Solved Can't install XP Service Pack 3 on old computer

NorGitram · Nov 26, 2010

I get this error message

---------------------------
Service Pack 3 Setup Error
---------------------------
The file c:\windows\system32\ntdll.dll is open or in use by another application.

Close all other applications and then click Retry.
---------------------------
Retry Cancel
---------------------------
Logs

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5191

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

11/26/2010 3:23:02 AM
mbam-log-2010-11-26 (03-23-02).txt

Scan type: Quick scan
Objects scanned: 132391
Time elapsed: 7 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-11-26 03:31:11
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0 MAXTOR_6 rev.A93.
Running: 22edji9z.exe; Driver: C:\DOCUME~1\Ron\LOCALS~1\Temp\fwldypow.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs PQV2i.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \FileSystem\Fastfat \Fat PQV2i.sys (StorageCraft Volume Snap-Shot/StorageCraft)

---- EOF - GMER 1.0.15 ----

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-26.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 10/31/2004 2:24:00 PM
System Uptime: 11/26/2010 3:24:27 AM (0 hours ago)

Motherboard: Shuttle Inc | | FN41SP
Processor: AMD Athlon(tm) XP 1500+ | Socket A | 1293/100mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 29 GiB total, 20.377 GiB free.
D: is FIXED (NTFS) - 45 GiB total, 32.226 GiB free.
E: is CDROM (UDF)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP268: 11/25/2010 9:31:58 AM - Revo Uninstaller's restore point - PayPal Plug-In
RP269: 11/25/2010 9:32:21 AM - Removed PayPal Plug-In
RP270: 11/25/2010 9:33:23 AM - Revo Uninstaller's restore point - Documents To Go
RP271: 11/25/2010 9:33:44 AM - Removed Documents To Go
RP272: 11/25/2010 9:35:28 AM - Revo Uninstaller's restore point - Combat Mission Afrika Korps
RP273: 11/25/2010 9:37:22 AM - Revo Uninstaller's restore point - Motorola Phone Tools
RP274: 11/25/2010 9:37:33 AM - Removed Motorola Phone Tools
RP275: 11/25/2010 9:37:36 AM - Removed Motorola Phone Tools
RP276: 11/25/2010 9:37:39 AM - Removed Motorola Phone Tools
RP277: 11/25/2010 9:38:45 AM - Revo Uninstaller's restore point - Tweak-SE plug-in for Ad-Aware SE
RP278: 11/25/2010 9:39:15 AM - Revo Uninstaller's restore point - Ad-Aware SE Personal
RP279: 11/25/2010 9:40:28 AM - Revo Uninstaller's restore point - Messenger-Control plug-in for Ad-Aware SE
RP280: 11/25/2010 9:41:12 AM - Revo Uninstaller's restore point - OE/W Messengerctrl plug-in for Ad-Aware SE
RP281: 11/25/2010 9:41:39 AM - Revo Uninstaller's restore point - Palm
RP282: 11/25/2010 9:41:55 AM - Removed Palm
RP283: 11/25/2010 9:42:48 AM - Revo Uninstaller's restore point - VX2 Cleaner plug-in for Ad-Aware SE
RP284: 11/25/2010 9:43:41 AM - Revo Uninstaller's restore point - Spybot - Search & Destroy 1.4

==== Installed Programs ======================

7-Zip 4.64
ACDSee Pro 2.5
ACDSee RAW Image Decoder Plug-In Update 4.0
Adaptec UDF Reader
Adobe Flash Player 10 Plugin
Adobe Reader 7.0.7
Apple Software Update
CCleaner
Cda Product Service - shared component
Diskeeper Professional Edition
FileBox eXtender
Garmin City Navigator North America v8
Garmin MapSource
Garmin Trip and Waypoint Manager v3
GeoBuddy 3.0
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB981793)
Icon Restore 1.0
IrfanView (remove only)
J2SE Runtime Environment 5.0 Update 6
Java Auto Updater
Java(TM) 6 Update 2
Java(TM) 6 Update 22
Linksys PrintServer Driver
Macromedia Flash Player 8
Magical Jelly Bean KeyFinder
Malwarebytes' Anti-Malware
MapSource
MapSource - US Topo 24K National Parks, West v2
MapSource - US Topo v3.02
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft IntelliPoint 4.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Security Essentials
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Motherboard Monitor 5
Movielink Manager
Mozilla Firefox (3.0.6)
MSN Music Assistant
NVIDIA Drivers
NvMixer
PowerDVD
PowerQuest Drive Image 7.0
PowerQuest PartitionMagic 7.0
Quicken 2006
QuickTime
RealPlayer
Revo Uninstaller 1.90
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Spell Catcher Plus
SUPERAntiSpyware
Tweakui Powertoy for Windows XP
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB914882)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Internet Explorer 8
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinFlash

==== Event Viewer Messages From Past Week ========

11/26/2010 3:36:50 AM, error: Service Control Manager [7016] - The GEARSecurity service has reported an invalid current state 0.
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The V2i Protector service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The UStorage Server Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The Movielink Core Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The GEARSecurity service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The Diskeeper service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7034] - The C-DillaCdaC11BA service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 3:04:38 AM, error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
11/26/2010 3:04:38 AM, error: Service Control Manager [7031] - The Google Updater Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 900000 milliseconds: Restart the service.
11/25/2010 9:52:38 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 9:37:55 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\drivers\usbser.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.2180.
11/25/2010 9:28:08 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 9:19:31 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 9:04:49 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 8:57:31 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 8:38:41 AM, error: NtServicePack [4373] - Windows XP KB956572 installation failed.
An internal error occurred.
11/25/2010 8:38:16 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 8:33:30 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8007054f: Windows XP Service Pack 3 (KB936929).
11/25/2010 8:33:13 AM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 7:56:35 AM, error: NtServicePack [4373] - Windows XP KB956572 installation failed.
An internal error occurred.
11/25/2010 6:47:22 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8007054f: Security Update for Windows XP (KB956572).
11/25/2010 6:47:17 AM, error: NtServicePack [4373] - Windows XP KB956572 installation failed.
An internal error occurred.
11/25/2010 6:07:50 AM, error: EventLog [6004] - A driver packet received from the I/O subsystem was invalid. The data is the packet.
11/25/2010 5:50:05 AM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified.
11/25/2010 12:36:27 PM, error: NtServicePack [4373] - Windows XP Service Pack 3 installation failed.
An internal error occurred.
11/25/2010 11:25:15 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
11/25/2010 11:25:07 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
11/25/2010 11:24:38 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK7 Fips IPSec mbmiodrvr MpFilter MRxSmb NetBIOS NetBT PQIMount RasAcd Rdbss Tcpip
11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/25/2010 11:24:38 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
11/25/2010 11:23:15 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

==== End Of File ===========================

DDS (Ver_10-11-26.01) - NTFSx86
Run by Ron at 3:36:47.92 on Fri 11/26/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.644 [GMT -7:00]

