TechSpot

Can't install XP Service Pack 3 on old computer

Solved
By NorGitram
Nov 26, 2010
Topic Status:
Not open for further replies.
  1. I get this error message

    ---------------------------
    Service Pack 3 Setup Error
    ---------------------------
    The file c:\windows\system32\ntdll.dll is open or in use by another application.

    Close all other applications and then click Retry.
    ---------------------------
    Retry Cancel
    ---------------------------
    Logs

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 5191

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 8.0.6001.18702

    11/26/2010 3:23:02 AM
    mbam-log-2010-11-26 (03-23-02).txt

    Scan type: Quick scan
    Objects scanned: 132391
    Time elapsed: 7 minute(s), 23 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2010-11-26 03:31:11
    Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0 MAXTOR_6 rev.A93.
    Running: 22edji9z.exe; Driver: C:\DOCUME~1\Ron\LOCALS~1\Temp\fwldypow.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs PQV2i.sys (StorageCraft Volume Snap-Shot/StorageCraft)
    AttachedDevice \FileSystem\Fastfat \Fat PQV2i.sys (StorageCraft Volume Snap-Shot/StorageCraft)

    ---- EOF - GMER 1.0.15 ----


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-11-26.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 10/31/2004 2:24:00 PM
    System Uptime: 11/26/2010 3:24:27 AM (0 hours ago)

    Motherboard: Shuttle Inc | | FN41SP
    Processor: AMD Athlon(tm) XP 1500+ | Socket A | 1293/100mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 29 GiB total, 20.377 GiB free.
    D: is FIXED (NTFS) - 45 GiB total, 32.226 GiB free.
    E: is CDROM (UDF)

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP268: 11/25/2010 9:31:58 AM - Revo Uninstaller's restore point - PayPal Plug-In
    RP269: 11/25/2010 9:32:21 AM - Removed PayPal Plug-In
    RP270: 11/25/2010 9:33:23 AM - Revo Uninstaller's restore point - Documents To Go
    RP271: 11/25/2010 9:33:44 AM - Removed Documents To Go
    RP272: 11/25/2010 9:35:28 AM - Revo Uninstaller's restore point - Combat Mission Afrika Korps
    RP273: 11/25/2010 9:37:22 AM - Revo Uninstaller's restore point - Motorola Phone Tools
    RP274: 11/25/2010 9:37:33 AM - Removed Motorola Phone Tools
    RP275: 11/25/2010 9:37:36 AM - Removed Motorola Phone Tools
    RP276: 11/25/2010 9:37:39 AM - Removed Motorola Phone Tools
    RP277: 11/25/2010 9:38:45 AM - Revo Uninstaller's restore point - Tweak-SE plug-in for Ad-Aware SE
    RP278: 11/25/2010 9:39:15 AM - Revo Uninstaller's restore point - Ad-Aware SE Personal
    RP279: 11/25/2010 9:40:28 AM - Revo Uninstaller's restore point - Messenger-Control plug-in for Ad-Aware SE
    RP280: 11/25/2010 9:41:12 AM - Revo Uninstaller's restore point - OE/W Messengerctrl plug-in for Ad-Aware SE
    RP281: 11/25/2010 9:41:39 AM - Revo Uninstaller's restore point - Palm
    RP282: 11/25/2010 9:41:55 AM - Removed Palm
    RP283: 11/25/2010 9:42:48 AM - Revo Uninstaller's restore point - VX2 Cleaner plug-in for Ad-Aware SE
    RP284: 11/25/2010 9:43:41 AM - Revo Uninstaller's restore point - Spybot - Search & Destroy 1.4

    ==== Installed Programs ======================

    7-Zip 4.64
    ACDSee Pro 2.5
    ACDSee RAW Image Decoder Plug-In Update 4.0
    Adaptec UDF Reader
    Adobe Flash Player 10 Plugin
    Adobe Reader 7.0.7
    Apple Software Update
    CCleaner
    Cda Product Service - shared component
    Diskeeper Professional Edition
    FileBox eXtender
    Garmin City Navigator North America v8
    Garmin MapSource
    Garmin Trip and Waypoint Manager v3
    GeoBuddy 3.0
    Google Chrome
    Google Earth
    Google Toolbar for Internet Explorer
    Google Update Helper
    Google Updater
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB981793)
    Icon Restore 1.0
    IrfanView (remove only)
    J2SE Runtime Environment 5.0 Update 6
    Java Auto Updater
    Java(TM) 6 Update 2
    Java(TM) 6 Update 22
    Linksys PrintServer Driver
    Macromedia Flash Player 8
    Magical Jelly Bean KeyFinder
    Malwarebytes' Anti-Malware
    MapSource
    MapSource - US Topo 24K National Parks, West v2
    MapSource - US Topo v3.02
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft Antimalware
    Microsoft Application Error Reporting
    Microsoft IntelliPoint 4.0
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Security Essentials
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Motherboard Monitor 5
    Movielink Manager
    Mozilla Firefox (3.0.6)
    MSN Music Assistant
    NVIDIA Drivers
    NvMixer
    PowerDVD
    PowerQuest Drive Image 7.0
    PowerQuest PartitionMagic 7.0
    Quicken 2006
    QuickTime
    RealPlayer
    Revo Uninstaller 1.90
    Security Update for Windows Internet Explorer 7 (KB938127-v2)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB982381)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB883939)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896422)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899588)
    Security Update for Windows XP (KB899589)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB905915)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB908531)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911567)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912812)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913446)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB916281)
    Security Update for Windows XP (KB917159)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB918899)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920214)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB921883)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937143)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB944338-v2)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958470)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB971032)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB981349)
    Spell Catcher Plus
    SUPERAntiSpyware
    Tweakui Powertoy for Windows XP
    Update for Windows XP (KB894391)
    Update for Windows XP (KB896727)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB904942)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB911280)
    Update for Windows XP (KB914882)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    WebFldrs XP
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool
    Windows Installer 3.1 (KB893803)
    Windows Installer Clean Up
    Windows Internet Explorer 8
    Windows Media Format Runtime
    Windows Media Player 10
    Windows XP Hotfix - KB834707
    Windows XP Hotfix - KB867282
    Windows XP Hotfix - KB873333
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB887742
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890047
    Windows XP Hotfix - KB890175
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB890923
    Windows XP Hotfix - KB891781
    Windows XP Hotfix - KB893066
    Windows XP Hotfix - KB893086
    WinFlash

    ==== Event Viewer Messages From Past Week ========

    11/26/2010 3:36:50 AM, error: Service Control Manager [7016] - The GEARSecurity service has reported an invalid current state 0.
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The V2i Protector service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The UStorage Server Service service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The Movielink Core Service service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The GEARSecurity service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The Diskeeper service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The C-DillaCdaC11BA service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 3:04:38 AM, error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
    11/26/2010 3:04:38 AM, error: Service Control Manager [7031] - The Google Updater Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 900000 milliseconds: Restart the service.
    11/25/2010 9:52:38 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 9:37:55 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\drivers\usbser.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.2180.
    11/25/2010 9:28:08 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 9:19:31 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 9:04:49 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 8:57:31 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 8:38:41 AM, error: NtServicePack [4373] - Windows XP KB956572 installation failed.
    An internal error occurred.
    11/25/2010 8:38:16 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 8:33:30 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8007054f: Windows XP Service Pack 3 (KB936929).
    11/25/2010 8:33:13 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 7:56:35 AM, error: NtServicePack [4373] - Windows XP KB956572 installation failed.
    An internal error occurred.
    11/25/2010 6:47:22 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8007054f: Security Update for Windows XP (KB956572).
    11/25/2010 6:47:17 AM, error: NtServicePack [4373] - Windows XP KB956572 installation failed.
    An internal error occurred.
    11/25/2010 6:07:50 AM, error: EventLog [6004] - A driver packet received from the I/O subsystem was invalid. The data is the packet.
    11/25/2010 5:50:05 AM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified.
    11/25/2010 12:36:27 PM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
    An internal error occurred.
    11/25/2010 11:25:15 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    11/25/2010 11:25:07 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    11/25/2010 11:24:38 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK7 Fips IPSec mbmiodrvr MpFilter MRxSmb NetBIOS NetBT PQIMount RasAcd Rdbss Tcpip
    11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    11/25/2010 11:23:15 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

    ==== End Of File ===========================


    DDS (Ver_10-11-26.01) - NTFSx86
    Run by Ron at 3:36:47.92 on Fri 11/26/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.644 [GMT -7:00]

    AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Motherboard Monitor 5\MBM5.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
    C:\Program Files\Microsoft Security Essentials\msseces.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\FileBX\FileBX.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    D:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\WINDOWS\System32\GEARSec.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    D:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\UStorSrv.exe
    D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Ron\Desktop\Scans\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.comcast.net/explore.html
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uWindow Title =
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
    mSearchAssistant = hxxp://www.google.com/ie
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
    BHO: {c333cf63-767f-4831-94ac-e683d962c63c} - CoTGT_BHO Class
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
    uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [updateMgr] "d:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    mRun: [MBM 5] "d:\program files\motherboard monitor 5\MBM5.EXE"
    mRun: [DiskeeperSystray] "d:\program files\executive software\diskeeper\DkIcon.exe"
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [nwiz] nwiz.exe /install
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [POINTER] point32.exe
    mRun: [<NO NAME>]
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
    mRun: [LoadMSvcmm] "d:\program files\movielink\movielinkmanager\Movielink User.exe"
    mRun: [QuickTime Task] "d:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
    StartupFolder: c:\docume~1\ron\startm~1\programs\startup\filebo~1.lnk - d:\program files\filebx\FileBX.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - d:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - hxxps://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photo.walgreens.com/WalgreensActivia.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1290690552625
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - hxxps://www-secure.symantec.com/techsupp/asa/SymAData.cab
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\ron\applic~1\mozilla\firefox\profiles\sgyupw4s.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - plugin: c:\program files\google\google updater\2.4.1439.6872\npCIDetect13.dll
    FF - plugin: c:\program files\google\update\1.2.133.37\npGoogleOneClick7.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: d:\program files\adobe\acrobat 7.0\reader\browser\nppdf32.dll
    FF - plugin: d:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: d:\program files\mozilla firefox\plugins\npsnapfish.dll
    FF - plugin: d:\program files\quicktime\plugins\npqtplugin.dll
    FF - plugin: d:\program files\quicktime\plugins\npqtplugin2.dll
    FF - plugin: d:\program files\quicktime\plugins\npqtplugin3.dll
    FF - plugin: d:\program files\quicktime\plugins\npqtplugin4.dll
    FF - plugin: d:\program files\quicktime\plugins\npqtplugin5.dll
    FF - plugin: d:\program files\quicktime\plugins\npqtplugin6.dll
    FF - plugin: d:\program files\quicktime\plugins\npqtplugin7.dll
    FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true
    ============= SERVICES / DRIVERS ===============

    R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2003-9-12 132899]
    R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]
    R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2003-9-12 46810]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
    S2 gupdate1c985725098acde;Google Update Service (gupdate1c985725098acde);c:\program files\google\update\GoogleUpdate.exe [2009-2-2 133104]
    S2 mrtRate;mrtRate; [x]

