975364)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB2541763)
    Update for Windows XP (KB2607712)
    Update for Windows XP (KB2616676)
    Update for Windows XP (KB2641690)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971029)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    VC80CRTRedist - 8.0.50727.6195
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WebFldrs XP
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
    Windows Genuine Advantage Notifications (KB905474)
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Search 4.0
    Windows XP Service Pack 3
    WinRAR archiver
    .
    ==== Event Viewer Messages From Past Week ========
    .
    30/03/2012 9:57:47 AM, error: Service Control Manager [7000] - The bdsandbox service failed to start due to the following error: The specified procedure could not be found.
    30/03/2012 8:23:53 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avc3 bdfsfltr bdftdif bdselfpr BDVEDISK eeCtrl Fips intelppm IPSec Lbd MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL SPBBCDrv SRTSP SRTSPX SYMTDI Tcpip trufos WPS
    30/03/2012 3:39:43 PM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).
    30/03/2012 11:51:09 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm Lbd SASDIFSV SASKUTIL SPBBCDrv SRTSP SRTSPX SYMTDI
    30/03/2012 11:39:22 AM, error: Service Control Manager [7034] - The LiveUpdate service terminated unexpectedly. It has done this 1 time(s).
    30/03/2012 11:16:23 AM, error: Service Control Manager [7000] - The Bonjour Service service failed to start due to the following error: The system cannot find the file specified.
    30/03/2012 10:23:06 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
    29/03/2012 9:48:18 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec Lbd MRxSmb NetBIOS NetBT RasAcd Rdbss SPBBCDrv SRTSP SRTSPX SYMTDI Tcpip WPS
    29/03/2012 9:48:18 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    29/03/2012 9:48:18 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    29/03/2012 9:48:18 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    29/03/2012 9:48:18 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    29/03/2012 9:48:18 AM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    29/03/2012 9:48:18 AM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    29/03/2012 9:47:58 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    29/03/2012 9:47:10 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    29/03/2012 9:47:07 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    29/03/2012 9:37:52 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd
    29/03/2012 2:48:20 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    29/03/2012 2:23:12 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avc3 bdfsfltr bdftdif bdselfpr BDVEDISK eeCtrl Fips intelppm IPSec Lbd MRxSmb NetBIOS NetBT RasAcd Rdbss SPBBCDrv SRTSP SRTSPX SYMTDI Tcpip trufos WPS
    28/03/2012 8:40:34 AM, error: EventLog [6004] - A driver packet received from the I/O subsystem was invalid. The data is the packet.
    28/03/2012 3:01:29 AM, error: DCOM [10009] - DCOM was unable to communicate with the computer BRIAN2 using any of the configured protocols.
    28/03/2012 2:27:53 AM, error: DCOM [10009] - DCOM was unable to communicate with the computer BRIAN1A using any of the configured protocols.
    28/03/2012 12:42:28 PM, error: Print [6161] - The document J09063_EX12005C.pdf owned by Staff failed to print on printer \\BRIAN1A\HP designjet 5500 42 by hp. Data type: RAW. Size of the spool file in bytes: 179803. Number of bytes printed: 0. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\BRIAN7. Win32 error code returned by the print processor: 1775 (0x6ef).
    27/03/2012 2:58:26 PM, error: Dhcp [1002] - The IP address lease 192.168.1.6 for the Network Card with network address 0022190CD980 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    03/04/2012 10:08:19 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD aswRdr aswSnx aswSP aswTdi eeCtrl Fips intelppm IPSec Lbd MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL SPBBCDrv SRTSP SRTSPX Tcpip WPS
    03/04/2012 10:03:59 AM, error: Service Control Manager [7034] - The Sentinel Keys Server service terminated unexpectedly. It has done this 1 time(s).
    02/04/2012 4:23:19 PM, error: Dhcp [1002] - The IP address lease 192.168.1.3 for the Network Card with network address 0022190CD980 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    .
    ==== End Of File ===========================
     
  19. tcb

    tcb TS Rookie Topic Starter Posts: 25

    aswMBR.txt - wasn't done scanning...now it is

    Bootkit Remover
    (c) 2009 Esage Lab
    www.esagelab.com

    Program version: 1.2.0.1
    OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000

    Size Device Name MBR Status
    --------------------------------------------
    232 GB \\.\PhysicalDrive0 Controlled by rootkit!

    Boot code on some of your physical disks is hidden by a rootkit.
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]


    Done;
    Press any key to quit...
    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-04-03 15:56:12
    -----------------------------
    15:56:12.687 OS Version: Windows 5.1.2600 Service Pack 3
    15:56:12.687 Number of processors: 2 586 0xF0B
    15:56:12.687 ComputerName: BRIAN7 UserName: Staff
    15:56:14.843 Initialize success
    15:56:15.203 AVAST engine defs: 12040302
    15:56:40.593 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    15:56:40.593 Disk 0 Vendor: ST325031 3.AD Size: 238418MB BusType: 3
    15:56:40.609 Disk 0 MBR read successfully
    15:56:40.609 Disk 0 MBR scan
    15:56:40.609 Disk 0 Windows XP default MBR code
    15:56:40.609 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
    15:56:40.625 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 238347 MB offset 128520
    15:56:40.625 Disk 0 scanning sectors +488263545
    15:56:40.718 Disk 0 scanning C:\WINDOWS\system32\drivers
    15:56:48.781 Service scanning
    15:57:01.125 Service Teefer2 C:\WINDOWS\system32\DRIVERS\teefer2.sys **LOCKED** 32
    15:57:02.343 Service WPS C:\WINDOWS\system32\drivers\wpsdrvnt.sys **LOCKED** 32
    15:57:02.375 Service WpsHelper C:\WINDOWS\system32\drivers\WpsHelper.sys **LOCKED** 32
    15:57:03.125 Modules scanning
    15:57:08.125 Disk 0 trace - called modules:
    15:57:08.156 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
    15:57:08.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ae05ab8]
    15:57:08.156 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8ae74030]
    15:57:08.687 AVAST engine scan C:\WINDOWS
    15:57:27.625 AVAST engine scan C:\WINDOWS\system32
    15:59:40.453 AVAST engine scan C:\WINDOWS\system32\drivers
    15:59:55.687 AVAST engine scan C:\Documents and Settings\Staff
    16:00:07.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Staff\Desktop\MBR.dat"
    16:00:07.671 The log file has been saved successfully to "C:\Documents and Settings\Staff\Desktop\aswMBR.txt"


    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-04-03 15:56:12
    -----------------------------
    15:56:12.687 OS Version: Windows 5.1.2600 Service Pack 3
    15:56:12.687 Number of processors: 2 586 0xF0B
    15:56:12.687 ComputerName: BRIAN7 UserName: Staff
    15:56:14.843 Initialize success
    15:56:15.203 AVAST engine defs: 12040302
    15:56:40.593 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    15:56:40.593 Disk 0 Vendor: ST325031 3.AD Size: 238418MB BusType: 3
    15:56:40.609 Disk 0 MBR read successfully
    15:56:40.609 Disk 0 MBR scan
    15:56:40.609 Disk 0 Windows XP default MBR code
    15:56:40.609 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
    15:56:40.625 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 238347 MB offset 128520
    15:56:40.625 Disk 0 scanning sectors +488263545
    15:56:40.718 Disk 0 scanning C:\WINDOWS\system32\drivers
    15:56:48.781 Service scanning
    15:57:01.125 Service Teefer2 C:\WINDOWS\system32\DRIVERS\teefer2.sys **LOCKED** 32
    15:57:02.343 Service WPS C:\WINDOWS\system32\drivers\wpsdrvnt.sys **LOCKED** 32
    15:57:02.375 Service WpsHelper C:\WINDOWS\system32\drivers\WpsHelper.sys **LOCKED** 32
    15:57:03.125 Modules scanning
    15:57:08.125 Disk 0 trace - called modules:
    15:57:08.156 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
    15:57:08.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ae05ab8]
    15:57:08.156 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8ae74030]
    15:57:08.687 AVAST engine scan C:\WINDOWS
    15:57:27.625 AVAST engine scan C:\WINDOWS\system32
    15:59:40.453 AVAST engine scan C:\WINDOWS\system32\drivers
    15:59:55.687 AVAST engine scan C:\Documents and Settings\Staff
    16:00:07.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Staff\Desktop\MBR.dat"
    16:00:07.671 The log file has been saved successfully to "C:\Documents and Settings\Staff\Desktop\aswMBR.txt"
    16:08:23.375 AVAST engine scan C:\Documents and Settings\All Users
    16:15:16.312 Scan finished successfully
    16:15:58.562 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Staff\Desktop\MBR.dat"
    16:15:58.562 The log file has been saved successfully to "C:\Documents and Settings\Staff\Desktop\aswMBR.txt"
     
  20. tcb

    tcb TS Rookie Topic Starter Posts: 25

    I have to go.