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\FileBX\FileBX.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
D:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\UStorSrv.exe
D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ron\Desktop\Scans\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.comcast.net/explore.html
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uWindow Title =
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: {c333cf63-767f-4831-94ac-e683d962c63c} - CoTGT_BHO Class
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [updateMgr] "d:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
mRun: [MBM 5] "d:\program files\motherboard monitor 5\MBM5.EXE"
mRun: [DiskeeperSystray] "d:\program files\executive software\diskeeper\DkIcon.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [POINTER] point32.exe
mRun: [<NO NAME>]
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [LoadMSvcmm] "d:\program files\movielink\movielinkmanager\Movielink User.exe"
mRun: [QuickTime Task] "d:\program files\quicktime\QTTask.exe" -atboottime
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
StartupFolder: c:\docume~1\ron\startm~1\programs\startup\filebo~1.lnk - d:\program files\filebx\FileBX.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - d:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - hxxps://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photo.walgreens.com/WalgreensActivia.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1290690552625
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - hxxps://www-secure.symantec.com/techsupp/asa/SymAData.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ron\applic~1\mozilla\firefox\profiles\sgyupw4s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - plugin: c:\program files\google\google updater\2.4.1439.6872\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.133.37\npGoogleOneClick7.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\program files\adobe\acrobat 7.0\reader\browser\nppdf32.dll
FF - plugin: d:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: d:\program files\mozilla firefox\plugins\npsnapfish.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin2.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin3.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin4.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin5.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin6.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin7.dll
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2003-9-12 132899]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]
R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2003-9-12 46810]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
S2 gupdate1c985725098acde;Google Update Service (gupdate1c985725098acde);c:\program files\google\update\GoogleUpdate.exe [2009-2-2 133104]
S2 mrtRate;mrtRate; [x]

=============== Created Last 30 ================

2010-11-26 10:34:15 6273872 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{97f1599c-1d61-4690-9448-0aa13af080f9}\mpengine.dll
2010-11-26 10:09:13 -------- d-----w- c:\docume~1\ron\applic~1\Malwarebytes
2010-11-26 10:09:03 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-26 10:09:01 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-11-26 10:09:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-26 10:09:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-26 09:53:41 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-11-26 09:53:41 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2010-11-25 18:54:38 -------- d-----w- c:\docume~1\ron\applic~1\SUPERAntiSpyware.com
2010-11-25 18:54:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-11-25 18:54:29 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-11-25 18:35:41 -------- d-----w- c:\program files\CCleaner
2010-11-25 18:30:37 -------- d-sh--w- c:\documents and settings\ron\IECompatCache
2010-11-25 18:30:07 -------- d-sh--w- c:\documents and settings\ron\PrivacIE
2010-11-25 16:42:03 -------- d-----w- c:\program files\Palm
2010-11-25 14:26:30 -------- d-sh--w- c:\documents and settings\ron\IETldCache
2010-11-25 14:01:28 -------- d-----w- c:\windows\ie8updates
2010-11-25 14:00:54 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-11-25 14:00:53 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-11-25 14:00:53 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-11-25 13:59:17 -------- dc-h--w- c:\windows\ie8
2010-11-25 13:50:48 -------- d-----w- c:\windows\ServicePackFiles
2010-11-25 13:07:02 -------- d-----w- c:\program files\Magical Jelly Bean
2010-11-25 12:58:30 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-11-25 12:56:51 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-11-25 12:38:55 472808 ----a-w- c:\windows\system32\deployJava1.dll

==================== Find3M ====================

2010-09-15 09:29:49 73728 ----a-w- c:\windows\system32\javacpl.cpl

============= FINISH: 3:37:49.54 ===============

Broni · Nov 26, 2010

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=========================================================================

Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

=======================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AVG Remover to uninstall it: http://www.avg.com/us-en/download-tools
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.pif
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

NorGitram · Nov 26, 2010

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 129):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EC000 \WINDOWS\system32\hal.dll
0xF7D2F000 \WINDOWS\system32\KDCOM.DLL
0xF7C3F000 \WINDOWS\system32\BOOTVID.dll
0xF77E0000 ACPI.sys
0xF7D31000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF77CF000 pci.sys
0xF782F000 isapnp.sys
0xF783F000 ohci1394.sys
0xF784F000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7DF7000 pciide.sys
0xF7AAF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF785F000 MountMgr.sys
0xF77B0000 ftdisk.sys
0xF7D33000 dmload.sys
0xF778A000 dmio.sys
0xF7AB7000 PartMgr.sys
0xF786F000 VolSnap.sys
0xF7772000 atapi.sys
0xF7ABF000 nvidesm.sys
0xF775A000 \WINDOWS\system32\drivers\SCSIPORT.SYS
0xF787F000 disk.sys
0xF788F000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF773A000 fltMgr.sys
0xF7728000 sr.sys
0xF7713000 PQV2i.sys
0xF76FC000 KSecDD.sys
0xF766F000 Ntfs.sys
0xF7642000 NDIS.sys
0xF7C43000 nv_agp.sys
0xF7627000 Mup.sys
0xF7DF8000 giveio.sys
0xF79FF000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF7A4F000 \SystemRoot\system32\DRIVERS\amdk7.sys
0xF7B0F000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6ED9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7B17000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6EC5000 \SystemRoot\system32\DRIVERS\NVENET.sys
0xF7A5F000 \SystemRoot\system32\drivers\nvax.sys
0xF7A6F000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7A7F000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6EA2000 \SystemRoot\system32\DRIVERS\ks.sys
0xF75E2000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
0xF6BEF000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6BDB000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7B1F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7A8F000 \SystemRoot\system32\DRIVERS\serial.sys
0xF75DA000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF6BC7000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7A9F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7B27000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7F64000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF78BF000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF75D6000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6BB0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF78CF000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF78DF000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7B2F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6B9F000 \SystemRoot\system32\DRIVERS\psched.sys
0xF78EF000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7C07000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7C2F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF515B000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF6AFF000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7C37000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7D95000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF50D7000 \SystemRoot\system32\DRIVERS\update.sys
0xF7CDB000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF60CF000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF609F000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7D9D000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF480C000 \SystemRoot\system32\drivers\nvapu.sys
0xF47E8000 \SystemRoot\system32\drivers\portcls.sys
0xF606F000 \SystemRoot\system32\drivers\drmk.sys
0xF4703000 \SystemRoot\system32\drivers\nvmcp.sys
0xF46F2000 \SystemRoot\system32\drivers\nvarm.sys
0xF177F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xEFCA1000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xF183D000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF14EB000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF1655000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7DCF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7EE1000 \SystemRoot\System32\Drivers\Null.SYS
0xF7DD1000 \SystemRoot\System32\Drivers\Beep.SYS
0xF1645000 \SystemRoot\System32\drivers\vga.sys
0xF7DD3000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7DD5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF163D000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF1635000 \SystemRoot\System32\Drivers\Npfs.SYS
0xEFC4E000 \SystemRoot\System32\Drivers\UdfReadr.SYS
0xF1481000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEFC29000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEFBD1000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEFBA9000 \SystemRoot\system32\DRIVERS\netbt.sys
0xEFB87000 \SystemRoot\System32\drivers\afd.sys
0xF14DB000 \SystemRoot\system32\DRIVERS\netbios.sys
0xEFB65000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF162D000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xEFB3A000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF0ED9000 \SystemRoot\System32\Drivers\PQIMount.SYS
0xEFACB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7ECB000 \??\C:\WINDOWS\system32\mbmiodrvr.sys
0xF0EB9000 \SystemRoot\System32\Drivers\Fips.SYS
0xEFAAA000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF0EA9000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF0E99000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xF7D07000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF28D5000 \SystemRoot\system32\DRIVERS\IPFilter.sys
0xEFA99000 \SystemRoot\System32\Drivers\Udfs.SYS
0xF6F0C000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0xF161D000 \SystemRoot\System32\Drivers\dump_nvidesm.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7CEF000 \SystemRoot\System32\drivers\Dxapi.sys
0xF1615000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7F62000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xF6F20000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xED92C000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF1767000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEE9F1000 \??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS
0xED89F000 \SystemRoot\system32\drivers\wdmaud.sys
0xF547D000 \SystemRoot\system32\drivers\sysaudio.sys
0xED59A000 \SystemRoot\system32\DRIVERS\srv.sys
0xED199000 \SystemRoot\System32\Drivers\HTTP.sys
0xECFBE000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF7B37000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xECF93000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 39):
0 System Idle Process
4 System
664 C:\WINDOWS\system32\smss.exe
728 csrss.exe
752 C:\WINDOWS\system32\winlogon.exe
796 C:\WINDOWS\system32\services.exe
808 C:\WINDOWS\system32\lsass.exe
952 C:\WINDOWS\system32\svchost.exe
1032 svchost.exe
1068 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
1108 C:\WINDOWS\system32\svchost.exe
1192 svchost.exe
1412 svchost.exe
1572 C:\WINDOWS\explorer.exe
1612 C:\WINDOWS\system32\spoolsv.exe
1752 C:\WINDOWS\system32\drivers\CDAC11BA.EXE
1800 D:\Program Files\Executive Software\Diskeeper\DkService.exe
1920 D:\Program Files\Motherboard Monitor 5\MBM5.exe
1972 C:\WINDOWS\system32\rundll32.exe
1980 C:\Program Files\Microsoft Hardware\Mouse\point32.exe
1988 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1996 C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
2016 D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
124 C:\Program Files\Microsoft Security Essentials\msseces.exe
164 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
172 C:\WINDOWS\system32\ctfmon.exe
336 D:\Program Files\FileBX\FileBX.exe
548 C:\WINDOWS\system32\gearsec.exe
576 C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
624 C:\Program Files\Java\jre6\bin\jqs.exe
772 D:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
1160 C:\WINDOWS\system32\nvsvc32.exe
1304 C:\WINDOWS\system32\svchost.exe
1456 wdfmgr.exe
1508 C:\WINDOWS\system32\UStorSrv.exe
1692 D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
2860 alg.exe
3176 C:\WINDOWS\system32\wuauclt.exe
3728 C:\Documents and Settings\Ron\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000007`52c65e00 (NTFS)