    =============== Created Last 30 ================

    2010-11-26 10:34:15 6273872 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{97f1599c-1d61-4690-9448-0aa13af080f9}\mpengine.dll
    2010-11-26 10:09:13 -------- d-----w- c:\docume~1\ron\applic~1\Malwarebytes
    2010-11-26 10:09:03 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-26 10:09:01 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-11-26 10:09:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-26 10:09:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-26 09:53:41 274288 ----a-w- c:\windows\system32\mucltui.dll
    2010-11-26 09:53:41 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
    2010-11-25 18:54:38 -------- d-----w- c:\docume~1\ron\applic~1\SUPERAntiSpyware.com
    2010-11-25 18:54:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
    2010-11-25 18:54:29 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-11-25 18:35:41 -------- d-----w- c:\program files\CCleaner
    2010-11-25 18:30:37 -------- d-sh--w- c:\documents and settings\ron\IECompatCache
    2010-11-25 18:30:07 -------- d-sh--w- c:\documents and settings\ron\PrivacIE
    2010-11-25 16:42:03 -------- d-----w- c:\program files\Palm
    2010-11-25 14:26:30 -------- d-sh--w- c:\documents and settings\ron\IETldCache
    2010-11-25 14:01:28 -------- d-----w- c:\windows\ie8updates
    2010-11-25 14:00:54 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2010-11-25 14:00:53 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2010-11-25 14:00:53 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2010-11-25 13:59:17 -------- dc-h--w- c:\windows\ie8
    2010-11-25 13:50:48 -------- d-----w- c:\windows\ServicePackFiles
    2010-11-25 13:07:02 -------- d-----w- c:\program files\Magical Jelly Bean
    2010-11-25 12:58:30 222080 ------w- c:\windows\system32\MpSigStub.exe
    2010-11-25 12:56:51 -------- d-----w- c:\program files\Microsoft Security Essentials
    2010-11-25 12:38:55 472808 ----a-w- c:\windows\system32\deployJava1.dll

    ==================== Find3M ====================

    2010-09-15 09:29:49 73728 ----a-w- c:\windows\system32\javacpl.cpl

    ============= FINISH: 3:37:49.54 ===============
  2. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =========================================================================

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    =======================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AVG Remover to uninstall it: http://www.avg.com/us-en/download-tools
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.pif
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  3. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000003d

    Kernel Drivers (total 129):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EC000 \WINDOWS\system32\hal.dll
    0xF7D2F000 \WINDOWS\system32\KDCOM.DLL
    0xF7C3F000 \WINDOWS\system32\BOOTVID.dll
    0xF77E0000 ACPI.sys
    0xF7D31000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF77CF000 pci.sys
    0xF782F000 isapnp.sys
    0xF783F000 ohci1394.sys
    0xF784F000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xF7DF7000 pciide.sys
    0xF7AAF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF785F000 MountMgr.sys
    0xF77B0000 ftdisk.sys
    0xF7D33000 dmload.sys
    0xF778A000 dmio.sys
    0xF7AB7000 PartMgr.sys
    0xF786F000 VolSnap.sys
    0xF7772000 atapi.sys
    0xF7ABF000 nvidesm.sys
    0xF775A000 \WINDOWS\system32\drivers\SCSIPORT.SYS
    0xF787F000 disk.sys
    0xF788F000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF773A000 fltMgr.sys
    0xF7728000 sr.sys
    0xF7713000 PQV2i.sys
    0xF76FC000 KSecDD.sys
    0xF766F000 Ntfs.sys
    0xF7642000 NDIS.sys
    0xF7C43000 nv_agp.sys
    0xF7627000 Mup.sys
    0xF7DF8000 giveio.sys
    0xF79FF000 \SystemRoot\system32\DRIVERS\nic1394.sys
    0xF7A4F000 \SystemRoot\system32\DRIVERS\amdk7.sys
    0xF7B0F000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0xF6ED9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF7B17000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF6EC5000 \SystemRoot\system32\DRIVERS\NVENET.sys
    0xF7A5F000 \SystemRoot\system32\drivers\nvax.sys
    0xF7A6F000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xF7A7F000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xF6EA2000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF75E2000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
    0xF6BEF000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
    0xF6BDB000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF7B1F000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xF7A8F000 \SystemRoot\system32\DRIVERS\serial.sys
    0xF75DA000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xF6BC7000 \SystemRoot\system32\DRIVERS\parport.sys
    0xF7A9F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF7B27000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF7F64000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF78BF000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF75D6000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF6BB0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF78CF000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF78DF000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF7B2F000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF6B9F000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF78EF000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF7C07000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF7C2F000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF515B000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xF6AFF000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF7C37000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF7D95000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF50D7000 \SystemRoot\system32\DRIVERS\update.sys
    0xF7CDB000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF60CF000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF609F000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7D9D000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF480C000 \SystemRoot\system32\drivers\nvapu.sys
    0xF47E8000 \SystemRoot\system32\drivers\portcls.sys
    0xF606F000 \SystemRoot\system32\drivers\drmk.sys
    0xF4703000 \SystemRoot\system32\drivers\nvmcp.sys
    0xF46F2000 \SystemRoot\system32\drivers\nvarm.sys
    0xF177F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
    0xEFCA1000 \SystemRoot\system32\DRIVERS\MpFilter.sys
    0xF183D000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0xF14EB000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0xF1655000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0xF7DCF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7EE1000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7DD1000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF1645000 \SystemRoot\System32\drivers\vga.sys
    0xF7DD3000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7DD5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF163D000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF1635000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xEFC4E000 \SystemRoot\System32\Drivers\UdfReadr.SYS
    0xF1481000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xEFC29000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xEFBD1000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xEFBA9000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xEFB87000 \SystemRoot\System32\drivers\afd.sys
    0xF14DB000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xEFB65000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    0xF162D000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0xEFB3A000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xF0ED9000 \SystemRoot\System32\Drivers\PQIMount.SYS
    0xEFACB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF7ECB000 \??\C:\WINDOWS\system32\mbmiodrvr.sys
    0xF0EB9000 \SystemRoot\System32\Drivers\Fips.SYS
    0xEFAAA000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF0EA9000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF0E99000 \SystemRoot\system32\DRIVERS\arp1394.sys
    0xF7D07000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0xF28D5000 \SystemRoot\system32\DRIVERS\IPFilter.sys
    0xEFA99000 \SystemRoot\System32\Drivers\Udfs.SYS
    0xF6F0C000 \SystemRoot\System32\Drivers\dump_diskdump.sys
    0xF161D000 \SystemRoot\System32\Drivers\dump_nvidesm.sys
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF7CEF000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF1615000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7F62000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\nv4_disp.dll
    0xF6F20000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xED92C000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF1767000 \SystemRoot\System32\Drivers\ParVdm.SYS
    0xEE9F1000 \??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS
    0xED89F000 \SystemRoot\system32\drivers\wdmaud.sys
    0xF547D000 \SystemRoot\system32\drivers\sysaudio.sys
    0xED59A000 \SystemRoot\system32\DRIVERS\srv.sys
    0xED199000 \SystemRoot\System32\Drivers\HTTP.sys
    0xECFBE000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xF7B37000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0xECF93000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 39):
    0 System Idle Process
    4 System
    664 C:\WINDOWS\system32\smss.exe
    728 csrss.exe
    752 C:\WINDOWS\system32\winlogon.exe
    796 C:\WINDOWS\system32\services.exe
    808 C:\WINDOWS\system32\lsass.exe
    952 C:\WINDOWS\system32\svchost.exe
    1032 svchost.exe
    1068 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
    1108 C:\WINDOWS\system32\svchost.exe
    1192 svchost.exe
    1412 svchost.exe
    1572 C:\WINDOWS\explorer.exe
    1612 C:\WINDOWS\system32\spoolsv.exe
    1752 C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    1800 D:\Program Files\Executive Software\Diskeeper\DkService.exe
    1920 D:\Program Files\Motherboard Monitor 5\MBM5.exe
    1972 C:\WINDOWS\system32\rundll32.exe
    1980 C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    1988 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    1996 C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
    2016 D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
    124 C:\Program Files\Microsoft Security Essentials\msseces.exe
    164 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    172 C:\WINDOWS\system32\ctfmon.exe
    336 D:\Program Files\FileBX\FileBX.exe
    548 C:\WINDOWS\system32\gearsec.exe
    576 C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    624 C:\Program Files\Java\jre6\bin\jqs.exe
    772 D:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
    1160 C:\WINDOWS\system32\nvsvc32.exe
    1304 C:\WINDOWS\system32\svchost.exe
    1456 wdfmgr.exe
    1508 C:\WINDOWS\system32\UStorSrv.exe
    1692 D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
    2860 alg.exe
    3176 C:\WINDOWS\system32\wuauclt.exe
    3728 C:\Documents and Settings\Ron\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000007`52c65e00 (NTFS)

    PhysicalDrive0 Model Number: MAXTOR 6L080L4, Rev: A93.

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0



    ComboFix 10-11-25.06 - Ron 11/26/2010 12:15:54.2.1 - x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.705 [GMT -7:00]
    Running from: c:\documents and settings\Ron\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\kernel1.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-10-26 to 2010-11-26 )))))))))))))))))))))))))))))))
    .

    2010-11-26 10:34 . 2010-11-10 03:33 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{97F1599C-1D61-4690-9448-0AA13AF080F9}\mpengine.dll
    2010-11-26 10:09 . 2010-11-26 10:09 -------- d-----w- c:\documents and settings\Ron\Application Data\Malwarebytes
    2010-11-26 10:09 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-26 10:09 . 2010-11-26 10:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-11-26 10:09 . 2010-11-26 10:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-26 10:09 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-26 09:53 . 2009-08-07 02:23 274288 ----a-w- c:\windows\system32\mucltui.dll
    2010-11-25 18:54 . 2010-11-25 18:54 -------- d-----w- c:\documents and settings\Ron\Application Data\SUPERAntiSpyware.com
    2010-11-25 18:54 . 2010-11-25 18:54 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2010-11-25 18:54 . 2010-11-25 18:54 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-11-25 18:35 . 2010-11-25 18:35 -------- d-----w- c:\program files\CCleaner
    2010-11-25 18:30 . 2010-11-25 18:30 -------- d-sh--w- c:\documents and settings\Ron\IECompatCache
    2010-11-25 18:30 . 2010-11-25 18:30 -------- d-sh--w- c:\documents and settings\Ron\PrivacIE
    2010-11-25 17:55 . 2010-11-25 17:55 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-11-25 16:42 . 2010-11-25 16:42 -------- d-----w- c:\program files\Palm
    2010-11-25 14:26 . 2010-11-25 14:26 -------- d-sh--w- c:\documents and settings\Ron\IETldCache
    2010-11-25 14:00 . 2010-05-06 10:41 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2010-11-25 14:00 . 2010-05-06 10:41 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2010-11-25 14:00 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2010-11-25 13:59 . 2010-11-25 14:00 -------- dc-h--w- c:\windows\ie8
    2010-11-25 13:50 . 2010-11-25 13:50 -------- d-----w- c:\windows\ServicePackFiles
    2010-11-25 13:07 . 2010-11-25 13:07 -------- d-----w- c:\program files\Magical Jelly Bean
    2010-11-25 12:58 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
    2010-11-25 12:56 . 2010-11-25 12:57 -------- d-----w- c:\program files\Microsoft Security Essentials
    2010-11-25 12:38 . 2010-09-15 11:50 472808 ----a-w- c:\windows\system32\deployJava1.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-15 09:29 . 2007-09-17 20:44 73728 ----a-w- c:\windows\system32\javacpl.cpl
    .