    I have to go and pickup the kids. Let me know what to do next and I will do it and post when I am back at the computer tommorow at 8AM PST.
     
  21. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    No problem.

    You're running two AV programs, Avast and Norton.
    One of them has to go.
    If Norton use this tool to uninstall it: http://majorgeeks.com/Norton_Removal_Tool_SymNRT_d4749.html

    Then....

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    Vista and Win7 users need to right click Rkill and choose Run as Administrator
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.exe
    • Double-click on the Rkill icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  22. tcb

    tcb TS Rookie Topic Starter Posts: 25

    ComboFix --> log.txt

    ComboFix 12-04-04.02 - Staff 04/04/2012 7:54.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2328 [GMT -7:00]
    Running from: c:\documents and settings\Staff\Desktop\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Staff\Application Data\Local
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\Inception_Trailer_NEW.divx(2).ddr
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\Inception_Trailer_NEW.divx.ddr
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_NEW(2).divx
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_NEW.divx
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\video.avi
    c:\documents and settings\Staff\Application Data\Local\Temp\DDM\Settings\video.avi.ddr
    c:\windows\dasetup.log
    c:\windows\system32\dllcache\dlimport.exe
    c:\windows\system32\Temp
    .
    c:\windows\system32\grpconv.exe was missing
    Restored copy from - c:\windows\ServicePackFiles\i386\grpconv.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-03-04 to 2012-04-04 )))))))))))))))))))))))))))))))
    .
    .
    2012-04-04 14:58 . 2008-04-14 00:12 39424 ----a-w- c:\windows\system32\grpconv.exe
    2012-04-04 14:58 . 2008-04-14 00:12 39424 ----a-w- c:\windows\system32\dllcache\grpconv.exe
    2012-04-03 22:40 . 2012-04-03 22:40 -------- d-----w- C:\TDSSKiller_Quarantine
    2012-04-03 15:57 . 2012-04-03 16:05 -------- d-----w- c:\documents and settings\Staff\Local Settings\Application Data\NPE
    2012-04-03 15:57 . 2012-04-03 15:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
    2012-03-30 20:28 . 2012-03-06 23:03 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2012-03-30 20:28 . 2012-03-06 23:01 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2012-03-30 20:28 . 2012-03-06 23:02 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2012-03-30 20:28 . 2012-03-06 23:01 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2012-03-30 20:28 . 2012-03-06 23:03 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2012-03-30 20:28 . 2012-03-06 23:01 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2012-03-30 20:28 . 2012-03-06 23:01 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2012-03-30 19:54 . 2012-03-06 22:58 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2012-03-30 19:54 . 2012-03-06 23:15 41184 ----a-w- c:\windows\avastSS.scr
    2012-03-30 19:54 . 2012-03-06 23:15 201352 ----a-w- c:\windows\system32\aswBoot.exe
    2012-03-30 19:53 . 2012-03-30 19:53 -------- d-----w- c:\program files\AVAST Software
    2012-03-30 19:53 . 2012-03-30 19:53 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
    2012-03-30 19:45 . 2012-03-30 19:45 388096 ----a-r- c:\documents and settings\Staff\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2012-03-30 19:45 . 2012-03-30 19:45 -------- d-----w- c:\program files\Trend Micro
    2012-03-30 18:44 . 2012-03-30 18:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-03-30 18:44 . 2011-12-10 22:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-03-30 18:05 . 2012-03-30 18:05 101920 ----a-w- c:\documents and settings\All Users\Application Data\1333130424.bdinstall.bin
    2012-03-30 17:34 . 2012-03-13 04:39 818104 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
    2012-03-30 17:15 . 2012-03-30 17:15 447208 ----a-w- c:\windows\system32\drivers\avckf.sys
    2012-03-30 17:13 . 2012-03-30 22:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2012-03-30 17:13 . 2012-03-30 22:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2012-03-30 17:00 . 2012-03-30 17:00 256843 ----a-w- c:\documents and settings\All Users\Application Data\1333125710.bdinstall.bin
    2012-03-30 16:38 . 2012-03-30 16:38 239271 ----a-w- c:\documents and settings\All Users\Application Data\1333124823.bdinstall.bin
    2012-03-29 22:33 . 2012-03-29 22:33 -------- d-----w- c:\documents and settings\Staff\Application Data\SUPERAntiSpyware.com
    2012-03-29 22:33 . 2012-03-29 22:33 -------- d-----w- c:\program files\SUPERAntiSpyware
    2012-03-29 22:33 . 2012-03-29 22:33 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2012-03-29 18:22 . 2012-03-29 18:22 -------- d-----w- c:\documents and settings\Staff\Application Data\Malwarebytes
    2012-03-29 18:22 . 2012-03-29 18:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2012-03-29 18:15 . 2012-03-29 18:15 329753 ----a-w- c:\documents and settings\All Users\Application Data\1333044001.bdinstall.bin
    2012-03-29 18:13 . 2012-03-29 18:13 -------- d-----w- c:\documents and settings\All Users\Application Data\BDLogging
    2012-03-29 18:11 . 2008-11-08 01:55 16928 ------w- c:\windows\system32\spmsgXP_2k3.dll
    2012-03-29 18:03 . 2012-03-29 18:03 -------- d-----w- c:\documents and settings\Staff\Application Data\QuickScan
    2012-03-29 18:00 . 2012-03-30 18:14 -------- d-----w- c:\program files\Bitdefender
    2012-03-29 17:59 . 2012-03-30 18:05 -------- d-----w- c:\program files\Common Files\Bitdefender
    2012-03-26 21:50 . 2012-03-26 21:50 -------- d-----w- c:\program files\iPod
    2012-03-26 21:50 . 2012-03-26 21:51 -------- d-----w- c:\program files\iTunes
    2012-03-26 21:47 . 2012-03-30 16:05 -------- d-----w- c:\program files\Bonjour
    2012-03-22 19:12 . 2012-03-22 19:12 4435968 ----a-w- c:\windows\system32\GPhotos.scr
    2012-03-06 20:31 . 2012-03-06 20:31 -------- d-----w- c:\documents and settings\Staff\Local Settings\Application Data\HP
    2012-03-06 20:13 . 2005-02-03 17:31 32768 ----a-w- c:\windows\system32\compJNI.dll
    2012-03-06 20:13 . 2004-08-20 13:02 102400 ----a-w- c:\windows\system32\PMLJNI.dll
    2012-03-06 20:13 . 2004-05-10 20:11 40960 ----a-w- c:\windows\system32\d4channel.dll
    2012-03-06 20:13 . 2003-06-20 17:21 36864 ----a-w- c:\windows\system32\hpbmmjno.dll
    2012-03-06 20:13 . 2003-06-16 21:52 74752 ----a-w- c:\windows\system32\jst.dll
    2012-03-06 20:12 . 2012-03-06 20:13 -------- d-----w- c:\program files\Zero G Registry
    2012-03-06 20:08 . 2012-03-30 22:31 -------- d-----w- c:\program files\Hewlett-Packard
    2012-03-06 20:08 . 2012-03-06 20:08 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
    2012-03-06 20:02 . 2004-12-24 19:07 57344 ----a-w- c:\windows\system32\HPZisn12.dll
    2012-03-06 20:02 . 2004-12-24 19:07 94208 ----a-w- c:\windows\system32\HPZipt12.dll
    2012-03-06 20:02 . 2004-12-24 19:05 61440 ----a-w- c:\windows\system32\HPZinw12.exe
    2012-03-06 19:58 . 2012-03-06 20:02 -------- d-----w- C:\Temp
    2012-03-06 19:57 . 2012-03-30 22:28 -------- d-----w- c:\program files\HP
    2012-03-06 19:56 . 2012-03-06 19:56 -------- d-----w- c:\program files\Common Files\SWF Studio
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-03-26 22:05 . 2011-06-27 15:11 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-02-22 18:13 . 2012-02-22 18:13 376832 ----a-w- c:\windows\system32\MPIWIN32.DLL
    2012-02-16 18:41 . 2007-02-14 23:13 45136 ----a-w- c:\windows\system32\drivers\CBUSB.sys
    2012-02-15 18:01 . 2011-08-31 19:23 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
    2012-02-15 18:01 . 2008-11-04 16:45 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2012-02-03 09:22 . 2004-08-11 22:00 1860096 ----a-w- c:\windows\system32\win32k.sys
    2012-01-11 19:06 . 2012-02-15 05:35 3072 ------w- c:\windows\system32\iacenc.dll
    2012-01-09 16:20 . 2004-08-11 22:11 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-03-13 04:39 . 2012-03-30 17:35 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-30 39408]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-13 8523776]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-09-11 1015808]
    "ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-26 17920]
    "PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
    "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]
    "DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-07 421736]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
    "TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-11-12 245760]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2004-2-24 10872]
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2011-05-04 17:54 551296 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
    "c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
    "c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Keys Server\\sntlkeyssrvr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
    .
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [30/03/2012 1:28 PM 612184]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [30/03/2012 1:28 PM 337880]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22/07/2011 9:27 AM 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/07/2011 2:55 PM 67664]
    R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [11/08/2011 4:38 PM 116608]
    R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [20/06/2007 12:30 PM 79168]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [30/03/2012 1:28 PM 20696]
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [30/03/2012 11:44 AM 652360]
    R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [27/04/2007 1:00 AM 316992]
    R3 CBUSB;MARX CryptoTech LP;c:\windows\system32\drivers\CBUSB.sys [14/02/2007 4:13 PM 45136]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [30/03/2012 11:44 AM 20464]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
    S2 gupdate1c99b94d903291d;Google Update Service (gupdate1c99b94d903291d);c:\program files\Google\Update\GoogleUpdate.exe [02/03/2009 5:13 PM 133104]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [02/03/2009 5:13 PM 133104]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [21/08/2008 11:49 PM 18688]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [21/08/2008 11:49 PM 8320]
    S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [18/06/2007 8:18 PM 23680]
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
    .
    2012-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 00:13]
    .
    2012-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 00:13]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    mSearch Bar = hxxp://www.google.com/ie
    uInternet Settings,ProxyOverride = <local>;*.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki...
    TCP: DhcpNameServer = 75.153.176.9 75.153.176.1
    FF - ProfilePath - c:\documents and settings\Staff\Application Data\Mozilla\Firefox\Profiles\q1hpcp3c.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-04-04 08:03
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*]
    @="WordPad Document"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\AuxUserType\2]
    @="WordPad Document"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\AuxUserType\3]
    @="WordPad"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\DefaultIcon]
    @="c:\\PROGRA~1\\MIB102~1\\MSCAD2~1\\MSRTFV~1.EXE,1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\InprocHandler32]
    @="ole32.dll"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\Insertable]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\LocalServer32]
    @="c:\\PROGRA~1\\MIB102~1\\MSCAD2~1\\MSRTFV~1.EXE"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\ProgID]
    @="WordPad.Document.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\Verb\0]
    @="&Edit,0,2"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\¬ RÄ*\Verb\1]
    @="&Open,0,2"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(764)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    .
    - - - - - - - > 'explorer.exe'(3028)
    c:\windows\system32\WININET.dll
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVAST Software\Avast\AvastSvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\nvsvc32.exe
    c:\windows\system32\HPZipm12.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    c:\windows\system32\SearchIndexer.exe
    c:\windows\system32\wscntfy.exe
    c:\progra~1\MI3AA1~1\rapimgr.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\progra~1\HEWLET~1\Toolbox\STATUS~1\STATUS~1.EXE
    c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
    .
    **************************************************************************
    .
    Completion time: 2012-04-04 08:08:46 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-04-04 15:08
    .
    Pre-Run: 196,436,799,488 bytes free
    Post-Run: 197,149,462,528 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    .
    - - End Of File - - F09EFCBCA11157668011BDF839DA775D
     