PhysicalDrive0 Model Number: MAXTOR 6L080L4, Rev: A93.

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0

ComboFix 10-11-25.06 - Ron 11/26/2010 12:15:54.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.705 [GMT -7:00]
Running from: c:\documents and settings\Ron\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\kernel1.exe

.
((((((((((((((((((((((((( Files Created from 2010-10-26 to 2010-11-26 )))))))))))))))))))))))))))))))
.

2010-11-26 10:34 . 2010-11-10 03:33 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{97F1599C-1D61-4690-9448-0AA13AF080F9}\mpengine.dll
2010-11-26 10:09 . 2010-11-26 10:09 -------- d-----w- c:\documents and settings\Ron\Application Data\Malwarebytes
2010-11-26 10:09 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-26 10:09 . 2010-11-26 10:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-26 10:09 . 2010-11-26 10:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-26 10:09 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-26 09:53 . 2009-08-07 02:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-11-25 18:54 . 2010-11-25 18:54 -------- d-----w- c:\documents and settings\Ron\Application Data\SUPERAntiSpyware.com
2010-11-25 18:54 . 2010-11-25 18:54 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-11-25 18:54 . 2010-11-25 18:54 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-11-25 18:35 . 2010-11-25 18:35 -------- d-----w- c:\program files\CCleaner
2010-11-25 18:30 . 2010-11-25 18:30 -------- d-sh--w- c:\documents and settings\Ron\IECompatCache
2010-11-25 18:30 . 2010-11-25 18:30 -------- d-sh--w- c:\documents and settings\Ron\PrivacIE
2010-11-25 17:55 . 2010-11-25 17:55 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-25 16:42 . 2010-11-25 16:42 -------- d-----w- c:\program files\Palm
2010-11-25 14:26 . 2010-11-25 14:26 -------- d-sh--w- c:\documents and settings\Ron\IETldCache
2010-11-25 14:00 . 2010-05-06 10:41 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-11-25 14:00 . 2010-05-06 10:41 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-11-25 14:00 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-11-25 13:59 . 2010-11-25 14:00 -------- dc-h--w- c:\windows\ie8
2010-11-25 13:50 . 2010-11-25 13:50 -------- d-----w- c:\windows\ServicePackFiles
2010-11-25 13:07 . 2010-11-25 13:07 -------- d-----w- c:\program files\Magical Jelly Bean
2010-11-25 12:58 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-11-25 12:56 . 2010-11-25 12:57 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-11-25 12:38 . 2010-09-15 11:50 472808 ----a-w- c:\windows\system32\deployJava1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-15 09:29 . 2007-09-17 20:44 73728 ----a-w- c:\windows\system32\javacpl.cpl
.

------- Sigcheck -------

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\sfcfiles.dll
[-] 2004-08-04 . F2F5FF05C9F93894C9FA8A6FBDE94330 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
[7] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 68856]
"updateMgr"="d:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 307200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MBM 5"="d:\program files\Motherboard Monitor 5\MBM5.EXE" [2004-06-12 594944]
"DiskeeperSystray"="d:\program files\Executive Software\Diskeeper\DkIcon.exe" [2004-11-13 180312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"nwiz"="nwiz.exe" [2004-10-29 921600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"LoadMSvcmm"="d:\program files\Movielink\MovielinkManager\Movielink User.exe" [2005-08-30 112224]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - d:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax.com Tray Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\eFax.com Tray Menu.lnk
backup=c:\windows\pss\eFax.com Tray Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ------w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [9/12/2003 1:19 PM 132899]
R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [9/12/2003 1:48 PM 46810]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
S2 gupdate1c985725098acde;Google Update Service (gupdate1c985725098acde);c:\program files\Google\Update\GoogleUpdate.exe [2/2/2009 1:10 PM 133104]
S2 mrtRate;mrtRate; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 20:42]

2010-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 20:10]

2010-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-02 20:10]

2010-11-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 04:40]

2010-11-26 c:\windows\Tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comcast.net/explore.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
FF - ProfilePath - c:\documents and settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - plugin: c:\program files\Google\Google Updater\2.4.1439.6872\npCIDetect13.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npsnapfish.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin7.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-POINTER - point32.exe
Notify-AtiExtEvent - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-26 12:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2010-11-26 12:24:21
ComboFix-quarantined-files.txt 2010-11-26 19:24

Pre-Run: 21,803,261,952 bytes free
Post-Run: 21,765,206,016 bytes free

- - End Of File - - 13B3315C91B7FE6C9B867B633512EE26

Broni · Nov 26, 2010

The last few lines of MBRCheck log are missing.
Please, repost.