    ------- Sigcheck -------

    [-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\sfcfiles.dll
    [-] 2004-08-04 . F2F5FF05C9F93894C9FA8A6FBDE94330 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
    [7] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 68856]
    "updateMgr"="d:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 307200]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MBM 5"="d:\program files\Motherboard Monitor 5\MBM5.EXE" [2004-06-12 594944]
    "DiskeeperSystray"="d:\program files\Executive Software\Diskeeper\DkIcon.exe" [2004-11-13 180312]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
    "nwiz"="nwiz.exe" [2004-10-29 921600]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
    "LoadMSvcmm"="d:\program files\Movielink\MovielinkManager\Movielink User.exe" [2005-08-30 112224]
    "QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
    "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - d:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax.com Tray Menu.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\eFax.com Tray Menu.lnk
    backup=c:\windows\pss\eFax.com Tray Menu.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2004-10-13 16:24 1694208 ------w- c:\program files\Messenger\msmsgs.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\system32\\mmc.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [9/12/2003 1:19 PM 132899]
    R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [9/12/2003 1:48 PM 46810]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
    S2 gupdate1c985725098acde;Google Update Service (gupdate1c985725098acde);c:\program files\Google\Update\GoogleUpdate.exe [2/2/2009 1:10 PM 133104]
    S2 mrtRate;mrtRate; [x]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 20:42]

    2010-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 20:10]

    2010-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 20:10]

    2010-11-26 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 04:40]

    2010-11-26 c:\windows\Tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.comcast.net/explore.html
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
    FF - ProfilePath - c:\documents and settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - plugin: c:\program files\Google\Google Updater\2.4.1439.6872\npCIDetect13.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: d:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF - plugin: d:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: d:\program files\Mozilla Firefox\plugins\npsnapfish.dll
    FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin.dll
    FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin2.dll
    FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin3.dll
    FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin4.dll
    FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin5.dll
    FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin6.dll
    FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin7.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-POINTER - point32.exe
    Notify-AtiExtEvent - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-26 12:20
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(756)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    .
    Completion time: 2010-11-26 12:24:21
    ComboFix-quarantined-files.txt 2010-11-26 19:24

    Pre-Run: 21,803,261,952 bytes free
    Post-Run: 21,765,206,016 bytes free

    - - End Of File - - 13B3315C91B7FE6C9B867B633512EE26
  4. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    The last few lines of MBRCheck log are missing.
    Please, repost.
  5. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    MBRCheck freezes my computer. I have to reboot, this is all that in the text file.

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000001d

    Kernel Drivers (total 128):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EC000 \WINDOWS\system32\hal.dll
    0xF7D2F000 \WINDOWS\system32\KDCOM.DLL
    0xF7C3F000 \WINDOWS\system32\BOOTVID.dll
    0xF77E0000 ACPI.sys
    0xF7D31000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF77CF000 pci.sys
    0xF782F000 isapnp.sys
    0xF783F000 ohci1394.sys
    0xF784F000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xF7DF7000 pciide.sys
    0xF7AAF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF785F000 MountMgr.sys
    0xF77B0000 ftdisk.sys
    0xF7D33000 dmload.sys
    0xF778A000 dmio.sys
    0xF7AB7000 PartMgr.sys
    0xF786F000 VolSnap.sys
    0xF7772000 atapi.sys
    0xF7ABF000 nvidesm.sys
    0xF775A000 \WINDOWS\system32\drivers\SCSIPORT.SYS
    0xF787F000 disk.sys
    0xF788F000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF773A000 fltMgr.sys
    0xF7728000 sr.sys
    0xF7713000 PQV2i.sys
    0xF76FC000 KSecDD.sys
    0xF766F000 Ntfs.sys
    0xF7642000 NDIS.sys
    0xF7C43000 nv_agp.sys
    0xF7627000 Mup.sys
    0xF7DF8000 giveio.sys
    0xF7A0F000 \SystemRoot\system32\DRIVERS\nic1394.sys
    0xF79BF000 \SystemRoot\system32\DRIVERS\amdk7.sys
    0xF7B0F000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0xF6E3F000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF7B17000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF6E2B000 \SystemRoot\system32\DRIVERS\NVENET.sys
    0xF79CF000 \SystemRoot\system32\drivers\nvax.sys
    0xF79DF000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xF79EF000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xF6E08000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF7D1F000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
    0xF6B55000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
    0xF6B41000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF7B1F000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xF79FF000 \SystemRoot\system32\DRIVERS\serial.sys
    0xF7D27000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xF6B2D000 \SystemRoot\system32\DRIVERS\parport.sys
    0xF7A1F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF7B27000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF7EE5000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF7A2F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF7D2B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF6B16000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF7A3F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF7A6F000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF7B37000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF6AEE000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF7A7F000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF7C07000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF7C2F000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF4933000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xF62F2000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF7C37000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF7D91000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF48F5000 \SystemRoot\system32\DRIVERS\update.sys
    0xF6AE6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF4B72000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF4B62000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7DA3000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF3E32000 \SystemRoot\system32\drivers\nvapu.sys
    0xF3E0E000 \SystemRoot\system32\drivers\portcls.sys
    0xF4B22000 \SystemRoot\system32\drivers\drmk.sys
    0xF3D29000 \SystemRoot\system32\drivers\nvmcp.sys
    0xF3D18000 \SystemRoot\system32\drivers\nvarm.sys
    0xF0EED000 \SystemRoot\system32\DRIVERS\flpydisk.sys
    0xEF40E000 \SystemRoot\system32\DRIVERS\MpFilter.sys
    0xF7DEB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF492D000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7DB7000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF0EDD000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0xF0ED5000 \SystemRoot\System32\drivers\vga.sys
    0xF7DBB000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7DBD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF0ECD000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF061B000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xEF3BB000 \SystemRoot\System32\Drivers\UdfReadr.SYS
    0xF49B0000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xEF396000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xEF33E000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xEF316000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xEF2F4000 \SystemRoot\System32\drivers\afd.sys
    0xF0DA5000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xEF2D2000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    0xF0613000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0xEF2A7000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xF0D95000 \SystemRoot\System32\Drivers\PQIMount.SYS
    0xEF238000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF483B000 \??\C:\WINDOWS\system32\mbmiodrvr.sys
    0xF0D75000 \SystemRoot\System32\Drivers\Fips.SYS
    0xEF217000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF0718000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF0708000 \SystemRoot\system32\DRIVERS\arp1394.sys
    0xF6ADE000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0xF06E8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0xF49C8000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0xF6202000 \SystemRoot\system32\DRIVERS\IPFilter.sys
    0xEF206000 \SystemRoot\System32\Drivers\Udfs.SYS
    0xF6ADA000 \SystemRoot\System32\Drivers\dump_diskdump.sys
    0xF0603000 \SystemRoot\System32\Drivers\dump_nvidesm.sys
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF49B8000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF05FB000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7E52000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\nv4_disp.dll
    0xEE1D2000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xED039000 \SystemRoot\system32\drivers\wdmaud.sys
    0xF6ED2000 \SystemRoot\system32\drivers\sysaudio.sys
    0xECE4E000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF053F000 \SystemRoot\System32\Drivers\ParVdm.SYS
    0xECE7B000 \??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS
    0xECCDF000 \SystemRoot\system32\DRIVERS\srv.sys
    0xEC88E000 \SystemRoot\System32\Drivers\HTTP.sys
    0xEC68B000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xEC660000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 38):
    0 System Idle Process
    4 System
    664 C:\WINDOWS\system32\smss.exe
    728 csrss.exe
    752 C:\WINDOWS\system32\winlogon.exe
    796 C:\WINDOWS\system32\services.exe
    808 C:\WINDOWS\system32\lsass.exe
    960 C:\WINDOWS\system32\svchost.exe
    1040 svchost.exe
    1136 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
    1172 C:\WINDOWS\system32\svchost.exe
    1256 svchost.exe
    1480 svchost.exe
    1720 C:\WINDOWS\explorer.exe
    1804 C:\WINDOWS\system32\spoolsv.exe
    2008 D:\Program Files\Motherboard Monitor 5\MBM5.exe
    184 C:\WINDOWS\system32\rundll32.exe
    192 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    180 C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
    204 D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
    232 C:\Program Files\Microsoft Security Essentials\msseces.exe
    240 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    484 D:\Program Files\FileBX\FileBX.exe
    876 C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    984 D:\Program Files\Executive Software\Diskeeper\DkService.exe
    1080 C:\WINDOWS\system32\gearsec.exe
    1108 C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    1228 C:\Program Files\Java\jre6\bin\jqs.exe
    1376 D:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
    1668 C:\WINDOWS\system32\nvsvc32.exe
    1628 C:\WINDOWS\system32\svchost.exe
    1976 wdfmgr.exe
    2068 C:\WINDOWS\system32\UStorSrv.exe
    2116 D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
    2248 C:\WINDOWS\system32\wuauclt.exe
    3176 alg.exe
    3928 C:\WINDOWS\system32\wuauclt.exe
    1412 C:\Documents and Settings\Ron\Desktop\MBRCheck.exe

    Øÿÿÿvk > ø@   m Reduce color\ A àÿÿÿvk < @@   A SaturateØÿÿÿvk n xÿ?   C Luminance r o 2 Øÿÿÿvk
     €   6 MRUFloatStyleÔ6 Øÿÿÿvk  €   6 MRUDockRightPos àÿÿÿvk  €C   6 BarIDè6 *ÿÿÿnk ì=KŽ †É K< ÿÿÿÿÿÿÿÿ
    Xæ6 ¨] ÿÿÿÿ  MRUF
    Toolbar-Bar11œ6 Øÿÿÿ
  6. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Let's try something else then...

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
  7. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    Bootkit Remover
    (c) 2009 eSage Lab
    www.esagelab.com

    Program version: 1.2.0.0
    OS Version: Microsoft Windows XP Professional Service Pack 2 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
    ATA_Read(): DeviceIoControl() ERROR 1
    Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


    Done;
    Press any key to quit...