  23. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Looks good :)

    How is computer doing?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\tasks\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  24. tcb

    tcb TS Rookie Topic Starter Posts: 25

    OTL.txt pt.1

    OTL logfile created on: 04/04/2012 1:24:36 PM - Run 1
    OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Staff\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    3.25 Gb Total Physical Memory | 2.52 Gb Available Physical Memory | 77.67% Memory free
    5.09 Gb Paging File | 4.44 Gb Available in Paging File | 87.23% Paging File free
    Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 232.76 Gb Total Space | 183.62 Gb Free Space | 78.89% Space Free | Partition Type: NTFS
    Drive R: | 439.35 Gb Total Space | 198.14 Gb Free Space | 45.10% Space Free | Partition Type: NTFS

    Computer Name: BRIAN7 | User Name: Staff | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2012/04/04 13:21:24 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\OTL.exe
    PRC - [2012/03/06 16:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
    PRC - [2012/03/06 16:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    PRC - [2012/03/06 13:12:43 | 000,020,572 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
    PRC - [2012/01/13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2012/01/13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    PRC - [2011/08/11 16:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
    PRC - [2010/12/08 14:15:44 | 000,063,360 | ---- | M] (DivX, LLC) -- C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
    PRC - [2008/06/11 22:43:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
    PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2008/02/26 08:57:28 | 000,128,296 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    PRC - [2008/01/11 17:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    PRC - [2007/10/03 13:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    PRC - [2007/10/03 13:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    PRC - [2007/06/20 12:30:18 | 000,079,168 | ---- | M] (Broadcom Corporation) -- C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    PRC - [2007/04/27 01:00:04 | 000,316,992 | ---- | M] (SafeNet, Inc.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
    PRC - [2005/03/24 13:56:50 | 000,151,552 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
    PRC - [2004/12/24 12:11:46 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe


    ========== Modules (No Company Name) ==========

    MOD - [2012/04/04 02:17:42 | 001,753,600 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12040400\algo.dll
    MOD - [2012/03/06 15:46:58 | 000,603,648 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\aswOtl.dll
    MOD - [2012/03/06 13:12:44 | 000,053,349 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\zip.dll
    MOD - [2012/03/06 13:12:44 | 000,053,342 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\verify.dll
    MOD - [2012/03/06 13:12:44 | 000,032,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\net.dll
    MOD - [2012/03/06 13:12:43 | 000,802,901 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\hotspot\jvm.dll
    MOD - [2012/03/06 13:12:43 | 000,094,308 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\java.dll
    MOD - [2012/03/06 13:12:43 | 000,028,776 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\hpi.dll
    MOD - [2012/03/06 13:12:43 | 000,020,572 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
    MOD - [2012/02/15 04:08:55 | 004,466,688 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessS#\d51f0b35218dc816047557157b02a021\Microsoft.BusinessSolutions.eCRM.OutlookAddIn.CSUtils.ni.dll
    MOD - [2012/02/15 04:08:52 | 001,712,128 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\96e485c02ad346a2bd26a635e7fcb023\Microsoft.VisualBasic.ni.dll
    MOD - [2012/02/15 04:08:49 | 000,391,168 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Iris.Mapi.MessageSt#\fe71c0e16e5455c18b4fb5159c1a5f21\Iris.Mapi.MessageStore.ni.dll
    MOD - [2012/02/15 04:08:48 | 000,462,336 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.BusinessS#\5e2cbf99fe0fed898a7ff726691dda9e\Microsoft.BusinessSolutions.eCRM.DataSync.ni.dll
    MOD - [2012/02/15 04:08:42 | 003,826,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\BusinessLayer\2c6c58f46fc8ef55e6040a8079c580bf\BusinessLayer.ni.dll
    MOD - [2012/02/15 04:08:37 | 001,039,872 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Interop.M#\e903729a000835294ec0320a38ed0228\Microsoft.Interop.Mapi.Impl.ni.dll
    MOD - [2012/02/15 04:08:36 | 001,526,272 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\BCMRes\2d7fb3ea2de5d4f1a8b27a4e8051ed33\BCMRes.ni.dll
    MOD - [2012/02/15 04:08:15 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\94a40f415bfa947e251888bbe88bb973\System.Configuration.ni.dll
    MOD - [2012/02/15 04:08:15 | 000,484,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\BCMCommon\d15f9a0db4361af008e88b6439902c1c\BCMCommon.ni.dll
    MOD - [2012/02/15 04:06:50 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\77e1279cbf4eecfb0284b63316fe43fe\System.Xml.ni.dll
    MOD - [2012/02/15 04:06:45 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ad99ac6b5666edb8ee742dd64f9578af\System.Windows.Forms.ni.dll
    MOD - [2012/02/15 04:06:35 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\9351cf29bb1ba951e45a9b3b0edab937\System.Drawing.ni.dll
    MOD - [2012/02/15 04:06:23 | 006,616,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\ae888f8633fce3ff1de98e32bce0abbf\System.Data.ni.dll
    MOD - [2012/02/15 04:05:27 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\9e3803cd2a11f056291862e306a8e2b2\System.ni.dll
    MOD - [2012/02/15 04:04:51 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
    MOD - [2012/02/15 04:04:41 | 000,069,120 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
    MOD - [2011/10/13 03:12:48 | 000,220,672 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\3e6deccf191ab943d3a0812a38ab5c97\CustomMarshalers.ni.dll
    MOD - [2011/10/13 03:11:55 | 000,014,336 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Extensibility\e0184e13eb92684dd8f3f166ab684d1e\Extensibility.ni.dll
    MOD - [2011/10/13 03:11:29 | 002,267,648 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\a8056c5d0c4c019bf426009d0f4a068b\Microsoft.Office.Interop.Outlook.ni.dll
    MOD - [2011/10/13 03:11:26 | 000,177,664 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Interop.M#\07021d10c3bc8a0ea378435a258f7b1b\Microsoft.Interop.Mapi.PropTags.ni.dll
    MOD - [2011/10/13 03:11:24 | 000,963,072 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\office\2f1af80313dae24293036e97653e1968\office.ni.dll
    MOD - [2011/10/13 03:11:24 | 000,044,032 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\stdole\095500d1130c8a84eaa3256a7c73926f\stdole.ni.dll
    MOD - [2011/10/13 03:11:23 | 000,062,976 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Interop.e#\00cc95b92fb21663d07f94e15cab3be0\Microsoft.Interop.eCRM.Ole.ni.dll
    MOD - [2011/10/13 03:11:22 | 000,152,064 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Interop.M#\daa68c80020eb582452ec3173450505d\Microsoft.Interop.Mapi.Interfaces.ni.dll
    MOD - [2011/10/13 03:06:23 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
    MOD - [2011/10/05 04:52:30 | 000,756,048 | ---- | M] () -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
    MOD - [2011/09/27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2011/09/27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    MOD - [2011/06/22 11:46:12 | 000,434,016 | ---- | M] () -- C:\Program Files\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
    MOD - [2010/03/15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
    MOD - [2009/05/20 20:27:34 | 000,981,968 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\Microsoft.BusinessSolutions.eCRM.OutlookAddIn\3.0.0.0__31bf3856ad364e35\Microsoft.BusinessSolutions.eCRM.OutlookAddIn.dll
    MOD - [2009/05/20 20:27:33 | 000,310,720 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\BCMCommon\3.0.0.0__31bf3856ad364e35\BCMCommon.dll
    MOD - [2009/02/26 13:46:56 | 000,064,344 | ---- | M] () -- C:\Program Files\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
    MOD - [2008/12/02 15:21:16 | 000,051,716 | ---- | M] () -- C:\WINDOWS\system32\pdf995mon.dll
    MOD - [2008/10/24 03:03:48 | 000,591,976 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\Microsoft.Interop.Mapi.Impl\3.0.0.0__31bf3856ad364e35\Microsoft.Interop.Mapi.Impl.dll
    MOD - [2008/06/11 22:32:28 | 002,666,496 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 9.0\PDFMaker\Common\AdobePDFMakerX.dll
    MOD - [2008/03/19 20:59:10 | 000,012,104 | ---- | M] () -- C:\Program Files\Microsoft Small Business\Business Contact Manager\en-US\Microsoft.Interop.Mapi.Interfaces.resources.dll
    MOD - [2008/03/19 20:58:50 | 000,064,328 | ---- | M] () -- C:\Program Files\Microsoft Small Business\Business Contact Manager\en-US\BusinessLayer.resources.dll
    MOD - [2008/01/11 17:50:32 | 000,529,512 | ---- | M] () -- C:\Program Files\Microsoft Small Business\Business Contact Manager\en-US\BCMRes.resources.dll
    MOD - [2004/08/20 06:02:52 | 000,102,400 | ---- | M] () -- C:\WINDOWS\system32\PMLJNI.dll
    MOD - [2003/06/16 14:52:48 | 000,074,752 | ---- | M] () -- C:\WINDOWS\system32\jst.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
    SRV - [2012/03/06 16:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2012/01/13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011/08/11 16:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
    SRV - [2009/06/25 09:18:51 | 000,074,360 | ---- | M] (Autodesk, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
    SRV - [2008/10/24 10:22:50 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2008/01/11 17:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
    SRV - [2007/10/03 13:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
    SRV - [2007/06/20 12:30:18 | 000,079,168 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe -- (ASFIPmon)
    SRV - [2007/04/27 01:00:04 | 000,316,992 | ---- | M] (SafeNet, Inc.) [Auto | Running] -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe -- (SentinelKeysServer)
    SRV - [2004/12/24 12:11:46 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Internet Explorer\SABProcEnum.sys -- (SABProcEnum)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
    DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
    DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOCUME~1\Staff\LOCALS~1\Temp\mbr.sys -- (mbr)
    DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
    DRV - File not found [File_System | Boot | Stopped] -- system32\DRIVERS\Lbd.sys -- (Lbd)
    DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
    DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2012/03/06 16:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
    DRV - [2012/03/06 16:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2012/03/06 16:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2012/03/06 16:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2012/03/06 16:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2012/03/06 16:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2012/03/06 15:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2012/02/16 11:41:32 | 000,045,136 | ---- | M] (MARX CryptoTech LP) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CBUSB.sys -- (CBUSB)
    DRV - [2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2011/07/22 09:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
    DRV - [2011/07/12 14:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
    DRV - [2008/08/21 23:49:58 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)
    DRV - [2008/08/21 23:49:22 | 000,018,688 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)
    DRV - [2007/09/11 17:23:54 | 000,161,792 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
    DRV - [2007/09/11 16:58:28 | 000,392,960 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)
    DRV - [2007/06/20 12:30:20 | 000,010,480 | ---- | M] (Broadcom Corporation) [Kernel | Auto | Running] -- C:\Program Files\Broadcom\ASFIPMon\BASFND.sys -- (BASFND)
    DRV - [2007/06/18 20:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motport.sys -- (motport)
    DRV - [2007/06/18 20:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
    DRV - [2007/04/27 07:40:00 | 000,090,688 | ---- | M] (SafeNet, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\sentinel.sys -- (Sentinel)
    DRV - [2007/04/27 07:40:00 | 000,035,328 | ---- | M] (SafeNet, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS -- (SNTNLUSB)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ca/ig/dell?hl=en&client=dell-row-rel&channel=ca&ibd=2081013
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.ca/ig/dell?hl=en&client=dell-row-rel&channel=ca&ibd=2081013
    IE - HKLM\..\SearchScopes,DefaultScope = {6443CA84-FBBE-46BA-81F3-B23BD6570D42}
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
    IE - HKLM\..\SearchScopes\{6443CA84-FBBE-46BA-81F3-B23BD6570D42}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7