NorGitram · Nov 27, 2010

MBRCheck freezes my computer. I have to reboot, this is all that in the text file.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 128):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EC000 \WINDOWS\system32\hal.dll
0xF7D2F000 \WINDOWS\system32\KDCOM.DLL
0xF7C3F000 \WINDOWS\system32\BOOTVID.dll
0xF77E0000 ACPI.sys
0xF7D31000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF77CF000 pci.sys
0xF782F000 isapnp.sys
0xF783F000 ohci1394.sys
0xF784F000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7DF7000 pciide.sys
0xF7AAF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF785F000 MountMgr.sys
0xF77B0000 ftdisk.sys
0xF7D33000 dmload.sys
0xF778A000 dmio.sys
0xF7AB7000 PartMgr.sys
0xF786F000 VolSnap.sys
0xF7772000 atapi.sys
0xF7ABF000 nvidesm.sys
0xF775A000 \WINDOWS\system32\drivers\SCSIPORT.SYS
0xF787F000 disk.sys
0xF788F000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF773A000 fltMgr.sys
0xF7728000 sr.sys
0xF7713000 PQV2i.sys
0xF76FC000 KSecDD.sys
0xF766F000 Ntfs.sys
0xF7642000 NDIS.sys
0xF7C43000 nv_agp.sys
0xF7627000 Mup.sys
0xF7DF8000 giveio.sys
0xF7A0F000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF79BF000 \SystemRoot\system32\DRIVERS\amdk7.sys
0xF7B0F000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6E3F000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7B17000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6E2B000 \SystemRoot\system32\DRIVERS\NVENET.sys
0xF79CF000 \SystemRoot\system32\drivers\nvax.sys
0xF79DF000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF79EF000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6E08000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7D1F000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
0xF6B55000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6B41000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7B1F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF79FF000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7D27000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF6B2D000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7A1F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7B27000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7EE5000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7A2F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7D2B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6B16000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7A3F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7A6F000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7B37000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6AEE000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7A7F000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7C07000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7C2F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF4933000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF62F2000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7C37000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7D91000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF48F5000 \SystemRoot\system32\DRIVERS\update.sys
0xF6AE6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF4B72000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF4B62000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7DA3000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF3E32000 \SystemRoot\system32\drivers\nvapu.sys
0xF3E0E000 \SystemRoot\system32\drivers\portcls.sys
0xF4B22000 \SystemRoot\system32\drivers\drmk.sys
0xF3D29000 \SystemRoot\system32\drivers\nvmcp.sys
0xF3D18000 \SystemRoot\system32\drivers\nvarm.sys
0xF0EED000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xEF40E000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xF7DEB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF492D000 \SystemRoot\System32\Drivers\Null.SYS
0xF7DB7000 \SystemRoot\System32\Drivers\Beep.SYS
0xF0EDD000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF0ED5000 \SystemRoot\System32\drivers\vga.sys
0xF7DBB000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7DBD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF0ECD000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF061B000 \SystemRoot\System32\Drivers\Npfs.SYS
0xEF3BB000 \SystemRoot\System32\Drivers\UdfReadr.SYS
0xF49B0000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEF396000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEF33E000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEF316000 \SystemRoot\system32\DRIVERS\netbt.sys
0xEF2F4000 \SystemRoot\System32\drivers\afd.sys
0xF0DA5000 \SystemRoot\system32\DRIVERS\netbios.sys
0xEF2D2000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF0613000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xEF2A7000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF0D95000 \SystemRoot\System32\Drivers\PQIMount.SYS
0xEF238000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF483B000 \??\C:\WINDOWS\system32\mbmiodrvr.sys
0xF0D75000 \SystemRoot\System32\Drivers\Fips.SYS
0xEF217000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF0718000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF0708000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xF6ADE000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF06E8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF49C8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF6202000 \SystemRoot\system32\DRIVERS\IPFilter.sys
0xEF206000 \SystemRoot\System32\Drivers\Udfs.SYS
0xF6ADA000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0xF0603000 \SystemRoot\System32\Drivers\dump_nvidesm.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xF49B8000 \SystemRoot\System32\drivers\Dxapi.sys
0xF05FB000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7E52000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xEE1D2000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xED039000 \SystemRoot\system32\drivers\wdmaud.sys
0xF6ED2000 \SystemRoot\system32\drivers\sysaudio.sys
0xECE4E000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF053F000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xECE7B000 \??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS
0xECCDF000 \SystemRoot\system32\DRIVERS\srv.sys
0xEC88E000 \SystemRoot\System32\Drivers\HTTP.sys
0xEC68B000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xEC660000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 38):
0 System Idle Process
4 System
664 C:\WINDOWS\system32\smss.exe
728 csrss.exe
752 C:\WINDOWS\system32\winlogon.exe
796 C:\WINDOWS\system32\services.exe
808 C:\WINDOWS\system32\lsass.exe
960 C:\WINDOWS\system32\svchost.exe
1040 svchost.exe
1136 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
1172 C:\WINDOWS\system32\svchost.exe
1256 svchost.exe
1480 svchost.exe
1720 C:\WINDOWS\explorer.exe
1804 C:\WINDOWS\system32\spoolsv.exe
2008 D:\Program Files\Motherboard Monitor 5\MBM5.exe
184 C:\WINDOWS\system32\rundll32.exe
192 C:\Program Files\Common Files\Java\Java Update\jusched.exe
180 C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
204 D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
232 C:\Program Files\Microsoft Security Essentials\msseces.exe
240 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
484 D:\Program Files\FileBX\FileBX.exe
876 C:\WINDOWS\system32\drivers\CDAC11BA.EXE
984 D:\Program Files\Executive Software\Diskeeper\DkService.exe
1080 C:\WINDOWS\system32\gearsec.exe
1108 C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
1228 C:\Program Files\Java\jre6\bin\jqs.exe
1376 D:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
1668 C:\WINDOWS\system32\nvsvc32.exe
1628 C:\WINDOWS\system32\svchost.exe
1976 wdfmgr.exe
2068 C:\WINDOWS\system32\UStorSrv.exe
2116 D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
2248 C:\WINDOWS\system32\wuauclt.exe
3176 alg.exe
3928 C:\WINDOWS\system32\wuauclt.exe
1412 C:\Documents and Settings\Ron\Desktop\MBRCheck.exe

Øÿÿÿvk > ø@ m Reduce color\ A àÿÿÿvk < @@ A SaturateØÿÿÿvk n xÿ? C Luminance r o 2 Øÿÿÿvk
€ 6 MRUFloatStyleÔ6 Øÿÿÿvk € 6 MRUDockRightPos àÿÿÿvk €C 6 BarIDè6 *ÿÿÿnk ì=KŽ †É K< ÿÿÿÿÿÿÿÿ
Xæ6 ¨] ÿÿÿÿ MRUF
Toolbar-Bar11œ6 Øÿÿÿ

Broni · Nov 27, 2010

Let's try something else then...

Download Bootkit Remover to your Desktop.

You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.
It will show a Black screen with some data on it.
Right click on the screen and click Select All.
Press CTRL+C
Open a Notepad and press CTRL+V
Post the output back here.

NorGitram · Nov 27, 2010

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows XP Professional Service Pack 2 (build 2600)

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
ATA_Read(): DeviceIoControl() ERROR 1
Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)

Done;
Press any key to quit...