    The Bootkit also saved this log to the desktop

    .\debug.cpp(238) : Debug log started at 27.11.2010 - 20:17:42
    .\boot_cleaner.cpp(527) : Bootkit Remover
    .\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
    .\boot_cleaner.cpp(529) : www.esagelab.com
    .\boot_cleaner.cpp(533) : Program version: 1.2.0.0
    .\boot_cleaner.cpp(540) : OS Version: Microsoft Windows XP Professional Service Pack 2 (build 2600)
    .\debug.cpp(248) : **********************************************
    .\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
    .\debug.cpp(250) : **********************************************
    .\debug.cpp(256) : 0x804d7000 0x00214900 "\WINDOWS\system32\ntoskrnl.exe"
    .\debug.cpp(256) : 0x806ec000 0x00020380 "\WINDOWS\system32\hal.dll"
    .\debug.cpp(256) : 0xf7d2f000 0x00002000 "\WINDOWS\system32\KDCOM.DLL"
    .\debug.cpp(256) : 0xf7c3f000 0x00003000 "\WINDOWS\system32\BOOTVID.dll"
    .\debug.cpp(256) : 0xf77e0000 0x0002e000 "ACPI.sys"
    .\debug.cpp(256) : 0xf7d31000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS"
    .\debug.cpp(256) : 0xf77cf000 0x00011000 "pci.sys"
    .\debug.cpp(256) : 0xf782f000 0x00009000 "isapnp.sys"
    .\debug.cpp(256) : 0xf783f000 0x0000f000 "ohci1394.sys"
    .\debug.cpp(256) : 0xf784f000 0x0000d000 "\WINDOWS\system32\DRIVERS\1394BUS.SYS"
    .\debug.cpp(256) : 0xf7df7000 0x00001000 "pciide.sys"
    .\debug.cpp(256) : 0xf7aaf000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS"
    .\debug.cpp(256) : 0xf785f000 0x0000b000 "MountMgr.sys"
    .\debug.cpp(256) : 0xf77b0000 0x0001f000 "ftdisk.sys"
    .\debug.cpp(256) : 0xf7d33000 0x00002000 "dmload.sys"
    .\debug.cpp(256) : 0xf778a000 0x00026000 "dmio.sys"
    .\debug.cpp(256) : 0xf7ab7000 0x00005000 "PartMgr.sys"
    .\debug.cpp(256) : 0xf786f000 0x0000d000 "VolSnap.sys"
    .\debug.cpp(256) : 0xf7772000 0x00018000 "atapi.sys"
    .\debug.cpp(256) : 0xf7abf000 0x00005000 "nvidesm.sys"
    .\debug.cpp(256) : 0xf775a000 0x00018000 "\WINDOWS\system32\drivers\SCSIPORT.SYS"
    .\debug.cpp(256) : 0xf787f000 0x00009000 "disk.sys"
    .\debug.cpp(256) : 0xf788f000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS"
    .\debug.cpp(256) : 0xf773a000 0x00020000 "fltMgr.sys"
    .\debug.cpp(256) : 0xf7728000 0x00012000 "sr.sys"
    .\debug.cpp(256) : 0xf7713000 0x00015000 "PQV2i.sys"
    .\debug.cpp(256) : 0xf76fc000 0x00017000 "KSecDD.sys"
    .\debug.cpp(256) : 0xf766f000 0x0008d000 "Ntfs.sys"
    .\debug.cpp(256) : 0xf7642000 0x0002d000 "NDIS.sys"
    .\debug.cpp(256) : 0xf7c43000 0x00004000 "nv_agp.sys"
    .\debug.cpp(256) : 0xf7627000 0x0001b000 "Mup.sys"
    .\debug.cpp(256) : 0xf7df8000 0x00001000 "giveio.sys"
    .\debug.cpp(256) : 0xf79ef000 0x00010000 "\SystemRoot\system32\DRIVERS\nic1394.sys"
    .\debug.cpp(256) : 0xf7a4f000 0x0000a000 "\SystemRoot\system32\DRIVERS\amdk7.sys"
    .\debug.cpp(256) : 0xf7b07000 0x00005000 "\SystemRoot\system32\DRIVERS\usbohci.sys"
    .\debug.cpp(256) : 0xf759b000 0x00023000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS"
    .\debug.cpp(256) : 0xf7b0f000 0x00007000 "\SystemRoot\system32\DRIVERS\usbehci.sys"
    .\debug.cpp(256) : 0xf7587000 0x00014000 "\SystemRoot\system32\DRIVERS\NVENET.sys"
    .\debug.cpp(256) : 0xf7a5f000 0x0000e000 "\SystemRoot\system32\drivers\nvax.sys"
    .\debug.cpp(256) : 0xf7a6f000 0x0000d000 "\SystemRoot\system32\DRIVERS\cdrom.sys"
    .\debug.cpp(256) : 0xf7a7f000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys"
    .\debug.cpp(256) : 0xf7564000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys"
    .\debug.cpp(256) : 0xf7d13000 0x00003000 "\SystemRoot\System32\Drivers\GearAspiWDM.SYS"
    .\debug.cpp(256) : 0xf72b1000 0x002b3000 "\SystemRoot\system32\DRIVERS\nv4_mini.sys"
    .\debug.cpp(256) : 0xf729d000 0x00014000 "\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS"
    .\debug.cpp(256) : 0xf7b17000 0x00007000 "\SystemRoot\system32\DRIVERS\fdc.sys"
    .\debug.cpp(256) : 0xf7a8f000 0x00010000 "\SystemRoot\system32\DRIVERS\serial.sys"
    .\debug.cpp(256) : 0xf7d1b000 0x00004000 "\SystemRoot\system32\DRIVERS\serenum.sys"
    .\debug.cpp(256) : 0xf7289000 0x00014000 "\SystemRoot\system32\DRIVERS\parport.sys"
    .\debug.cpp(256) : 0xf7a9f000 0x0000d000 "\SystemRoot\system32\DRIVERS\i8042prt.sys"
    .\debug.cpp(256) : 0xf7b1f000 0x00006000 "\SystemRoot\system32\DRIVERS\kbdclass.sys"
    .\debug.cpp(256) : 0xf7eed000 0x00001000 "\SystemRoot\system32\DRIVERS\audstub.sys"
    .\debug.cpp(256) : 0xf78bf000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"
    .\debug.cpp(256) : 0xf7d1f000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"
    .\debug.cpp(256) : 0xf7272000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"
    .\debug.cpp(256) : 0xf78cf000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"
    .\debug.cpp(256) : 0xf78ff000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys"
    .\debug.cpp(256) : 0xf7b2f000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS"
    .\debug.cpp(256) : 0xf7189000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys"
    .\debug.cpp(256) : 0xf791f000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys"
    .\debug.cpp(256) : 0xf7bff000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys"
    .\debug.cpp(256) : 0xf7c27000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys"
    .\debug.cpp(256) : 0xf3d57000 0x00031000 "\SystemRoot\system32\DRIVERS\rdpdr.sys"
    .\debug.cpp(256) : 0xf719a000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys"
    .\debug.cpp(256) : 0xf7c2f000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys"
    .\debug.cpp(256) : 0xf7d91000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys"
    .\debug.cpp(256) : 0xf3d23000 0x00034000 "\SystemRoot\system32\DRIVERS\update.sys"
    .\debug.cpp(256) : 0xf7cff000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys"
    .\debug.cpp(256) : 0xf697e000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS"
    .\debug.cpp(256) : 0xf696e000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys"
    .\debug.cpp(256) : 0xf7d99000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"
    .\debug.cpp(256) : 0xf3441000 0x00066000 "\SystemRoot\system32\drivers\nvapu.sys"
    .\debug.cpp(256) : 0xf3409000 0x00024000 "\SystemRoot\system32\drivers\portcls.sys"
    .\debug.cpp(256) : 0xf692e000 0x0000f000 "\SystemRoot\system32\drivers\drmk.sys"
    .\debug.cpp(256) : 0xf3324000 0x000e5000 "\SystemRoot\system32\drivers\nvmcp.sys"
    .\debug.cpp(256) : 0xf3300000 0x00011000 "\SystemRoot\system32\drivers\nvarm.sys"
    .\debug.cpp(256) : 0xf018d000 0x00005000 "\SystemRoot\system32\DRIVERS\flpydisk.sys"
    .\debug.cpp(256) : 0xee5eb000 0x00023000 "\SystemRoot\system32\DRIVERS\MpFilter.sys"
    .\debug.cpp(256) : 0xeffae000 0x00003000 "\SystemRoot\system32\DRIVERS\hidusb.sys"
    .\debug.cpp(256) : 0xefc0d000 0x00009000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS"
    .\debug.cpp(256) : 0xf000e000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS"
    .\debug.cpp(256) : 0xf7dad000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS"
    .\debug.cpp(256) : 0xf404a000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS"
    .\debug.cpp(256) : 0xf7daf000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS"
    .\debug.cpp(256) : 0xefffe000 0x00006000 "\SystemRoot\System32\drivers\vga.sys"
    .\debug.cpp(256) : 0xf7db1000 0x00002000 "\SystemRoot\System32\Drivers\mnmdd.SYS"
    .\debug.cpp(256) : 0xf7db3000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"
    .\debug.cpp(256) : 0xefff6000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS"
    .\debug.cpp(256) : 0xeffee000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS"
    .\debug.cpp(256) : 0xee598000 0x00033000 "\SystemRoot\System32\Drivers\UdfReadr.SYS"
    .\debug.cpp(256) : 0xef7d2000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys"
    .\debug.cpp(256) : 0xee573000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys"
    .\debug.cpp(256) : 0xee51b000 0x00058000 "\SystemRoot\system32\DRIVERS\tcpip.sys"
    .\debug.cpp(256) : 0xee4f3000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys"
    .\debug.cpp(256) : 0xee4d1000 0x00022000 "\SystemRoot\System32\drivers\afd.sys"
    .\debug.cpp(256) : 0xefbfd000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys"
    .\debug.cpp(256) : 0xee4af000 0x00022000 "\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS"
    .\debug.cpp(256) : 0xeffe6000 0x00006000 "\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS"
    .\debug.cpp(256) : 0xee484000 0x0002b000 "\SystemRoot\system32\DRIVERS\rdbss.sys"
    .\debug.cpp(256) : 0xefbed000 0x00009000 "\SystemRoot\System32\Drivers\PQIMount.SYS"
    .\debug.cpp(256) : 0xee415000 0x0006f000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"
    .\debug.cpp(256) : 0xf3da9000 0x00001000 "\??\C:\WINDOWS\system32\mbmiodrvr.sys"
    .\debug.cpp(256) : 0xefbcd000 0x00009000 "\SystemRoot\System32\Drivers\Fips.SYS"
    .\debug.cpp(256) : 0xee3f4000 0x00021000 "\SystemRoot\system32\DRIVERS\ipnat.sys"
    .\debug.cpp(256) : 0xefbbd000 0x00009000 "\SystemRoot\system32\DRIVERS\wanarp.sys"
    .\debug.cpp(256) : 0xefbad000 0x0000f000 "\SystemRoot\system32\DRIVERS\arp1394.sys"
    .\debug.cpp(256) : 0xf3dfe000 0x00003000 "\SystemRoot\system32\DRIVERS\mouhid.sys"
    .\debug.cpp(256) : 0xf1fc3000 0x00003000 "\SystemRoot\system32\DRIVERS\IPFilter.sys"
    .\debug.cpp(256) : 0xee3e3000 0x00011000 "\SystemRoot\System32\Drivers\Udfs.SYS"
    .\debug.cpp(256) : 0xf75c6000 0x00004000 "\SystemRoot\System32\Drivers\dump_diskdump.sys"
    .\debug.cpp(256) : 0xeffd6000 0x00005000 "\SystemRoot\System32\Drivers\dump_nvidesm.sys"
    .\debug.cpp(256) : 0xbf800000 0x001c4000 "\SystemRoot\System32\win32k.sys"
    .\debug.cpp(256) : 0xf7cdb000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys"
    .\debug.cpp(256) : 0xeffce000 0x00005000 "\SystemRoot\System32\watchdog.sys"
    .\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys"
    .\debug.cpp(256) : 0xf7f2d000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys"
    .\debug.cpp(256) : 0xbf012000 0x00391000 "\SystemRoot\System32\nv4_disp.dll"
    .\debug.cpp(256) : 0xf1507000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"
    .\debug.cpp(256) : 0xec23e000 0x00015000 "\SystemRoot\system32\drivers\wdmaud.sys"
    .\debug.cpp(256) : 0xef75e000 0x0000f000 "\SystemRoot\system32\drivers\sysaudio.sys"
    .\debug.cpp(256) : 0xec053000 0x0002d000 "\SystemRoot\system32\DRIVERS\mrxdav.sys"
    .\debug.cpp(256) : 0xf7dc1000 0x00002000 "\SystemRoot\System32\Drivers\ParVdm.SYS"
    .\debug.cpp(256) : 0xec0ec000 0x00003000 "\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS"
    .\debug.cpp(256) : 0xebee4000 0x00057000 "\SystemRoot\system32\DRIVERS\srv.sys"
    .\debug.cpp(256) : 0xebb33000 0x00041000 "\SystemRoot\System32\Drivers\HTTP.sys"
    .\debug.cpp(256) : 0xeb958000 0x00023000 "\SystemRoot\System32\Drivers\Fastfat.SYS"
    .\debug.cpp(256) : 0x7c900000 0x000b0000 "\WINDOWS\system32\ntdll.dll"
    .\debug.cpp(263) : **********************************************
    .\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
    .\debug.cpp(308) : **********************************************
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{616b38c0-de36-11dd-a7ad-806d6172696f}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"
    .\debug.cpp(400) : Destination "\Device\Video0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"
    .\debug.cpp(400) : Destination "\Device\Ndis"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
    .\debug.cpp(400) : Destination "\Device\00000043"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmIoDaemon"
    .\debug.cpp(400) : Destination "\Device\DmControl\DmIoDaemon"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000031"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{71985f4a-1ca1-11d3-9cc8-00c04f7971e0}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"
    .\debug.cpp(400) : Destination "\Device\Video1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_TOSHIBA&Prod_DVD-ROM_SD-M1612&Rev_1004#4&e6802b0&0&100#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1Port0Path1Target0Lun0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip"
    .\debug.cpp(400) : Destination "\Device\Ip"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"
    .\debug.cpp(400) : Destination "\Device\Video2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:"
    .\debug.cpp(400) : Destination "\Device\CdRom0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&Signature5B0B5B0BOffset752C65E00LengthB507BAA00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000030"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&34941eb3&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"
    .\debug.cpp(400) : Destination "\Device\Video3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev"
    .\debug.cpp(400) : Destination "\Device\IPSEC"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9aa4a2cc-81e0-4cfd-802f-0f74526d2bd3}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDPROXY"
    .\debug.cpp(400) : Destination "\Device\NDProxy"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\RdpDrDvMgr"
    .\debug.cpp(400) : Destination "\Device\RdpDrDvMgr"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{fd0a5af4-b41d-11d2-9c95-00c04f7971e0}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{d008f032-103d-42f3-a554-4b707a4936c5}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#Disk&Ven_MAXTOR_6&Prod_L080L4&Rev_A93.#4&e6802b0&0&000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1Port0Path0Target0Lun0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\$VDMLPT1"