    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.ca/ig/dell?hl=en&client=dell-row-rel&channel=ca&ibd=2081013
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.ca/ig/dell?hl=en&client=dell-row-rel&channel=ca&ibd=2081013
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://brian100/PIMARC/PIMARC_login.htm
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\..\SearchScopes,DefaultScope = {6443CA84-FBBE-46BA-81F3-B23BD6570D42}
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\..\SearchScopes\{5B3EEDA7-80AF-4DC9-9EF6-E4DA688BD72E}: "URL" = http://twitter.com/search?q={searchTerms}
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\..\SearchScopes\{6443CA84-FBBE-46BA-81F3-B23BD6570D42}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_en
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\..\SearchScopes\{BBCA473A-D9C0-4BD5-8C96-D51AB6B0E0E6}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\..\SearchScopes\{C61E59AD-ED22-4D6F-ADB9-E088092B809E}: "URL" = http://www.facebook.com/search/?q={searchTerms}&init=quick
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.update: false
    FF - prefs.js..browser.startup.homepage: "http://www.google.ca/"
    FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
    FF - prefs.js..extensions.enabledItems: en-CA@dictionaries.addons.mozilla.org:1.1.5
    FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900
    FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
    FF - prefs.js..extensions.enabledItems: fastbid@bxwa.com:2.15.3.0
    FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - user.js - File not found

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2010/12/22 10:06:43 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2010/12/22 10:06:43 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/03/30 12:54:11 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/30 10:35:01 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/21 09:40:04 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\

    [2008/10/24 08:11:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Staff\Application Data\Mozilla\Extensions
    [2012/03/30 10:36:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Profiles\q1hpcp3c.default\extensions
    [2011/05/02 08:50:50 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Profiles\q1hpcp3c.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
    [2012/03/15 11:53:14 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Profiles\q1hpcp3c.default\extensions\2020Player_IKEA@2020Technologies.com
    [2012/03/30 10:36:13 | 000,000,000 | ---D | M] (Canadian English Dictionary) -- C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Profiles\q1hpcp3c.default\extensions\en-CA@dictionaries.addons.mozilla.org
    [2011/11/25 11:29:01 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Profiles\q1hpcp3c.default\extensions\en-US@dictionaries.addons.mozilla.org
    [2009/03/23 14:00:03 | 000,000,000 | ---D | M] (FastBid Image Viewer) -- C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Profiles\q1hpcp3c.default\extensions\fastbid@bxwa.com
    [2012/03/30 10:35:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2012/03/12 21:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2011/02/02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
    [2008/12/16 05:32:42 | 004,796,416 | ---- | M] (Lizardtech Software) -- C:\Program Files\mozilla firefox\plugins\npexview.dll
    [2012/03/12 21:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2012/03/12 21:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)
    CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:eek:riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
    CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
    CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.142\ppGoogleNaClPluginChrome.dll
    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.142\pdf.dll
    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.142\gcswf32.dll
    CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
    CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
    CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
    CHR - plugin: Express View (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npexview.dll
    CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
    CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
    CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
    CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
    CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
    CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
    CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
    CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
    CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
    CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
    CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
    CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
    CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
    CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
    CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
    CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
    CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
    CHR - Extension: YouTube = C:\Documents and Settings\Staff\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
    CHR - Extension: Google Search = C:\Documents and Settings\Staff\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
    CHR - Extension: DivX HiQ = C:\Documents and Settings\Staff\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0\
    CHR - Extension: avast! WebRep = C:\Documents and Settings\Staff\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
    CHR - Extension: Gmail = C:\Documents and Settings\Staff\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\

    O1 HOSTS File: ([2012/04/04 08:03:22 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
    O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
    O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
    O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    O3 - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
    O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
    O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [DivX Download Manager] C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC)
    O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
    O4 - HKLM..\Run: [ECenter] C:\dell\E-Center\EULALauncher.exe ( )
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
    O4 - HKLM..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe (Hewlett-Packard)
    O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-18..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe (Autodesk, Inc)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\Software\Policies\Microsoft\Internet Explorer\Recovery present
    O7 - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-3331653302-3704506128-413106975-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
    O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Google Sidewiki... - Reg Error: Value error. File not found
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1224799319011 (WUWebControl Class)
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C0DD9B08-2BC9-4A2C-A2A8-F2F2157AB2EB}: DhcpNameServer = 75.153.176.9 75.153.176.1
    O18 - Protocol\Handler\jpip {B92DD248-E3D5-4A92-B311-C9B841681455} - C:\Program Files\LizardTech\Express View\expressview.dll (Lizardtech Software)
    O18 - Protocol\Handler\sidlet {B92DD248-E3D5-4A92-B311-C9B841681455} - C:\Program Files\LizardTech\Express View\expressview.dll (Lizardtech Software)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
    O24 - Desktop Components:0 () - file:///C:/DOCUME~1/Staff/LOCALS~1/Temp/msohtmlclip1/01/clip_image001.gif
    O24 - Desktop Components:1 (My Current Home Page) - About:Home
    O24 - Desktop WallPaper: C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Desktop Background.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Staff\Application Data\Mozilla\Firefox\Desktop Background.bmp
    O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
    O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/08/11 15:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2007/05/15 21:55:20 | 000,000,000 | ---D | M] - R:\autodesk -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point
     