The Bootkit also saved this log to the desktop

.\debug.cpp(238) : Debug log started at 27.11.2010 - 20:17:42
.\boot_cleaner.cpp(527) : Bootkit Remover
.\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
.\boot_cleaner.cpp(529) : www.esagelab.com
.\boot_cleaner.cpp(533) : Program version: 1.2.0.0
.\boot_cleaner.cpp(540) : OS Version: Microsoft Windows XP Professional Service Pack 2 (build 2600)
.\debug.cpp(248) : **********************************************
.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
.\debug.cpp(250) : **********************************************
.\debug.cpp(256) : 0x804d7000 0x00214900 "\WINDOWS\system32\ntoskrnl.exe"
.\debug.cpp(256) : 0x806ec000 0x00020380 "\WINDOWS\system32\hal.dll"
.\debug.cpp(256) : 0xf7d2f000 0x00002000 "\WINDOWS\system32\KDCOM.DLL"
.\debug.cpp(256) : 0xf7c3f000 0x00003000 "\WINDOWS\system32\BOOTVID.dll"
.\debug.cpp(256) : 0xf77e0000 0x0002e000 "ACPI.sys"
.\debug.cpp(256) : 0xf7d31000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS"
.\debug.cpp(256) : 0xf77cf000 0x00011000 "pci.sys"
.\debug.cpp(256) : 0xf782f000 0x00009000 "isapnp.sys"
.\debug.cpp(256) : 0xf783f000 0x0000f000 "ohci1394.sys"
.\debug.cpp(256) : 0xf784f000 0x0000d000 "\WINDOWS\system32\DRIVERS\1394BUS.SYS"
.\debug.cpp(256) : 0xf7df7000 0x00001000 "pciide.sys"
.\debug.cpp(256) : 0xf7aaf000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS"
.\debug.cpp(256) : 0xf785f000 0x0000b000 "MountMgr.sys"
.\debug.cpp(256) : 0xf77b0000 0x0001f000 "ftdisk.sys"
.\debug.cpp(256) : 0xf7d33000 0x00002000 "dmload.sys"
.\debug.cpp(256) : 0xf778a000 0x00026000 "dmio.sys"
.\debug.cpp(256) : 0xf7ab7000 0x00005000 "PartMgr.sys"
.\debug.cpp(256) : 0xf786f000 0x0000d000 "VolSnap.sys"
.\debug.cpp(256) : 0xf7772000 0x00018000 "atapi.sys"
.\debug.cpp(256) : 0xf7abf000 0x00005000 "nvidesm.sys"
.\debug.cpp(256) : 0xf775a000 0x00018000 "\WINDOWS\system32\drivers\SCSIPORT.SYS"
.\debug.cpp(256) : 0xf787f000 0x00009000 "disk.sys"
.\debug.cpp(256) : 0xf788f000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS"
.\debug.cpp(256) : 0xf773a000 0x00020000 "fltMgr.sys"
.\debug.cpp(256) : 0xf7728000 0x00012000 "sr.sys"
.\debug.cpp(256) : 0xf7713000 0x00015000 "PQV2i.sys"
.\debug.cpp(256) : 0xf76fc000 0x00017000 "KSecDD.sys"
.\debug.cpp(256) : 0xf766f000 0x0008d000 "Ntfs.sys"
.\debug.cpp(256) : 0xf7642000 0x0002d000 "NDIS.sys"
.\debug.cpp(256) : 0xf7c43000 0x00004000 "nv_agp.sys"
.\debug.cpp(256) : 0xf7627000 0x0001b000 "Mup.sys"
.\debug.cpp(256) : 0xf7df8000 0x00001000 "giveio.sys"
.\debug.cpp(256) : 0xf79ef000 0x00010000 "\SystemRoot\system32\DRIVERS\nic1394.sys"
.\debug.cpp(256) : 0xf7a4f000 0x0000a000 "\SystemRoot\system32\DRIVERS\amdk7.sys"
.\debug.cpp(256) : 0xf7b07000 0x00005000 "\SystemRoot\system32\DRIVERS\usbohci.sys"
.\debug.cpp(256) : 0xf759b000 0x00023000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS"
.\debug.cpp(256) : 0xf7b0f000 0x00007000 "\SystemRoot\system32\DRIVERS\usbehci.sys"
.\debug.cpp(256) : 0xf7587000 0x00014000 "\SystemRoot\system32\DRIVERS\NVENET.sys"
.\debug.cpp(256) : 0xf7a5f000 0x0000e000 "\SystemRoot\system32\drivers\nvax.sys"
.\debug.cpp(256) : 0xf7a6f000 0x0000d000 "\SystemRoot\system32\DRIVERS\cdrom.sys"
.\debug.cpp(256) : 0xf7a7f000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys"
.\debug.cpp(256) : 0xf7564000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys"
.\debug.cpp(256) : 0xf7d13000 0x00003000 "\SystemRoot\System32\Drivers\GearAspiWDM.SYS"
.\debug.cpp(256) : 0xf72b1000 0x002b3000 "\SystemRoot\system32\DRIVERS\nv4_mini.sys"
.\debug.cpp(256) : 0xf729d000 0x00014000 "\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS"
.\debug.cpp(256) : 0xf7b17000 0x00007000 "\SystemRoot\system32\DRIVERS\fdc.sys"
.\debug.cpp(256) : 0xf7a8f000 0x00010000 "\SystemRoot\system32\DRIVERS\serial.sys"
.\debug.cpp(256) : 0xf7d1b000 0x00004000 "\SystemRoot\system32\DRIVERS\serenum.sys"
.\debug.cpp(256) : 0xf7289000 0x00014000 "\SystemRoot\system32\DRIVERS\parport.sys"
.\debug.cpp(256) : 0xf7a9f000 0x0000d000 "\SystemRoot\system32\DRIVERS\i8042prt.sys"
.\debug.cpp(256) : 0xf7b1f000 0x00006000 "\SystemRoot\system32\DRIVERS\kbdclass.sys"
.\debug.cpp(256) : 0xf7eed000 0x00001000 "\SystemRoot\system32\DRIVERS\audstub.sys"
.\debug.cpp(256) : 0xf78bf000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"
.\debug.cpp(256) : 0xf7d1f000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"
.\debug.cpp(256) : 0xf7272000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"
.\debug.cpp(256) : 0xf78cf000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"
.\debug.cpp(256) : 0xf78ff000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys"
.\debug.cpp(256) : 0xf7b2f000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS"
.\debug.cpp(256) : 0xf7189000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys"
.\debug.cpp(256) : 0xf791f000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys"
.\debug.cpp(256) : 0xf7bff000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys"
.\debug.cpp(256) : 0xf7c27000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys"
.\debug.cpp(256) : 0xf3d57000 0x00031000 "\SystemRoot\system32\DRIVERS\rdpdr.sys"
.\debug.cpp(256) : 0xf719a000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys"
.\debug.cpp(256) : 0xf7c2f000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys"
.\debug.cpp(256) : 0xf7d91000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys"
.\debug.cpp(256) : 0xf3d23000 0x00034000 "\SystemRoot\system32\DRIVERS\update.sys"
.\debug.cpp(256) : 0xf7cff000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys"
.\debug.cpp(256) : 0xf697e000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS"
.\debug.cpp(256) : 0xf696e000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys"
.\debug.cpp(256) : 0xf7d99000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"
.\debug.cpp(256) : 0xf3441000 0x00066000 "\SystemRoot\system32\drivers\nvapu.sys"
.\debug.cpp(256) : 0xf3409000 0x00024000 "\SystemRoot\system32\drivers\portcls.sys"
.\debug.cpp(256) : 0xf692e000 0x0000f000 "\SystemRoot\system32\drivers\drmk.sys"
.\debug.cpp(256) : 0xf3324000 0x000e5000 "\SystemRoot\system32\drivers\nvmcp.sys"
.\debug.cpp(256) : 0xf3300000 0x00011000 "\SystemRoot\system32\drivers\nvarm.sys"
.\debug.cpp(256) : 0xf018d000 0x00005000 "\SystemRoot\system32\DRIVERS\flpydisk.sys"
.\debug.cpp(256) : 0xee5eb000 0x00023000 "\SystemRoot\system32\DRIVERS\MpFilter.sys"
.\debug.cpp(256) : 0xeffae000 0x00003000 "\SystemRoot\system32\DRIVERS\hidusb.sys"
.\debug.cpp(256) : 0xefc0d000 0x00009000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS"
.\debug.cpp(256) : 0xf000e000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS"
.\debug.cpp(256) : 0xf7dad000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS"
.\debug.cpp(256) : 0xf404a000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS"
.\debug.cpp(256) : 0xf7daf000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS"
.\debug.cpp(256) : 0xefffe000 0x00006000 "\SystemRoot\System32\drivers\vga.sys"
.\debug.cpp(256) : 0xf7db1000 0x00002000 "\SystemRoot\System32\Drivers\mnmdd.SYS"
.\debug.cpp(256) : 0xf7db3000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"
.\debug.cpp(256) : 0xefff6000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS"
.\debug.cpp(256) : 0xeffee000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS"
.\debug.cpp(256) : 0xee598000 0x00033000 "\SystemRoot\System32\Drivers\UdfReadr.SYS"
.\debug.cpp(256) : 0xef7d2000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys"
.\debug.cpp(256) : 0xee573000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys"
.\debug.cpp(256) : 0xee51b000 0x00058000 "\SystemRoot\system32\DRIVERS\tcpip.sys"
.\debug.cpp(256) : 0xee4f3000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys"
.\debug.cpp(256) : 0xee4d1000 0x00022000 "\SystemRoot\System32\drivers\afd.sys"
.\debug.cpp(256) : 0xefbfd000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys"
.\debug.cpp(256) : 0xee4af000 0x00022000 "\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS"
.\debug.cpp(256) : 0xeffe6000 0x00006000 "\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS"
.\debug.cpp(256) : 0xee484000 0x0002b000 "\SystemRoot\system32\DRIVERS\rdbss.sys"
.\debug.cpp(256) : 0xefbed000 0x00009000 "\SystemRoot\System32\Drivers\PQIMount.SYS"
.\debug.cpp(256) : 0xee415000 0x0006f000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"
.\debug.cpp(256) : 0xf3da9000 0x00001000 "\??\C:\WINDOWS\system32\mbmiodrvr.sys"
.\debug.cpp(256) : 0xefbcd000 0x00009000 "\SystemRoot\System32\Drivers\Fips.SYS"