    .\debug.cpp(400) : Destination "\Device\ParallelVdm0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&Signature5B0B5B0BOffset7E00Length752C56200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FDC#GENERIC_FLOPPY_DRIVE#4&33bc18fa&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\FloppyPDO0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQV2iSnapshotControl"
    .\debug.cpp(400) : Destination "\Device\PQV2iSnapshot\Control"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAPU"
    .\debug.cpp(400) : Destination "\Device\NVAPU"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"
    .\debug.cpp(400) : Destination "\Device\WMIDataDevice"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{534760B4-FDA7-4B44-8C7E-14F7C4781718}"
    .\debug.cpp(400) : Destination "\Device\{534760B4-FDA7-4B44-8C7E-14F7C4781718}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_006A&SUBSYS_F5411297&REV_A1#3&13c0b0c5&0&30#{1890563f-15c9-4c36-824b-ab9c553cc420}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM1"
    .\debug.cpp(400) : Destination "\Device\Serial0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_006E&SUBSYS_F5411297&REV_A3#3&13c0b0c5&0&68#{6bdd1fc1-810f-11d0-bec7-08002be2092f}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0068&SUBSYS_F5411297&REV_A4#3&13c0b0c5&0&12#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0010"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{2fad4382-26a2-414e-b4ef-1dbbab444ebc}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{32138dcc-2b53-11d9-bcad-806d6172696f}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"
    .\debug.cpp(400) : Destination "\Device\NamedPipe"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{32138dc4-2b53-11d9-bcad-806d6172696f}"
    .\debug.cpp(400) : Destination "\Device\Floppy0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{49BBD7B8-E1C5-4B7F-9BAC-36C77E7C646A}"
    .\debug.cpp(400) : Destination "\Device\{49BBD7B8-E1C5-4B7F-9BAC-36C77E7C646A}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&9bc4322&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UdfReadr_XP"
    .\debug.cpp(400) : Destination "\Device\UdfReadr_XP"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788}"
    .\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT"
    .\debug.cpp(400) : Destination "\Device\IPNAT"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"
    .\debug.cpp(400) : Destination "\Device\Mup"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched"
    .\debug.cpp(400) : Destination "\Device\PSched"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GEARAspiWDMDevice"
    .\debug.cpp(400) : Destination "\Device\GEARAspiWDMDevice"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{b34a4f66-2f74-11d9-8946-806d6172696f}"
    .\debug.cpp(400) : Destination "\Device\CdRom0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_6_Model_6#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
    .\debug.cpp(400) : Destination "\Device\0000003e"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"
    .\debug.cpp(400) : Destination "\Device\Tcp"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"
    .\debug.cpp(400) : Destination "\Device\USBFDO-0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"
    .\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000035"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"
    .\debug.cpp(400) : Destination "\Device\USBFDO-1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD"
    .\debug.cpp(400) : Destination "\Device\VideoPdo0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"
    .\debug.cpp(400) : Destination "\Device\Harddisk0\DR0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQV2iSnapShot0"
    .\debug.cpp(400) : Destination "\Device\PQV2iSnapshot\Volume0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD2"
    .\debug.cpp(400) : Destination "\Device\USBFDO-2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000034"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"
    .\debug.cpp(400) : Destination "\DosDevices\LPT1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"
    .\debug.cpp(400) : Destination "\Device\CdRom0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000033"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{25CCF23E-DD25-4B09-B827-83D76EAC8721}"
    .\debug.cpp(400) : Destination "\Device\{25CCF23E-DD25-4B09-B827-83D76EAC8721}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"
    .\debug.cpp(400) : Destination "\Device\FsWrap"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQV2iSnapShot1"
    .\debug.cpp(400) : Destination "\Device\PQV2iSnapshot\Volume1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\sysaudio"
    .\debug.cpp(400) : Destination "\Device\sysaudio"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"
    .\debug.cpp(400) : Destination "\GLOBAL??"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
    .\debug.cpp(400) : Destination "\Device\00000046"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0066&SUBSYS_F5411297&REV_A1#3&13c0b0c5&0&20#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0011"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0303#3&13c0b0c5&0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000051"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}"
    .\debug.cpp(400) : Destination "\Device\0000004f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THRM#{4afa3d51-74a7-11d0-be5e-00a0c9062857}"
    .\debug.cpp(400) : Destination "\Device\00000040"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788}"
    .\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_TOSHIBA&Prod_DVD-ROM_SD-M1612&Rev_1004#4&e6802b0&0&100#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1Port0Path1Target0Lun0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{C6672E89-E1E2-4C7E-98AC-3CDC5682D8B3}"
    .\debug.cpp(400) : Destination "\Device\{C6672E89-E1E2-4C7E-98AC-3CDC5682D8B3}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{07dad660-22f1-11d1-a9f4-00c04fbbde8f}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ARP1394"
    .\debug.cpp(400) : Destination "\Device\ARP1394"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{dda54a40-1e4c-11d1-a050-405705c10000}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{4d36e978-e325-11ce-bfc1-08002be10318}"
    .\debug.cpp(400) : Destination "\Device\0000004f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_045e&Pid_0039#5&25360bda&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"
    .\debug.cpp(400) : Destination "\Device\MountPointManager"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmConfig"
    .\debug.cpp(400) : Destination "\Device\DmControl\DmConfig"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\0000002f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788}"
    .\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000003"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0067&SUBSYS_F5411297&REV_A4#3&13c0b0c5&0&11#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0009"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0250&SUBSYS_00371545&REV_A3#4&102ac5bc&0&00F0#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_045e&Pid_0039#6&649f079&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\0000006a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"
    .\debug.cpp(400) : Destination "\Device\WANARP"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmTrace"
    .\debug.cpp(400) : Destination "\Device\DmControl\DmTrace"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\giveio"
    .\debug.cpp(400) : Destination "\Device\giveio"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&1c75f3c7&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{094557a3-4211-4e66-8608-9640c9055c5f}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\A:"
    .\debug.cpp(400) : Destination "\Device\Floppy0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#dmio#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000002"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"
    .\debug.cpp(400) : Destination "\Device\NdisWanIp"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SASKUTIL"
    .\debug.cpp(400) : Destination "\Device\SASKUTIL"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQIMount"
    .\debug.cpp(400) : Destination "\Device\PQIMount"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"
    .\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788}"
    .\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\1394BUS0"
    .\debug.cpp(400) : Destination "\Device\1394BUS0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_045e&Pid_0039#6&649f079&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\0000006a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1"
    .\debug.cpp(400) : Destination "\Device\ParTechInc0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000032"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0067&SUBSYS_F5411297&REV_A4#3&13c0b0c5&0&10#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0008"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{ea2ef405-bfb8-40ce-8d37-4f94d99695dc}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0400#1#{97f76ef0-f883-11d0-af1f-0000f800845c}"
    .\debug.cpp(400) : Destination "\Device\00000050"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407}"
    .\debug.cpp(400) : Destination "\Device\00000039"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmLoader"
    .\debug.cpp(400) : Destination "\Device\DmLoader"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2"
    .\debug.cpp(400) : Destination "\Device\ParTechInc1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST"
    .\debug.cpp(400) : Destination "\Device\IPMULTICAST"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPT1"
    .\debug.cpp(400) : Destination "\Device\NamedPipe\Spooler\LPT1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"
    .\debug.cpp(400) : Destination "\Device\NdisWan"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISTAPI"
    .\debug.cpp(400) : Destination "\Device\NdisTapi"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow"
    .\debug.cpp(400) : Destination "\Device\LanmanRedirector"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0065&SUBSYS_F5411297&REV_A2#3&13c0b0c5&0&48#{2accfe60-c130-11d2-b082-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3"
    .\debug.cpp(400) : Destination "\Device\ParTechInc2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"
    .\debug.cpp(400) : Destination "\Device\FtControl"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SABDIFSV"
    .\debug.cpp(400) : Destination "\Device\SASDIFSV"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"
    .\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{41CECCE1-10CF-443A-BA7C-F859BD8BF879}"
    .\debug.cpp(400) : Destination "\Device\{41CECCE1-10CF-443A-BA7C-F859BD8BF879}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPTENUM#MicrosoftRawPort#4&1d62032d&0&LPT1#{811fc6a5-f728-11d0-a537-0000f8753ed1}"
    .\debug.cpp(400) : Destination "\Device\Parallel0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"
    .\debug.cpp(400) : Destination "\DosDevices\COM1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"
    .\debug.cpp(400) : Destination "\Device\MailSlot"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"
    .\debug.cpp(400) : Destination ""
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"
    .\debug.cpp(400) : Destination "\Device\Null"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000038"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"
    .\debug.cpp(400) : Destination "\Device\Ndisuio"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdaC15BA"
    .\debug.cpp(400) : Destination "\Device\CdaC15BA"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPFILTER"
    .\debug.cpp(400) : Destination "\Device\MSH_Filter"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000037"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NONSPOOLED_LPT1"
    .\debug.cpp(400) : Destination "\Device\Parallel0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmInfo"
    .\debug.cpp(400) : Destination "\Device\DmControl\DmInfo"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{56605FEC-7C98-45D5-8C23-4D598F3122E2}"
    .\debug.cpp(400) : Destination "\Device\{56605FEC-7C98-45D5-8C23-4D598F3122E2}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{54CE1298-8C85-4D6D-86C5-17DB23A3A99E}"
    .\debug.cpp(400) : Destination "\Device\{54CE1298-8C85-4D6D-86C5-17DB23A3A99E}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{011B4985-CBCC-4A49-BEB6-C7B9368065DB}"
    .\debug.cpp(400) : Destination "\Device\{011B4985-CBCC-4A49-BEB6-C7B9368065DB}"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\mbmiodrvr"
    .\debug.cpp(400) : Destination "\Device\mbmiodrvr"
    .\debug.cpp(409) : --
    .\debug.cpp(453) : **********************************************
    .\boot_cleaner.cpp(565) : System volume is \\.\C:
    .\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
    .\diskio.cpp(204) : ATA_Read(): DeviceIoControl() ERROR 1
    .\boot_cleaner.cpp(276) : Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd
    .\boot_cleaner.cpp(1060) :
    .\boot_cleaner.cpp(1061) : Size Device Name MBR Status
    .\boot_cleaner.cpp(1062) : --------------------------------------------
    .\boot_cleaner.cpp(1106) : 74 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
    .\boot_cleaner.cpp(1112) :
    .\boot_cleaner.cpp(1151) : Done;
  8. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    That looks good :)