  25. tcb

    tcb TS Rookie Topic Starter Posts: 25

    OTL.txt pt2

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/04/04 13:21:48 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\OTL.exe
    [2012/04/04 08:30:03 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2012/04/04 07:53:21 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2012/04/04 07:50:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2012/04/04 07:50:45 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2012/04/04 07:50:45 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2012/04/04 07:50:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2012/04/04 07:50:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2012/04/04 07:50:37 | 000,000,000 | ---D | C] -- C:\ComboFix
    [2012/04/04 07:50:34 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/04/04 07:50:15 | 004,456,875 | R--- | C] (Swearware) -- C:\Documents and Settings\Staff\Desktop\ComboFix.exe
    [2012/04/03 15:40:51 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
    [2012/04/03 15:35:14 | 000,083,968 | ---- | C] (Esage Lab) -- C:\Documents and Settings\Staff\Desktop\boot_cleaner.exe
    [2012/04/03 15:32:15 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Staff\Desktop\aswMBR.exe
    [2012/04/03 08:57:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Staff\Local Settings\Application Data\NPE
    [2012/04/03 08:57:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Norton
    [2012/04/03 08:57:44 | 002,804,712 | ---- | C] (Symantec Corporation) -- C:\Documents and Settings\Staff\Desktop\NPE.exe
    [2012/04/03 08:12:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
    [2012/03/30 13:28:37 | 000,337,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2012/03/30 13:28:37 | 000,020,696 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2012/03/30 13:28:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
    [2012/03/30 13:28:36 | 000,053,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2012/03/30 13:28:36 | 000,035,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2012/03/30 13:28:35 | 000,612,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
    [2012/03/30 13:28:35 | 000,095,704 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2012/03/30 13:28:35 | 000,089,048 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2012/03/30 13:15:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
    [2012/03/30 12:54:28 | 000,024,920 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2012/03/30 12:54:05 | 000,041,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2012/03/30 12:54:04 | 000,201,352 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2012/03/30 12:53:50 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
    [2012/03/30 12:53:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
    [2012/03/30 12:50:32 | 000,646,656 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\OTS.exe
    [2012/03/30 12:45:48 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
    [2012/03/30 12:45:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Staff\Start Menu\Programs\HiJackThis
    [2012/03/30 11:44:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2012/03/30 11:44:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2012/03/30 11:44:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2012/03/30 11:06:11 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Staff\Start Menu\Programs\Administrative Tools
    [2012/03/30 10:51:52 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Staff\Desktop\dds.scr
    [2012/03/30 10:15:21 | 000,447,208 | ---- | C] (BitDefender) -- C:\WINDOWS\System32\drivers\avckf.sys
    [2012/03/30 10:13:45 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
    [2012/03/30 10:13:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    [2012/03/30 08:49:35 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
    [2012/03/29 15:49:16 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\TFC.exe
    [2012/03/29 15:33:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Staff\Application Data\SUPERAntiSpyware.com
    [2012/03/29 15:33:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
    [2012/03/29 15:33:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    [2012/03/29 15:33:08 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
    [2012/03/29 14:41:05 | 002,068,016 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Staff\Desktop\bca.com
    [2012/03/29 11:24:54 | 000,389,024 | ---- | C] (Bleeping Computer, LLC) -- C:\Documents and Settings\Staff\Desktop\unhide.exe
    [2012/03/29 11:22:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Staff\Application Data\Malwarebytes
    [2012/03/29 11:22:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2012/03/29 11:13:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\BDLogging
    [2012/03/29 11:10:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Bitdefender 2012
    [2012/03/29 11:03:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Staff\Application Data\QuickScan
    [2012/03/29 11:00:56 | 000,000,000 | ---D | C] -- C:\Program Files\Bitdefender
    [2012/03/29 10:59:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender
    [2012/03/29 09:34:25 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Staff\Recent
    [2012/03/26 14:51:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
    [2012/03/26 14:50:49 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
    [2012/03/26 14:50:44 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
    [2012/03/26 14:47:05 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
    [2012/03/13 13:34:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Staff\Desktop\Trooper
    [2012/03/06 13:31:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Staff\Local Settings\Application Data\HP
    [2012/03/06 13:12:35 | 000,000,000 | ---D | C] -- C:\Program Files\Zero G Registry
    [2012/03/06 13:08:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\HP
    [2012/03/06 13:08:19 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard
    [2012/03/06 13:08:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Hewlett-Packard
    [2012/03/06 13:01:17 | 000,098,304 | R--- | C] (Hewlett Packard Company) -- C:\WINDOWS\System32\hpzjsn01.dll
    [2012/03/06 13:01:14 | 000,073,728 | R--- | C] (Hewlett Packard) -- C:\WINDOWS\System32\hptcpmib.dll
    [2012/03/06 13:01:11 | 000,110,592 | R--- | C] (Hewlett Packard) -- C:\WINDOWS\System32\hptcpmon.dll
    [2012/03/06 12:58:45 | 000,000,000 | ---D | C] -- C:\Temp
    [2012/03/06 12:57:36 | 000,000,000 | ---D | C] -- C:\Program Files\HP
    [2012/03/06 12:56:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SWF Studio

    ========== Files - Modified Within 30 Days ==========

    [2012/04/04 13:21:24 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\OTL.exe
    [2012/04/04 13:05:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2012/04/04 08:56:05 | 000,530,252 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2012/04/04 08:56:05 | 000,105,116 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2012/04/04 08:03:22 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2012/04/04 08:03:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2012/04/04 08:03:06 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2012/04/04 08:01:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2012/04/04 08:01:36 | 3487,158,272 | -HS- | M] () -- C:\hiberfil.sys
    [2012/04/04 07:53:28 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2012/04/04 07:44:06 | 004,456,875 | R--- | M] (Swearware) -- C:\Documents and Settings\Staff\Desktop\ComboFix.exe
    [2012/04/03 16:15:58 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\MBR.dat
    [2012/04/03 15:59:01 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Staff\Desktop\dds.scr
    [2012/04/03 15:34:33 | 000,044,607 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\bootkit_remover.zip
    [2012/04/03 15:32:35 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Staff\Desktop\aswMBR.exe
    [2012/04/03 14:17:00 | 000,035,001 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\120322_HWM_SPEA_2227LakePlacidRd.DWG
    [2012/04/03 11:35:22 | 000,268,130 | ---- | M] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\census.cache
    [2012/04/03 11:35:18 | 000,203,136 | ---- | M] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\ars.cache
    [2012/04/03 11:24:58 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\housecall.guid.cache
    [2012/04/03 09:05:09 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2012/04/02 09:42:01 | 000,001,791 | ---- | M] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2012/03/31 23:29:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2012/03/30 13:28:37 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2012/03/30 13:28:35 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2012/03/30 13:15:00 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2012/03/30 12:50:37 | 000,646,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\OTS.exe
    [2012/03/30 12:45:55 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\HiJackThis.lnk
    [2012/03/30 12:19:34 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\8wo4wnvu.exe
    [2012/03/30 11:44:42 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/03/30 11:05:57 | 000,101,920 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1333130424.bdinstall.bin
    [2012/03/30 10:35:04 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2012/03/30 10:35:04 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2012/03/30 10:15:21 | 000,447,208 | ---- | M] (BitDefender) -- C:\WINDOWS\System32\drivers\avckf.sys
    [2012/03/30 10:00:36 | 000,256,843 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1333125710.bdinstall.bin
    [2012/03/30 09:55:27 | 000,000,239 | ---- | M] () -- C:\WINDOWS\System32\checkdnsid.xml
    [2012/03/30 09:38:50 | 000,239,271 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1333124823.bdinstall.bin
    [2012/03/29 15:49:17 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\TFC.exe
    [2012/03/29 15:33:10 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
    [2012/03/29 15:19:13 | 001,008,141 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\rkill.com
    [2012/03/29 14:51:54 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2012/03/29 14:31:06 | 000,000,385 | ---- | M] () -- C:\WINDOWS\System32\user_gensett.xml
    [2012/03/29 11:24:54 | 000,389,024 | ---- | M] (Bleeping Computer, LLC) -- C:\Documents and Settings\Staff\Desktop\unhide.exe
    [2012/03/29 11:15:01 | 000,329,753 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1333044001.bdinstall.bin
    [2012/03/29 11:11:50 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_avchv_01009.Wdf
    [2012/03/29 11:11:48 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
    [2012/03/29 11:11:45 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2012/03/29 10:09:52 | 002,804,712 | ---- | M] (Symantec Corporation) -- C:\Documents and Settings\Staff\Desktop\NPE.exe
    [2012/03/29 08:57:28 | 000,000,882 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20120330-104620.backup
    [2012/03/26 14:58:06 | 000,407,104 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2012/03/26 14:51:41 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2012/03/26 13:41:12 | 002,068,016 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Staff\Desktop\bca.com
    [2012/03/21 13:07:44 | 000,189,565 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\or_us101.gpx
    [2012/03/20 09:09:24 | 000,000,059 | ---- | M] () -- C:\WINDOWS\wpd99.drv
    [2012/03/20 09:03:34 | 000,001,736 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 9 Pro.lnk
    [2012/03/12 15:47:59 | 001,168,051 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\A1 site plan OCT 13 2011.jpg
    [2012/03/12 15:30:38 | 001,455,762 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\A2 foundation & roof plan JAN 26 2012.jpg
    [2012/03/12 12:54:41 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
    [2012/03/06 16:15:19 | 000,041,184 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2012/03/06 16:15:14 | 000,201,352 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2012/03/06 16:03:51 | 000,612,184 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
    [2012/03/06 16:03:38 | 000,337,880 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2012/03/06 16:02:00 | 000,035,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2012/03/06 16:01:53 | 000,053,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2012/03/06 16:01:39 | 000,095,704 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2012/03/06 16:01:35 | 000,089,048 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2012/03/06 16:01:30 | 000,020,696 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2012/03/06 15:58:29 | 000,024,920 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2012/03/06 13:41:09 | 000,053,974 | ---- | M] () -- C:\WINDOWS\hppins01.dat
    [2012/03/06 13:31:04 | 000,000,128 | ---- | M] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\fusioncache.dat
    [2012/03/06 13:01:34 | 000,000,134 | ---- | M] () -- C:\WINDOWS\System32\AddPort.ini
    [2012/03/06 13:01:06 | 000,000,964 | ---- | M] () -- C:\WINDOWS\hpntwksetup.ini