.\debug.cpp(256) : 0xee3f4000 0x00021000 "\SystemRoot\system32\DRIVERS\ipnat.sys"
.\debug.cpp(256) : 0xefbbd000 0x00009000 "\SystemRoot\system32\DRIVERS\wanarp.sys"
.\debug.cpp(256) : 0xefbad000 0x0000f000 "\SystemRoot\system32\DRIVERS\arp1394.sys"
.\debug.cpp(256) : 0xf3dfe000 0x00003000 "\SystemRoot\system32\DRIVERS\mouhid.sys"
.\debug.cpp(256) : 0xf1fc3000 0x00003000 "\SystemRoot\system32\DRIVERS\IPFilter.sys"
.\debug.cpp(256) : 0xee3e3000 0x00011000 "\SystemRoot\System32\Drivers\Udfs.SYS"
.\debug.cpp(256) : 0xf75c6000 0x00004000 "\SystemRoot\System32\Drivers\dump_diskdump.sys"
.\debug.cpp(256) : 0xeffd6000 0x00005000 "\SystemRoot\System32\Drivers\dump_nvidesm.sys"
.\debug.cpp(256) : 0xbf800000 0x001c4000 "\SystemRoot\System32\win32k.sys"
.\debug.cpp(256) : 0xf7cdb000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys"
.\debug.cpp(256) : 0xeffce000 0x00005000 "\SystemRoot\System32\watchdog.sys"
.\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys"
.\debug.cpp(256) : 0xf7f2d000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys"
.\debug.cpp(256) : 0xbf012000 0x00391000 "\SystemRoot\System32\nv4_disp.dll"
.\debug.cpp(256) : 0xf1507000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"
.\debug.cpp(256) : 0xec23e000 0x00015000 "\SystemRoot\system32\drivers\wdmaud.sys"
.\debug.cpp(256) : 0xef75e000 0x0000f000 "\SystemRoot\system32\drivers\sysaudio.sys"
.\debug.cpp(256) : 0xec053000 0x0002d000 "\SystemRoot\system32\DRIVERS\mrxdav.sys"
.\debug.cpp(256) : 0xf7dc1000 0x00002000 "\SystemRoot\System32\Drivers\ParVdm.SYS"
.\debug.cpp(256) : 0xec0ec000 0x00003000 "\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS"
.\debug.cpp(256) : 0xebee4000 0x00057000 "\SystemRoot\system32\DRIVERS\srv.sys"
.\debug.cpp(256) : 0xebb33000 0x00041000 "\SystemRoot\System32\Drivers\HTTP.sys"
.\debug.cpp(256) : 0xeb958000 0x00023000 "\SystemRoot\System32\Drivers\Fastfat.SYS"
.\debug.cpp(256) : 0x7c900000 0x000b0000 "\WINDOWS\system32\ntdll.dll"
.\debug.cpp(263) : **********************************************
.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
.\debug.cpp(308) : **********************************************
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{616b38c0-de36-11dd-a7ad-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"
.\debug.cpp(400) : Destination "\Device\Video0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"
.\debug.cpp(400) : Destination "\Device\Ndis"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000043"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmIoDaemon"
.\debug.cpp(400) : Destination "\Device\DmControl\DmIoDaemon"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000031"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{71985f4a-1ca1-11d3-9cc8-00c04f7971e0}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"
.\debug.cpp(400) : Destination "\Device\Video1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_TOSHIBA&Prod_DVD-ROM_SD-M1612&Rev_1004#4&e6802b0&0&100#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1Port0Path1Target0Lun0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip"
.\debug.cpp(400) : Destination "\Device\Ip"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"
.\debug.cpp(400) : Destination "\Device\Video2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&Signature5B0B5B0BOffset752C65E00LengthB507BAA00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000030"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&34941eb3&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"
.\debug.cpp(400) : Destination "\Device\Video3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev"
.\debug.cpp(400) : Destination "\Device\IPSEC"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9aa4a2cc-81e0-4cfd-802f-0f74526d2bd3}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDPROXY"
.\debug.cpp(400) : Destination "\Device\NDProxy"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\RdpDrDvMgr"
.\debug.cpp(400) : Destination "\Device\RdpDrDvMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{fd0a5af4-b41d-11d2-9c95-00c04f7971e0}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{d008f032-103d-42f3-a554-4b707a4936c5}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#Disk&Ven_MAXTOR_6&Prod_L080L4&Rev_A93.#4&e6802b0&0&000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1Port0Path0Target0Lun0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\$VDMLPT1"
.\debug.cpp(400) : Destination "\Device\ParallelVdm0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&Signature5B0B5B0BOffset7E00Length752C56200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FDC#GENERIC_FLOPPY_DRIVE#4&33bc18fa&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\FloppyPDO0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQV2iSnapshotControl"
.\debug.cpp(400) : Destination "\Device\PQV2iSnapshot\Control"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAPU"
.\debug.cpp(400) : Destination "\Device\NVAPU"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"
.\debug.cpp(400) : Destination "\Device\WMIDataDevice"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{534760B4-FDA7-4B44-8C7E-14F7C4781718}"
.\debug.cpp(400) : Destination "\Device\{534760B4-FDA7-4B44-8C7E-14F7C4781718}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_006A&SUBSYS_F5411297&REV_A1#3&13c0b0c5&0&30#{1890563f-15c9-4c36-824b-ab9c553cc420}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM1"
.\debug.cpp(400) : Destination "\Device\Serial0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_006E&SUBSYS_F5411297&REV_A3#3&13c0b0c5&0&68#{6bdd1fc1-810f-11d0-bec7-08002be2092f}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0068&SUBSYS_F5411297&REV_A4#3&13c0b0c5&0&12#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0010"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{2fad4382-26a2-414e-b4ef-1dbbab444ebc}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{32138dcc-2b53-11d9-bcad-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"
.\debug.cpp(400) : Destination "\Device\NamedPipe"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{32138dc4-2b53-11d9-bcad-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\Floppy0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{49BBD7B8-E1C5-4B7F-9BAC-36C77E7C646A}"
.\debug.cpp(400) : Destination "\Device\{49BBD7B8-E1C5-4B7F-9BAC-36C77E7C646A}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&9bc4322&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UdfReadr_XP"
.\debug.cpp(400) : Destination "\Device\UdfReadr_XP"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT"
.\debug.cpp(400) : Destination "\Device\IPNAT"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"
.\debug.cpp(400) : Destination "\Device\Mup"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched"
.\debug.cpp(400) : Destination "\Device\PSched"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GEARAspiWDMDevice"
.\debug.cpp(400) : Destination "\Device\GEARAspiWDMDevice"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{b34a4f66-2f74-11d9-8946-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_6_Model_6#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
.\debug.cpp(400) : Destination "\Device\0000003e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"
.\debug.cpp(400) : Destination "\Device\Tcp"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"
.\debug.cpp(400) : Destination "\Device\USBFDO-0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000035"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"
.\debug.cpp(400) : Destination "\Device\USBFDO-1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD"
.\debug.cpp(400) : Destination "\Device\VideoPdo0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"
.\debug.cpp(400) : Destination "\Device\Harddisk0\DR0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQV2iSnapShot0"
.\debug.cpp(400) : Destination "\Device\PQV2iSnapshot\Volume0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD2"
.\debug.cpp(400) : Destination "\Device\USBFDO-2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000034"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"
.\debug.cpp(400) : Destination "\DosDevices\LPT1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000033"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{25CCF23E-DD25-4B09-B827-83D76EAC8721}"
.\debug.cpp(400) : Destination "\Device\{25CCF23E-DD25-4B09-B827-83D76EAC8721}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"
.\debug.cpp(400) : Destination "\Device\FsWrap"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQV2iSnapShot1"