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  9. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    OTL logfile created on: 11/28/2010 1:51:09 AM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Ron\Desktop
    Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1,023.00 Mb Total Physical Memory | 696.00 Mb Available Physical Memory | 68.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 29.29 Gb Total Space | 20.33 Gb Free Space | 69.41% Space Free | Partition Type: NTFS
    Drive D: | 45.26 Gb Total Space | 32.23 Gb Free Space | 71.21% Space Free | Partition Type: NTFS
    Drive E: | 591.50 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

    Computer Name: SHUTTLE | User Name: Ron | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
    PRC - [2010/09/15 04:34:02 | 001,094,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
    PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
    PRC - [2009/01/09 05:18:57 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    PRC - [2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2005/08/30 15:20:36 | 000,112,224 | ---- | M] (Movielink LLC) -- D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
    PRC - [2005/08/30 15:20:28 | 001,095,264 | ---- | M] (Movielink LLC) -- D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe
    PRC - [2004/12/20 16:12:36 | 000,131,072 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
    PRC - [2004/11/16 13:24:42 | 000,594,028 | ---- | M] (Executive Software International, Inc.) -- D:\Program Files\Executive Software\Diskeeper\DkService.exe
    PRC - [2004/11/05 05:10:06 | 000,039,936 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    PRC - [2004/07/13 21:16:06 | 000,139,264 | ---- | M] (OTi) -- C:\WINDOWS\system32\UStorSrv.exe
    PRC - [2004/06/12 08:40:42 | 000,594,944 | ---- | M] (Alex van Kaam) -- D:\Program Files\Motherboard Monitor 5\MBM5.exe
    PRC - [2004/02/13 09:23:56 | 000,585,728 | ---- | M] (Hyperionics Technology LLC) -- D:\Program Files\FileBX\FileBX.exe
    PRC - [2003/09/12 13:40:26 | 001,208,320 | ---- | M] (PowerQuest Corporation) -- D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
    PRC - [2002/11/25 07:12:32 | 000,049,152 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
    MOD - [2006/08/25 08:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
    MOD - [2004/02/13 09:24:00 | 000,094,208 | ---- | M] () -- D:\Program Files\FileBX\FileBXH.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
    SRV - [2008/12/01 11:01:02 | 000,033,752 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R)
    SRV - [2005/08/30 15:20:28 | 001,095,264 | ---- | M] (Movielink LLC) [Auto | Running] -- D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe -- (Movielink Core Service)
    SRV - [2004/11/16 13:24:42 | 000,594,028 | ---- | M] (Executive Software International, Inc.) [Auto | Running] -- D:\Program Files\Executive Software\Diskeeper\DkService.exe -- (Diskeeper)
    SRV - [2004/11/05 05:10:06 | 000,039,936 | ---- | M] (C-Dilla Ltd) [Auto | Running] -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE -- (C-DillaCdaC11BA)
    SRV - [2004/07/13 21:16:06 | 000,139,264 | ---- | M] (OTi) [Auto | Running] -- C:\WINDOWS\System32\UStorSrv.exe -- (UStorage Server Service)
    SRV - [2003/09/12 13:40:26 | 001,208,320 | ---- | M] (PowerQuest Corporation) [Auto | Running] -- D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe -- (V2i Protector)
    SRV - [2002/11/25 07:12:32 | 000,049,152 | ---- | M] (GEAR Software) [Auto | Running] -- C:\WINDOWS\system32\gearsec.exe -- (GEARSecurity)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\PalmUSBD.sys -- (PalmUSBD)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Ron\LOCALS~1\Temp\catchme.sys -- (catchme)
    DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
    DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
    DRV - [2006/09/26 14:11:13 | 000,022,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbsermpt.sys -- (usbsermpt)
    DRV - [2005/04/13 11:34:02 | 000,414,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce) Service for NVIDIA(R) nForce(TM)
    DRV - [2005/04/13 11:32:42 | 000,053,376 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax) Service for NVIDIA(R) nForce(TM)
    DRV - [2004/11/05 05:09:58 | 000,008,864 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
    DRV - [2004/10/29 15:50:00 | 002,826,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2004/08/03 20:08:36 | 000,013,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atinmdxx.sys -- (MVDCODEC)
    DRV - [2004/08/03 20:08:30 | 000,105,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atinrvxx.sys -- (atinrvxx)
    DRV - [2004/04/10 08:42:36 | 000,002,944 | ---- | M] (cansoft@livewiredev.com) [Kernel | System | Running] -- C:\WINDOWS\system32\mbmiodrvr.sys -- (mbmiodrvr)
    DRV - [2003/09/12 13:48:10 | 000,046,810 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQIMount.sys -- (PQIMount)
    DRV - [2003/09/12 13:19:44 | 000,132,899 | ---- | M] (StorageCraft) [File_System | Boot | Running] -- C:\WINDOWS\System32\drivers\PQV2i.sys -- (PQV2i)
    DRV - [2002/11/27 04:52:00 | 000,080,896 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET)
    DRV - [2002/11/13 00:10:00 | 000,020,224 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvidesm.sys -- (nvidesm)
    DRV - [2002/09/05 20:24:00 | 000,013,568 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys -- (nv_agp)
    DRV - [2001/11/30 04:00:14 | 000,003,538 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WinFlash.sys -- (Winflash)
    DRV - [2001/08/22 22:33:12 | 000,010,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ipfilter.sys -- (IPFilter)
    DRV - [2000/06/15 19:54:02 | 000,206,368 | ---- | M] (Adaptec) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\udfreadr.BAK -- (UdfReadr)
    DRV - [1996/04/03 12:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "Google"
    FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
    FF - prefs.js..browser.search.selectedEngine: "Google"
    FF - prefs.js..extensions.enabledItems: {C6128004-4838-4708-9A97-BB172D17767D}:1.3
    FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.0
    FF - prefs.js..extensions.enabledItems: exif_viewer@mozilla.doslash.org:1.45
    FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:0.9.8
    FF - prefs.js..extensions.enabledItems: {6e84150a-d526-41f1-a480-a67d3fed910d}:1.4
    FF - prefs.js..extensions.enabledItems: {01c29d60-f7f0-416c-844a-ec8b2e1841d0}:1.7
    FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.5.2008112201
    FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.7.3
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22


    FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2009/02/04 16:40:32 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2010/11/25 05:38:55 | 000,000,000 | ---D | M]

    [2009/01/08 18:52:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Extensions
    [2010/11/25 05:54:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions
    [2009/01/09 02:39:31 | 000,000,000 | ---D | M] (PhotoME Extension) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{01c29d60-f7f0-416c-844a-ec8b2e1841d0}
    [2006/02/19 04:56:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{04352C84-9AC6-4d2f-A518-AB0962D62FA1}
    [2009/01/09 02:39:32 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
    [2006/09/27 03:55:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe6a}
    [2009/01/09 02:39:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
    [2009/01/09 02:39:53 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
    [2009/01/08 18:52:53 | 000,000,000 | ---D | M] (IE View) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
    [2009/01/09 02:39:33 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
    [2007/09/18 20:13:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{9b9d2aaa-ae26-4447-a7a1-633a32b19ddd}
    [2009/01/09 02:39:33 | 000,000,000 | ---D | M] (GetVideo) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{a51dd9d0-56c3-11db-b0de-0800200c9a66}
    [2009/01/09 02:39:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{C6128004-4838-4708-9A97-BB172D17767D}
    [2009/01/10 06:46:17 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
    [2009/01/09 02:39:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
    [2009/01/09 02:39:34 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
    [2009/01/09 02:39:34 | 000,000,000 | ---D | M] (CustomizeGoogle) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{fce36c1e-58d8-498a-b2a5-66ad1cedebbb}(2)
    [2009/01/09 02:39:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\exif_viewer@mozilla.doslash.org
    [2009/01/09 02:39:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\toolbarcleanup@supernova00.biz
    [2009/01/09 02:39:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\unplug@compunach