    ========== Files Created - No Company Name ==========

    [2012/04/04 07:53:28 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2012/04/04 07:53:24 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2012/04/04 07:50:45 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2012/04/04 07:50:45 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2012/04/04 07:50:45 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2012/04/04 07:50:45 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2012/04/04 07:50:45 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2012/04/03 16:00:07 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\MBR.dat
    [2012/04/03 15:34:32 | 000,044,607 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\bootkit_remover.zip
    [2012/04/03 14:17:00 | 000,035,001 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\120322_HWM_SPEA_2227LakePlacidRd.DWG
    [2012/04/03 11:35:22 | 000,268,130 | ---- | C] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\census.cache
    [2012/04/03 11:35:18 | 000,203,136 | ---- | C] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\ars.cache
    [2012/04/03 11:24:58 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\housecall.guid.cache
    [2012/04/03 11:13:06 | 3487,158,272 | -HS- | C] () -- C:\hiberfil.sys
    [2012/03/30 13:15:00 | 000,001,813 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2012/03/30 13:15:00 | 000,001,791 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2012/03/30 12:54:31 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2012/03/30 12:45:48 | 000,002,447 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\HiJackThis.lnk
    [2012/03/30 12:19:34 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\8wo4wnvu.exe
    [2012/03/30 11:44:42 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/03/30 11:05:57 | 000,101,920 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1333130424.bdinstall.bin
    [2012/03/30 10:35:04 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2012/03/30 10:35:04 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
    [2012/03/30 10:35:04 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2012/03/30 10:00:36 | 000,256,843 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1333125710.bdinstall.bin
    [2012/03/30 09:38:50 | 000,239,271 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1333124823.bdinstall.bin
    [2012/03/29 15:33:10 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
    [2012/03/29 15:26:03 | 001,008,141 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\rkill.com
    [2012/03/29 14:42:11 | 000,002,477 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\StarNet Converter.lnk
    [2012/03/29 14:42:11 | 000,001,947 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
    [2012/03/29 14:42:11 | 000,001,925 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Earth.lnk
    [2012/03/29 14:42:11 | 000,001,905 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Quantum GIS (1.7.3).lnk
    [2012/03/29 14:42:11 | 000,001,853 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\LEICA Geo Office Combined.lnk
    [2012/03/29 14:42:11 | 000,001,803 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Search.lnk
    [2012/03/29 14:42:11 | 000,001,787 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
    [2012/03/29 14:42:11 | 000,001,736 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 9 Pro.lnk
    [2012/03/29 14:42:11 | 000,001,709 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\PointCloud CAD 2010.lnk
    [2012/03/29 14:42:11 | 000,001,576 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\TextPad.lnk
    [2012/03/29 14:42:11 | 000,001,554 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
    [2012/03/29 14:42:11 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2012/03/29 14:42:11 | 000,001,541 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\MicroSurvey CAD 2010.lnk
    [2012/03/29 14:42:11 | 000,001,493 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Explorer.lnk
    [2012/03/29 14:42:11 | 000,000,831 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\TPS1200 Simulation.lnk
    [2012/03/29 14:42:11 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2012/03/29 14:42:11 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
    [2012/03/29 14:42:11 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
    [2012/03/29 14:42:11 | 000,000,777 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
    [2012/03/29 14:42:11 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
    [2012/03/29 14:42:11 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
    [2012/03/29 14:42:11 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
    [2012/03/29 14:42:10 | 000,001,890 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
    [2012/03/29 14:42:10 | 000,001,717 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\PowerDVD DX.lnk
    [2012/03/29 14:42:10 | 000,000,818 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Paint.NET.lnk
    [2012/03/29 14:42:09 | 000,002,209 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft ActiveSync.lnk
    [2012/03/29 14:42:07 | 000,000,622 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\EasyGPS.lnk
    [2012/03/29 14:42:06 | 000,002,371 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Acrobat Distiller 9.lnk
    [2012/03/29 14:42:06 | 000,002,317 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk
    [2012/03/29 14:42:06 | 000,002,311 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 9.lnk
    [2012/03/29 14:42:06 | 000,001,880 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk
    [2012/03/29 14:42:06 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
    [2012/03/29 14:42:06 | 000,000,740 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Acrobat.com.lnk
    [2012/03/29 14:31:06 | 000,000,385 | ---- | C] () -- C:\WINDOWS\System32\user_gensett.xml
    [2012/03/29 11:28:06 | 000,000,239 | ---- | C] () -- C:\WINDOWS\System32\checkdnsid.xml
    [2012/03/29 11:15:00 | 000,329,753 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1333044001.bdinstall.bin
    [2012/03/29 11:11:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_avchv_01009.Wdf
    [2012/03/29 11:11:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
    [2012/03/21 13:07:43 | 000,189,565 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\or_us101.gpx
    [2012/03/12 15:47:53 | 001,168,051 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\A1 site plan OCT 13 2011.jpg
    [2012/03/12 15:30:31 | 001,455,762 | ---- | C] () -- C:\Documents and Settings\Staff\Desktop\A2 foundation & roof plan JAN 26 2012.jpg
    [2012/03/06 13:31:04 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Staff\Local Settings\Application Data\fusioncache.dat
    [2012/03/06 13:13:14 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\PMLJNI.dll
    [2012/03/06 13:13:14 | 000,074,752 | ---- | C] () -- C:\WINDOWS\System32\jst.dll
    [2012/03/06 13:13:14 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\compJNI.dll
    [2012/03/06 13:01:34 | 000,000,134 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
    [2012/03/06 13:01:33 | 000,003,399 | R--- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
    [2012/03/06 13:00:26 | 000,000,964 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
    [2012/03/06 12:56:20 | 000,053,974 | ---- | C] () -- C:\WINDOWS\hppins01.dat
    [2012/03/06 12:56:20 | 000,002,392 | ---- | C] () -- C:\WINDOWS\hppmdl01.dat
    [2012/02/14 22:35:01 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
    [2010/05/06 08:36:16 | 000,000,469 | ---- | C] () -- C:\WINDOWS\System32\gmsblist.dll

    ========== LOP Check ==========

    [2008/10/23 15:42:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\MicroSurvey
    [2009/06/25 09:16:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
    [2012/03/30 12:53:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
    [2009/12/04 12:01:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
    [2012/03/29 11:13:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BDLogging
    [2008/10/24 09:13:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LEICA Geosystems
    [2012/02/22 11:11:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MicroSurvey
    [2009/05/20 15:19:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MicroSurvey Software Inc
    [2012/03/20 09:09:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995
    [2011/06/22 10:02:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ZoneFiveSoftware
    [2011/08/31 12:28:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2009/06/25 09:22:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\Autodesk
    [2012/01/19 10:24:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\Azureus
    [2011/05/02 08:51:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\GARMIN
    [2011/06/22 10:02:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\GPS Utility
    [2010/05/06 08:59:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\gsak
    [2008/11/27 15:31:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\Helios
    [2012/03/29 14:50:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\i2k Quickage
    [2012/02/16 11:42:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\MicroSurvey
    [2010/09/14 10:14:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\OxelonMC
    [2008/12/02 15:23:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\pdf995
    [2012/03/29 11:03:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\QuickScan
    [2012/02/16 10:14:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\Shape2Earth
    [2011/03/21 15:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\Windows Desktop Search
    [2008/10/29 14:44:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Staff\Application Data\Windows Search