.\debug.cpp(400) : Destination "\Device\PQV2iSnapshot\Volume1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\sysaudio"
.\debug.cpp(400) : Destination "\Device\sysaudio"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"
.\debug.cpp(400) : Destination "\GLOBAL??"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000046"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0066&SUBSYS_F5411297&REV_A1#3&13c0b0c5&0&20#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0011"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0303#3&13c0b0c5&0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\00000051"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}"
.\debug.cpp(400) : Destination "\Device\0000004f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THRM#{4afa3d51-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000040"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_TOSHIBA&Prod_DVD-ROM_SD-M1612&Rev_1004#4&e6802b0&0&100#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1Port0Path1Target0Lun0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{C6672E89-E1E2-4C7E-98AC-3CDC5682D8B3}"
.\debug.cpp(400) : Destination "\Device\{C6672E89-E1E2-4C7E-98AC-3CDC5682D8B3}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{07dad660-22f1-11d1-a9f4-00c04fbbde8f}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ARP1394"
.\debug.cpp(400) : Destination "\Device\ARP1394"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{dda54a40-1e4c-11d1-a050-405705c10000}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000004f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_045e&Pid_0039#5&25360bda&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
.\debug.cpp(400) : Destination "\Device\USBPDO-3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"
.\debug.cpp(400) : Destination "\Device\MountPointManager"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmConfig"
.\debug.cpp(400) : Destination "\Device\DmControl\DmConfig"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000002f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\00000003"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0067&SUBSYS_F5411297&REV_A4#3&13c0b0c5&0&11#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0009"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0250&SUBSYS_00371545&REV_A3#4&102ac5bc&0&00F0#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_045e&Pid_0039#6&649f079&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\0000006a"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"
.\debug.cpp(400) : Destination "\Device\WANARP"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmTrace"
.\debug.cpp(400) : Destination "\Device\DmControl\DmTrace"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\giveio"
.\debug.cpp(400) : Destination "\Device\giveio"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&1c75f3c7&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{094557a3-4211-4e66-8608-9640c9055c5f}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\A:"
.\debug.cpp(400) : Destination "\Device\Floppy0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#dmio#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"
.\debug.cpp(400) : Destination "\Device\NdisWanIp"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SASKUTIL"
.\debug.cpp(400) : Destination "\Device\SASKUTIL"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PQIMount"
.\debug.cpp(400) : Destination "\Device\PQIMount"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"
.\debug.cpp(400) : Destination "\Device\Scsi\nvidesm1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\1394BUS0"
.\debug.cpp(400) : Destination "\Device\1394BUS0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_045e&Pid_0039#6&649f079&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}"
.\debug.cpp(400) : Destination "\Device\0000006a"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1"
.\debug.cpp(400) : Destination "\Device\ParTechInc0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000032"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0067&SUBSYS_F5411297&REV_A4#3&13c0b0c5&0&10#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0008"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{ea2ef405-bfb8-40ce-8d37-4f94d99695dc}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0400#1#{97f76ef0-f883-11d0-af1f-0000f800845c}"
.\debug.cpp(400) : Destination "\Device\00000050"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NVAX#NFORCE_VAD#4&1ac55d68&0&0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407}"
.\debug.cpp(400) : Destination "\Device\00000039"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmLoader"
.\debug.cpp(400) : Destination "\Device\DmLoader"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2"
.\debug.cpp(400) : Destination "\Device\ParTechInc1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST"
.\debug.cpp(400) : Destination "\Device\IPMULTICAST"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPT1"
.\debug.cpp(400) : Destination "\Device\NamedPipe\Spooler\LPT1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"
.\debug.cpp(400) : Destination "\Device\NdisWan"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISTAPI"
.\debug.cpp(400) : Destination "\Device\NdisTapi"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow"
.\debug.cpp(400) : Destination "\Device\LanmanRedirector"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0065&SUBSYS_F5411297&REV_A2#3&13c0b0c5&0&48#{2accfe60-c130-11d2-b082-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3"
.\debug.cpp(400) : Destination "\Device\ParTechInc2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"
.\debug.cpp(400) : Destination "\Device\FtControl"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SABDIFSV"
.\debug.cpp(400) : Destination "\Device\SASDIFSV"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{41CECCE1-10CF-443A-BA7C-F859BD8BF879}"
.\debug.cpp(400) : Destination "\Device\{41CECCE1-10CF-443A-BA7C-F859BD8BF879}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPTENUM#MicrosoftRawPort#4&1d62032d&0&LPT1#{811fc6a5-f728-11d0-a537-0000f8753ed1}"
.\debug.cpp(400) : Destination "\Device\Parallel0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"
.\debug.cpp(400) : Destination "\DosDevices\COM1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"
.\debug.cpp(400) : Destination "\Device\MailSlot"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"
.\debug.cpp(400) : Destination ""
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"
.\debug.cpp(400) : Destination "\Device\Null"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\00000038"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"
.\debug.cpp(400) : Destination "\Device\Ndisuio"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdaC15BA"
.\debug.cpp(400) : Destination "\Device\CdaC15BA"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPFILTER"
.\debug.cpp(400) : Destination "\Device\MSH_Filter"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\00000037"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NONSPOOLED_LPT1"
.\debug.cpp(400) : Destination "\Device\Parallel0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmInfo"
.\debug.cpp(400) : Destination "\Device\DmControl\DmInfo"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{56605FEC-7C98-45D5-8C23-4D598F3122E2}"
.\debug.cpp(400) : Destination "\Device\{56605FEC-7C98-45D5-8C23-4D598F3122E2}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{54CE1298-8C85-4D6D-86C5-17DB23A3A99E}"
.\debug.cpp(400) : Destination "\Device\{54CE1298-8C85-4D6D-86C5-17DB23A3A99E}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{011B4985-CBCC-4A49-BEB6-C7B9368065DB}"
.\debug.cpp(400) : Destination "\Device\{011B4985-CBCC-4A49-BEB6-C7B9368065DB}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\mbmiodrvr"
.\debug.cpp(400) : Destination "\Device\mbmiodrvr"
.\debug.cpp(409) : --
.\debug.cpp(453) : **********************************************
.\boot_cleaner.cpp(565) : System volume is \\.\C:
.\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
.\diskio.cpp(204) : ATA_Read(): DeviceIoControl() ERROR 1
.\boot_cleaner.cpp(276) : Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd
.\boot_cleaner.cpp(1060) :
.\boot_cleaner.cpp(1061) : Size Device Name MBR Status
.\boot_cleaner.cpp(1062) : --------------------------------------------
.\boot_cleaner.cpp(1106) : 74 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
.\boot_cleaner.cpp(1112) :
.\boot_cleaner.cpp(1151) : Done;