    O1 HOSTS File: ([2010/11/26 12:20:54 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
    O2 - BHO: (no name) - {C333CF63-767F-4831-94AC-E683D962C63C} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
    O3 - HKCU\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
    O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
    O4 - HKLM..\Run: [DiskeeperSystray] D:\Program Files\Executive Software\Diskeeper\DkIcon.exe (Executive Software International, Inc.)
    O4 - HKLM..\Run: [LoadMSvcmm] D:\Program Files\Movielink\MovielinkManager\Movielink User.exe (Movielink LLC)
    O4 - HKLM..\Run: [MBM 5] D:\Program Files\Motherboard Monitor 5\MBM5.EXE (Alex van Kaam)
    O4 - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
    O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
    O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
    O4 - HKCU..\Run: [updateMgr] D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
    O4 - Startup: C:\Documents and Settings\Ron\Start Menu\Programs\Startup\FileBox eXtender.lnk = D:\Program Files\FileBX\FileBX.exe (Hyperionics Technology LLC)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab (LSSupCtl Class)
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photo.walgreens.com/WalgreensActivia.cab (Snapfish Activia)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1290690552625 (MUWebControl Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} https://www-secure.symantec.com/techsupp/asa/SymAData.cab (ActiveDataInfo Class)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
    O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
    O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/10/31 14:21:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [1999/11/10 11:30:28 | 000,000,038 | R--- | M] () - E:\AutoRun.dat -- [ UDF ]
    O32 - AutoRun File - [1998/12/14 14:31:14 | 000,000,051 | R--- | M] () - E:\AutoRun.inf -- [ UDF ]
    O32 - AutoRun File - [1999/01/27 14:46:14 | 000,118,784 | R--- | M] () - E:\autorun.exe -- [ UDF ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: VIDC.ACDV - ACDV.dll File not found
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (54619700398653440)

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/11/28 01:42:16 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
    [2010/11/27 13:10:13 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Documents and Settings\Ron\Desktop\remover.exe
    [2010/11/26 12:25:36 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2010/11/26 12:05:34 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/11/26 12:03:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/11/26 12:03:41 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/11/26 12:03:41 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/11/26 12:03:41 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2010/11/26 12:03:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/11/26 12:03:03 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/11/26 03:09:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ron\Application Data\Malwarebytes
    [2010/11/26 03:09:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/11/26 03:09:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/11/26 03:09:00 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/11/26 03:09:00 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/11/26 02:59:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ron\Desktop\Scans
    [2010/11/25 11:54:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ron\Application Data\SUPERAntiSpyware.com
    [2010/11/25 11:54:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    [2010/11/25 11:54:29 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
    [2010/11/25 11:47:47 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Ron\Recent
    [2010/11/25 11:35:41 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
    [2010/11/25 11:30:37 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Ron\IECompatCache
    [2010/11/25 11:30:07 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Ron\PrivacIE
    [2010/11/25 09:42:03 | 000,000,000 | ---D | C] -- C:\Program Files\Palm
    [2010/11/25 07:26:30 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Ron\IETldCache
    [2010/11/25 07:07:01 | 006,463,660 | ---- | C] (Punk Software ) -- C:\Documents and Settings\Ron\Desktop\RocketDock-v1.3.5.exe
    [2010/11/25 07:01:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
    [2010/11/25 06:59:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
    [2010/11/25 06:50:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
    [2010/11/25 06:07:02 | 000,000,000 | ---D | C] -- C:\Program Files\Magical Jelly Bean
    [2010/11/25 06:02:57 | 001,004,072 | ---- | C] (Magical Jelly Bean ) -- C:\Documents and Settings\Ron\Desktop\KeyFinderInstaller.exe
    [2010/11/25 05:56:51 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
    [2010/11/25 05:39:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun

    ========== Files - Modified Within 30 Days ==========

    [2010/11/28 01:44:47 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2010/11/28 01:42:52 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job
    [2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
    [2010/11/28 01:39:54 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/11/28 01:39:05 | 000,017,410 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
    [2010/11/28 01:39:03 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2010/11/28 01:38:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/11/27 02:38:00 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2010/11/26 12:39:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\MBRCheck.exe
    [2010/11/26 12:20:54 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/11/26 12:05:38 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2010/11/26 03:09:06 | 000,000,731 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/11/25 11:49:54 | 000,074,784 | ---- | M] () -- D:\My Documents\cc_20101125_114933.reg
    [2010/11/25 11:35:34 | 000,001,848 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2010/11/25 11:35:34 | 000,001,826 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2010/11/25 10:58:37 | 000,001,950 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
    [2010/11/25 09:09:20 | 000,000,942 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2010/11/25 09:09:20 | 000,000,937 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
    [2010/11/25 09:09:20 | 000,000,101 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
    [2010/11/25 07:26:21 | 000,090,296 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/11/25 07:07:06 | 006,463,660 | ---- | M] (Punk Software ) -- C:\Documents and Settings\Ron\Desktop\RocketDock-v1.3.5.exe
    [2010/11/25 06:03:04 | 001,004,072 | ---- | M] (Magical Jelly Bean ) -- C:\Documents and Settings\Ron\Desktop\KeyFinderInstaller.exe
    [2010/11/25 05:51:13 | 000,000,952 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\Revo Uninstaller.lnk
    [2010/11/08 01:20:24 | 000,089,088 | ---- | M] () -- C:\WINDOWS\MBR.exe

    ========== Files Created - No Company Name ==========

    [2010/11/26 12:05:38 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2010/11/26 12:05:35 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2010/11/26 12:03:41 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/11/26 12:03:41 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/11/26 12:03:41 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/11/26 12:03:41 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/11/26 12:03:41 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/11/26 11:42:47 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Ron\Desktop\MBRCheck.exe
    [2010/11/26 03:09:06 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/11/25 11:49:37 | 000,074,784 | ---- | C] () -- D:\My Documents\cc_20101125_114933.reg
    [2010/11/25 11:35:34 | 000,001,848 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2010/11/25 11:35:34 | 000,001,826 | ---- | C] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2010/11/25 11:33:58 | 000,000,880 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2010/11/25 11:33:58 | 000,000,876 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2010/11/25 11:30:34 | 000,000,418 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job
    [2010/11/25 10:58:37 | 000,001,950 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
    [2010/11/25 09:18:58 | 000,000,299 | ---- | C] () -- C:\Documents and Settings\Ron\Service Pack 3 Setup Error.txt
    [2010/11/25 07:08:09 | 013,525,424 | ---- | C] () -- C:\Documents and Settings\Ron\Desktop\Dropbox 0.7.110.exe
    [2010/11/25 06:02:00 | 000,000,408 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2005/02/05 12:25:31 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
    [2005/01/08 15:02:41 | 000,000,186 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
    [2005/01/08 14:58:23 | 000,046,592 | ---- | C] () -- C:\WINDOWS\System32\Prtserv.dll
    [2005/01/04 15:18:16 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\Ron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2005/01/02 11:30:06 | 000,000,088 | ---- | C] () -- C:\WINDOWS\Spell Catcher.INI
    [2005/01/01 09:41:44 | 000,003,538 | ---- | C] () -- C:\WINDOWS\System32\drivers\WinFlash.sys
    [2004/12/18 13:46:59 | 000,000,078 | ---- | C] () -- C:\WINDOWS\qwimp.ini
    [2004/12/04 12:51:03 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\OPDSL.DLL
    [2004/11/11 12:48:19 | 000,003,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\PQNTDRV.SYS
    [2004/11/05 05:10:08 | 000,112,128 | RH-- | C] () -- C:\WINDOWS\CdaC14BA.DLL
    [2004/11/05 05:10:05 | 000,008,864 | ---- | C] () -- C:\WINDOWS\System32\drivers\CDAC15BA.SYS
    [2004/11/05 05:08:32 | 000,000,765 | ---- | C] () -- C:\WINDOWS\efscan.ini
    [2004/11/05 05:08:32 | 000,000,072 | ---- | C] () -- C:\WINDOWS\efaxview.ini
    [2004/11/05 04:50:51 | 000,000,209 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
    [2004/11/01 05:27:44 | 000,001,101 | ---- | C] () -- C:\WINDOWS\wbocx.ini
    [2004/11/01 05:20:43 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Ron\Local Settings\Application Data\fusioncache.dat
    [2004/10/31 09:04:15 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/08/04 05:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
    [1996/04/03 12:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

    ========== LOP Check ==========

    [2009/01/09 04:46:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
    [2009/01/30 14:02:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GARMIN
    [2009/01/09 05:09:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HotSync
    [2006/05/19 13:48:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Movielink
    [2004/11/11 12:56:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PowerQuest
    [2009/01/24 05:39:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WholeSecurity
    [2009/01/09 03:50:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\ACD Systems
    [2009/01/30 14:02:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\GARMIN
    [2009/01/09 05:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\HotSync
    [2005/09/08 05:08:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Hyperionics
    [2004/11/11 13:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\IsolatedStorage
    [2004/11/11 12:32:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Leadertech
    [2006/10/12 14:49:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Snapfish
    [2005/01/02 11:27:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Spell Catcher Plus
    [2010/11/28 01:44:47 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
    [2010/11/28 01:42:52 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/01/09 16:22:48 | 000,004,262 | ---- | M] () -- C:\additdiag.txt
    [2005/02/10 17:05:31 | 000,000,434 | ---- | M] () -- C:\ApplyPatch.cmd
    [2004/10/31 14:21:11 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2004/11/05 04:36:23 | 000,518,792 | RHS- | M] () -- C:\AVG6DB_F.DAT
    [2004/11/05 10:41:47 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2004/11/05 10:41:47 | 000,000,211 | -HS- | M] () -- C:\BOOT.BKK
    [2010/11/26 12:05:38 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/11/26 12:24:21 | 000,010,148 | ---- | M] () -- C:\ComboFix.txt
    [2004/10/31 14:21:11 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2005/02/10 17:05:31 | 000,040,720 | ---- | M] (Microsoft Corporation) -- C:\DRIVERS.EXE
    [2005/02/11 16:24:57 | 000,010,155 | ---- | M] () -- C:\drivers.txt
    [2004/10/31 14:21:11 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2004/10/31 14:21:11 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
    [2010/11/28 01:38:54 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
    [2005/02/10 17:05:33 | 000,000,251 | ---- | M] () -- C:\PQIMount.reg
    [2005/02/10 17:05:33 | 000,000,401 | ---- | M] () -- C:\PQV2i.reg

    < %systemroot%\Fonts\*.com >

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/10/31 14:20:38 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >
    [2005/01/18 15:03:02 | 000,318,916 | ---- | M] () -- C:\WINDOWS\ElectricWindows.jpg

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004/10/31 09:01:58 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2004/10/31 09:01:58 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2004/10/31 09:01:58 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2004/10/31 14:21:18 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2004/10/31 14:29:26 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2010/11/25 09:09:20 | 000,000,101 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/09/23 02:17:04 | 013,525,424 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\Dropbox 0.7.110.exe
    [2010/11/25 06:03:04 | 001,004,072 | ---- | M] (Magical Jelly Bean ) -- C:\Documents and Settings\Ron\Desktop\KeyFinderInstaller.exe
    [2010/11/26 12:39:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\MBRCheck.exe
    [2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
    [2010/09/01 15:33:50 | 000,083,968 | ---- | M] (eSage Lab) -- C:\Documents and Settings\Ron\Desktop\remover.exe
    [2010/11/25 07:07:06 | 006,463,660 | ---- | M] (Punk Software ) -- C:\Documents and Settings\Ron\Desktop\RocketDock-v1.3.5.exe
    [2009/01/09 15:17:11 | 331,805,736 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Ron\Desktop\WindowsXP-KB936929-SP3-x86-ENU.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2010/11/25 09:09:20 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Ron\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/11/28 01:42:49 | 000,065,536 | ---- | M] () -- C:\Documents and Settings\Ron\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2004/09/22 16:46:10 | 000,192,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2004/08/04 05:00:00 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 00:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 00:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 07:22:02 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2004/08/04 00:06:34 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2004/10/13 09:24:37 | 001,694,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/04 05:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 05:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 05:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/04 00:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 00:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-11-25 15:38:46