    ========== Purity Check ==========



    ========== Custom Scans ==========

    < %SYSTEMDRIVE%\*.* >
    [2010/10/14 13:52:16 | 000,040,540 | ---- | M] () -- C:\aaw7boot.log
    [2004/08/11 15:15:00 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2012/03/30 11:03:34 | 000,006,053 | ---- | M] () -- C:\bdlog.txt
    [2012/04/03 09:05:09 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2012/04/04 07:53:28 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2012/04/04 08:08:46 | 000,020,958 | ---- | M] () -- C:\ComboFix.txt
    [2004/08/11 15:15:00 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2008/10/13 10:34:22 | 000,007,156 | R--- | M] () -- C:\dell.sdr
    [2012/04/04 08:01:36 | 3487,158,272 | -HS- | M] () -- C:\hiberfil.sys
    [2008/10/23 15:24:13 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
    [2004/08/11 15:15:00 | 000,000,000 | ---- | M] () -- C:\IO.SYS
    [2008/10/24 09:32:53 | 000,000,596 | ---- | M] () -- C:\LeicaOfficeDatabaseProfile.ini
    [2004/08/11 15:15:00 | 000,000,000 | ---- | M] () -- C:\MSDOS.SYS
    [2004/08/04 03:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2009/01/26 17:04:55 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2012/04/04 08:01:30 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
    [2012/04/03 13:47:18 | 000,000,339 | ---- | M] () -- C:\rkill.log
    [2009/07/08 12:37:51 | 000,000,232 | ---- | M] () -- C:\sqmdata00.sqm
    [2009/07/08 12:37:53 | 000,000,232 | ---- | M] () -- C:\sqmdata01.sqm
    [2009/07/08 12:37:55 | 000,000,232 | ---- | M] () -- C:\sqmdata02.sqm
    [2009/07/08 12:37:56 | 000,000,232 | ---- | M] () -- C:\sqmdata03.sqm
    [2009/07/08 12:37:58 | 000,000,232 | ---- | M] () -- C:\sqmdata04.sqm
    [2009/07/08 12:38:00 | 000,000,232 | ---- | M] () -- C:\sqmdata05.sqm
    [2009/07/08 12:38:02 | 000,000,232 | ---- | M] () -- C:\sqmdata06.sqm
    [2009/07/08 12:38:03 | 000,000,232 | ---- | M] () -- C:\sqmdata07.sqm
    [2009/07/08 12:38:06 | 000,000,232 | ---- | M] () -- C:\sqmdata08.sqm
    [2009/07/08 12:38:08 | 000,000,232 | ---- | M] () -- C:\sqmdata09.sqm
    [2009/07/08 12:38:10 | 000,000,232 | ---- | M] () -- C:\sqmdata10.sqm
    [2009/07/08 12:38:12 | 000,000,232 | ---- | M] () -- C:\sqmdata11.sqm
    [2009/07/08 12:38:14 | 000,000,232 | ---- | M] () -- C:\sqmdata12.sqm
    [2009/07/08 12:38:15 | 000,000,232 | ---- | M] () -- C:\sqmdata13.sqm
    [2009/07/08 12:38:17 | 000,000,232 | ---- | M] () -- C:\sqmdata14.sqm
    [2009/07/08 12:38:18 | 000,000,232 | ---- | M] () -- C:\sqmdata15.sqm
    [2009/07/08 12:38:20 | 000,000,232 | ---- | M] () -- C:\sqmdata16.sqm
    [2009/07/08 12:38:22 | 000,000,232 | ---- | M] () -- C:\sqmdata17.sqm
    [2009/07/08 12:38:25 | 000,000,232 | ---- | M] () -- C:\sqmdata18.sqm
    [2009/07/08 12:38:28 | 000,000,232 | ---- | M] () -- C:\sqmdata19.sqm
    [2009/07/08 12:37:51 | 000,000,244 | ---- | M] () -- C:\sqmnoopt00.sqm
    [2009/07/08 12:37:53 | 000,000,244 | ---- | M] () -- C:\sqmnoopt01.sqm
    [2009/07/08 12:37:55 | 000,000,244 | ---- | M] () -- C:\sqmnoopt02.sqm
    [2009/07/08 12:37:56 | 000,000,244 | ---- | M] () -- C:\sqmnoopt03.sqm
    [2009/07/08 12:37:58 | 000,000,244 | ---- | M] () -- C:\sqmnoopt04.sqm
    [2009/07/08 12:38:00 | 000,000,244 | ---- | M] () -- C:\sqmnoopt05.sqm
    [2009/07/08 12:38:02 | 000,000,244 | ---- | M] () -- C:\sqmnoopt06.sqm
    [2009/07/08 12:38:03 | 000,000,244 | ---- | M] () -- C:\sqmnoopt07.sqm
    [2009/07/08 12:38:06 | 000,000,244 | ---- | M] () -- C:\sqmnoopt08.sqm
    [2009/07/08 12:38:08 | 000,000,244 | ---- | M] () -- C:\sqmnoopt09.sqm
    [2009/07/08 12:38:10 | 000,000,244 | ---- | M] () -- C:\sqmnoopt10.sqm
    [2009/07/08 12:38:12 | 000,000,244 | ---- | M] () -- C:\sqmnoopt11.sqm
    [2009/07/08 12:38:14 | 000,000,244 | ---- | M] () -- C:\sqmnoopt12.sqm
    [2009/07/08 12:38:15 | 000,000,244 | ---- | M] () -- C:\sqmnoopt13.sqm
    [2009/07/08 12:38:17 | 000,000,244 | ---- | M] () -- C:\sqmnoopt14.sqm
    [2009/07/08 12:38:18 | 000,000,244 | ---- | M] () -- C:\sqmnoopt15.sqm
    [2009/07/08 12:38:20 | 000,000,244 | ---- | M] () -- C:\sqmnoopt16.sqm
    [2009/07/08 12:38:22 | 000,000,244 | ---- | M] () -- C:\sqmnoopt17.sqm
    [2009/07/08 12:38:25 | 000,000,244 | ---- | M] () -- C:\sqmnoopt18.sqm
    [2009/07/08 12:38:28 | 000,000,244 | ---- | M] () -- C:\sqmnoopt19.sqm
    [2012/04/03 15:41:07 | 000,102,946 | ---- | M] () -- C:\TDSSKiller.2.7.25.0_03.04.2012_15.40.15_log.txt

    < %systemroot%\Fonts\*.com >
    [2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/08/11 15:14:22 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2004/05/13 13:40:56 | 000,051,712 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\HPZPP034.DLL
    [2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2012/03/06 16:15:19 | 000,041,184 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004/08/11 15:06:14 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
    [2004/08/11 15:06:14 | 000,659,456 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
    [2004/08/11 15:06:14 | 000,876,544 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2009/01/26 17:08:48 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/01/26 17:21:47 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2004/08/11 15:20:42 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Staff\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2012/03/30 12:19:34 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Staff\Desktop\8wo4wnvu.exe
    [2012/04/03 15:32:35 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Staff\Desktop\aswMBR.exe
    [2011/09/20 03:02:40 | 000,083,968 | ---- | M] (Esage Lab) -- C:\Documents and Settings\Staff\Desktop\boot_cleaner.exe
    [2012/04/04 07:44:06 | 004,456,875 | R--- | M] (Swearware) -- C:\Documents and Settings\Staff\Desktop\ComboFix.exe
    [2012/03/29 10:09:52 | 002,804,712 | ---- | M] (Symantec Corporation) -- C:\Documents and Settings\Staff\Desktop\NPE.exe
    [2012/04/04 13:21:24 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\OTL.exe
    [2012/03/30 12:50:37 | 000,646,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\OTS.exe
    [2012/03/29 15:49:17 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Staff\Desktop\TFC.exe
    [2012/03/29 11:24:54 | 000,389,024 | ---- | M] (Bleeping Computer, LLC) -- C:\Documents and Settings\Staff\Desktop\unhide.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\tasks\*.* >
    [2012/03/31 23:29:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2004/08/04 03:00:00 | 000,000,065 | R--- | M] () -- C:\WINDOWS\tasks\desktop.ini
    [2012/04/04 08:03:06 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2012/04/04 13:05:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2012/04/04 08:01:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2004/08/04 03:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2009/01/26 17:21:47 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Staff\Favorites\Desktop.ini
    [2012/04/03 11:18:45 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Staff\Favorites\Search Results.lnk

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2012/04/04 13:24:25 | 000,212,992 | ---- | M] () -- C:\Documents and Settings\Staff\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 17:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/03 23:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/03 23:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 07:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 10:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 17:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/03 23:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/03 23:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/03 23:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/03 23:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/03 23:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

    < End of report >
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...