    < End of report >
  10. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    OTL Extras logfile created on: 11/28/2010 1:51:09 AM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Ron\Desktop
    Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1,023.00 Mb Total Physical Memory | 696.00 Mb Available Physical Memory | 68.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 29.29 Gb Total Space | 20.33 Gb Free Space | 69.41% Space Free | Partition Type: NTFS
    Drive D: | 45.26 Gb Total Space | 32.23 Gb Free Space | 71.21% Space Free | Partition Type: NTFS
    Drive E: | 591.50 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

    Computer Name: SHUTTLE | User Name: Ron | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [ACDSee Pro 2.5.Browse] -- "C:\Program Files\ACD Systems\ACDSee Pro\2.5\ACDSeeQVPro25.exe" "%1" (ACD Systems)
    Directory [Browse with &IrfanView] -- "D:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:*:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:*:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:*:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:*:Enabled:mad:xpsp2res.dll,-22002

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22002

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{01BDFB08-EE88-4E5E-94A6-AE9EDCFA40C5}" = Microsoft IntelliPoint 4.0
    "{121634B0-2F4A-11D3-ADA3-00C04F52DD53}" = Windows Installer Clean Up
    "{1A2E804D-0AB2-424A-A72E-E104E5C4A0B8}" = MapSource - US Topo 24K National Parks, West v2
    "{1BF38C77-E678-49AF-885A-BBD10AED2FF3}" = ACDSee RAW Image Decoder Plug-In Update 4.0
    "{1E5007FA-DA5E-4EDD-BDE5-14D128D66887}" = PowerQuest PartitionMagic 7.0
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{261B0BDC-13A6-4B1D-A27D-B4803A58294F}" = Spell Catcher Plus
    "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 22
    "{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006
    "{2A1A690D-7030-4B92-A93B-B80378F1F580}" = Diskeeper Professional Edition
    "{2D95950E-6D76-43E7-94A5-D9DBA2FD29E4}" = ACDSee Pro 2.5
    "{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
    "{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{5414086B-AE06-4332-8A59-26FF0F630D1B}" = Garmin Trip and Waypoint Manager v3
    "{5E3CFCA6-C95A-47CB-A822-7FA80D423AF2}" = MapSource
    "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{74EC78BC-B379-4E29-9006-8F161DCAABA6}" = Apple Software Update
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{8D538DFC-1E7A-45F0-9C7B-D8B6629CC2DC}" = PowerQuest Drive Image 7.0
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
    "{974530D2-AE96-4C99-B549-99CADA653CE5}" = Garmin MapSource
    "{A75949C3-DC28-42CA-9C56-24C002B93D89}" = Garmin City Navigator North America v8
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0.7
    "{AD4203ED-7683-435E-B436-C299773A9936}" = MapSource - US Topo v3.02
    "{C7793EE8-F666-4E6B-9827-76468679480E}" = Tweakui Powertoy for Windows XP
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
    "{D7A6C517-11F2-419F-B5BB-27772B939698}" = NvMixer
    "{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
    "{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
    "7-Zip" = 7-Zip 4.64
    "Adaptec UDF Reader" = Adaptec UDF Reader
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "CCleaner" = CCleaner
    "CdaC13Ba" = Cda Product Service - shared component
    "FileBox eXtender" = FileBox eXtender
    "GeoBuddy_is1" = GeoBuddy 3.0
    "Google Chrome" = Google Chrome
    "Google Updater" = Google Updater
    "Icon Restore_is1" = Icon Restore 1.0
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "ie8" = Windows Internet Explorer 8
    "IrfanView" = IrfanView (remove only)
    "KeyFinder_is1" = Magical Jelly Bean KeyFinder
    "Linksys PrintServer Driver" = Linksys PrintServer Driver
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft Security Essentials" = Microsoft Security Essentials
    "Motherboard Monitor 5_is1" = Motherboard Monitor 5
    "Movielink Manager" = Movielink Manager
    "Mozilla Firefox (3.0.6)" = Mozilla Firefox (3.0.6)
    "MSN Music Assistant" = MSN Music Assistant
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "NVIDIA Drivers" = NVIDIA Drivers
    "RealPlayer 6.0" = RealPlayer
    "Revo Uninstaller" = Revo Uninstaller 1.90
    "ShockwaveFlash" = Macromedia Flash Player 8
    "WGA" = Windows Genuine Advantage Validation Tool
    "Windows Media Format Runtime" = Windows Media Format Runtime
    "Windows Media Player" = Windows Media Player 10
    "WinFlash" = WinFlash

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 11/25/2010 2:21:35 PM | Computer Name = SHUTTLE | Source = Application Hang | ID = 1002
    Description = Hanging application explorer.exe, version 6.0.2900.3156, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 11/25/2010 2:21:35 PM | Computer Name = SHUTTLE | Source = Application Hang | ID = 1002
    Description = Hanging application explorer.exe, version 6.0.2900.3156, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 11/26/2010 6:31:10 AM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
    Description = Description: Unable to successfully reconcile changes since last session.
    Unable to enumerate the current drives on this system. Cannot initialize the Storage
    Management Engine. Error E0020002: Device \\.\PhysicalDrive0 cannot be opened. Error
    00000020: The process cannot access the file because it is being used by another
    process. Details: 0xE0020002 Source: PowerQuest Drive Image 7.0

    Error - 11/26/2010 6:31:16 AM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
    Description = Description: Unable to successfully reconcile changes since last session.
    Unable to enumerate the current drives on this system. Cannot initialize the Storage
    Management Engine. Error E0020002: Device \\.\PhysicalDrive0 cannot be opened. Error
    00000020: The process cannot access the file because it is being used by another
    process. Details: 0xE0020002 Source: PowerQuest Drive Image 7.0

    Error - 11/26/2010 6:40:37 AM | Computer Name = SHUTTLE | Source = Google Update | ID = 20
    Description =

    Error - 11/26/2010 2:38:06 PM | Computer Name = SHUTTLE | Source = Google Update | ID = 20
    Description =

    Error - 11/26/2010 3:16:22 PM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
    Description = Description: Unable to successfully reconcile changes since last session.
    Unable to enumerate the current drives on this system. Cannot initialize the Storage
    Management Engine. Details: Unspecified error Source: PowerQuest Drive Image 7.0

    Error - 11/26/2010 3:19:38 PM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
    Description = Description: Unable to successfully reconcile changes since last session.
    Unable to enumerate the current drives on this system. Cannot initialize the Storage
    Management Engine. Details: Unspecified error Source: PowerQuest Drive Image 7.0

    Error - 11/26/2010 3:19:40 PM | Computer Name = SHUTTLE | Source = MPSampleSubmission | ID = 5000
    Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 2.1.6805.0,
    P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
    P8 NIL, P9 NIL, P10 NIL.

    Error - 11/26/2010 3:21:28 PM | Computer Name = SHUTTLE | Source = Application Error | ID = 1000
    Description = Faulting application PQV2iSvc.exe, version 2.0.1.309, faulting module
    PQSmeCOM.dll, version 2.0.1.309, fault address 0x00318da0.

    [ System Events ]
    Error - 11/26/2010 4:27:30 PM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
    Description = The mrtRate service failed to start due to the following error: %%2

    Error - 11/26/2010 6:29:37 PM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
    Description = The mrtRate service failed to start due to the following error: %%2

    Error - 11/27/2010 4:50:32 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
    Description = The mrtRate service failed to start due to the following error: %%2

    Error - 11/27/2010 5:25:26 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
    Description = The mrtRate service failed to start due to the following error: %%2

    Error - 11/27/2010 5:45:05 AM | Computer Name = SHUTTLE | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service netman with
    arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

    Error - 11/27/2010 5:45:07 AM | Computer Name = SHUTTLE | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service EventSystem
    with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

    Error - 11/27/2010 5:47:50 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
    Description = The mrtRate service failed to start due to the following error: %%2

    Error - 11/27/2010 4:06:59 PM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
    Description = The mrtRate service failed to start due to the following error: %%2

    Error - 11/27/2010 4:17:43 PM | Computer Name = SHUTTLE | Source = Ntfs | ID = 262199
    Description = The file system structure on the disk is corrupt and unusable. Please
    run the chkdsk utility on the volume C:.

    Error - 11/28/2010 4:39:23 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
    Description = The mrtRate service failed to start due to the following error: %%2


    < End of report >
  11. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O2 - BHO: (no name) - {C333CF63-767F-4831-94AC-E683D962C63C} - No CLSID value found.
      O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
      
      
      :Services
      
      :Reg
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ========================================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  12. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C333CF63-767F-4831-94AC-E683D962C63C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C333CF63-767F-4831-94AC-E683D962C63C}\ deleted successfully.
    Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: NetworkService
    ->Temp folder emptied: 16440 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: Ron
    ->Temp folder emptied: 2007 bytes
    ->Temporary Internet Files folder emptied: 5285706 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 8061098 bytes
    ->Google Chrome cache emptied: 4906645 bytes
    ->Flash cache emptied: 405 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1342475 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 1848 bytes

    Total Files Cleaned = 19.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: NetworkService

    User: Ron
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.3 log created on 11282010_141829

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
  13. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 2
    Out of date service pack!!
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    Microsoft Security Essentials
    Antivirus up to date!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    CCleaner
    Java(TM) 6 Update 22
    Java(TM) 6 Update 2
    Out of date Java installed!
    Adobe Flash Player 10.0.12.36
    Adobe Reader 7.0.7
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.0.6) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Windows Defender MSMpEng.exe
    Microsoft Security Essentials msseces.exe
    ````````````````````````````````
    DNS Vulnerability Check:

    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````
  14. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Update Firefox to current 3.6.12 version.

    ========================================================================

    We need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    ====================================================================

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [​IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button
  15. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    ESETScan results

    D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe probably a variant of Win32/Genetik trojan
    Operating memory probably a variant of Win32/Genetik trojan
  16. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      
      :Services
      
      :Reg
      
      :Files
      D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =====================================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current (now, you're ready to try SP3 again)

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
  17. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    All processes killed
    ========== OTL ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 2286 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Ron
    ->Temp folder emptied: 401 bytes
    ->Temporary Internet Files folder emptied: 11005890 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 61742947 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 405 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 2061 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 69.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: NetworkService

    User: Ron
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.3 log created on 11292010_031741

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
  18. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 1226 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Ron
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 5517251 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 671 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1273 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 5.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: NetworkService

    User: Ron
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.17.3 log created on 11292010_032320

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
  19. NorGitram

    NorGitram TS Rookie Topic Starter Posts: 66

    SP3 installed fine now, and the computer seems fine also.
    Thanks for all your help and quick responses.
  20. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Way to go!! [​IMG]
    Good luck and stay safe :)
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.