Broni · Nov 27, 2010

That looks good

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

NorGitram · Nov 28, 2010

OTL logfile created on: 11/28/2010 1:51:09 AM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Ron\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 696.00 Mb Available Physical Memory | 68.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.29 Gb Total Space | 20.33 Gb Free Space | 69.41% Space Free | Partition Type: NTFS
Drive D: | 45.26 Gb Total Space | 32.23 Gb Free Space | 71.21% Space Free | Partition Type: NTFS
Drive E: | 591.50 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: SHUTTLE | User Name: Ron | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
PRC - [2010/09/15 04:34:02 | 001,094,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2009/01/09 05:18:57 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/08/30 15:20:36 | 000,112,224 | ---- | M] (Movielink LLC) -- D:\Program Files\Movielink\MovielinkManager\Movielink User.exe
PRC - [2005/08/30 15:20:28 | 001,095,264 | ---- | M] (Movielink LLC) -- D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe
PRC - [2004/12/20 16:12:36 | 000,131,072 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
PRC - [2004/11/16 13:24:42 | 000,594,028 | ---- | M] (Executive Software International, Inc.) -- D:\Program Files\Executive Software\Diskeeper\DkService.exe
PRC - [2004/11/05 05:10:06 | 000,039,936 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE
PRC - [2004/07/13 21:16:06 | 000,139,264 | ---- | M] (OTi) -- C:\WINDOWS\system32\UStorSrv.exe
PRC - [2004/06/12 08:40:42 | 000,594,944 | ---- | M] (Alex van Kaam) -- D:\Program Files\Motherboard Monitor 5\MBM5.exe
PRC - [2004/02/13 09:23:56 | 000,585,728 | ---- | M] (Hyperionics Technology LLC) -- D:\Program Files\FileBX\FileBX.exe
PRC - [2003/09/12 13:40:26 | 001,208,320 | ---- | M] (PowerQuest Corporation) -- D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
PRC - [2002/11/25 07:12:32 | 000,049,152 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe

========== Modules (SafeList) ==========

MOD - [2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
MOD - [2006/08/25 08:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2004/02/13 09:24:00 | 000,094,208 | ---- | M] () -- D:\Program Files\FileBX\FileBXH.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2008/12/01 11:01:02 | 000,033,752 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R)
SRV - [2005/08/30 15:20:28 | 001,095,264 | ---- | M] (Movielink LLC) [Auto | Running] -- D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe -- (Movielink Core Service)
SRV - [2004/11/16 13:24:42 | 000,594,028 | ---- | M] (Executive Software International, Inc.) [Auto | Running] -- D:\Program Files\Executive Software\Diskeeper\DkService.exe -- (Diskeeper)
SRV - [2004/11/05 05:10:06 | 000,039,936 | ---- | M] (C-Dilla Ltd) [Auto | Running] -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE -- (C-DillaCdaC11BA)
SRV - [2004/07/13 21:16:06 | 000,139,264 | ---- | M] (OTi) [Auto | Running] -- C:\WINDOWS\System32\UStorSrv.exe -- (UStorage Server Service)
SRV - [2003/09/12 13:40:26 | 001,208,320 | ---- | M] (PowerQuest Corporation) [Auto | Running] -- D:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe -- (V2i Protector)
SRV - [2002/11/25 07:12:32 | 000,049,152 | ---- | M] (GEAR Software) [Auto | Running] -- C:\WINDOWS\system32\gearsec.exe -- (GEARSecurity)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\PalmUSBD.sys -- (PalmUSBD)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Ron\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2006/09/26 14:11:13 | 000,022,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbsermpt.sys -- (usbsermpt)
DRV - [2005/04/13 11:34:02 | 000,414,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce) Service for NVIDIA(R) nForce(TM)
DRV - [2005/04/13 11:32:42 | 000,053,376 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax) Service for NVIDIA(R) nForce(TM)
DRV - [2004/11/05 05:09:58 | 000,008,864 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2004/10/29 15:50:00 | 002,826,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2004/08/03 20:08:36 | 000,013,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atinmdxx.sys -- (MVDCODEC)
DRV - [2004/08/03 20:08:30 | 000,105,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atinrvxx.sys -- (atinrvxx)
DRV - [2004/04/10 08:42:36 | 000,002,944 | ---- | M] (cansoft@livewiredev.com) [Kernel | System | Running] -- C:\WINDOWS\system32\mbmiodrvr.sys -- (mbmiodrvr)
DRV - [2003/09/12 13:48:10 | 000,046,810 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQIMount.sys -- (PQIMount)
DRV - [2003/09/12 13:19:44 | 000,132,899 | ---- | M] (StorageCraft) [File_System | Boot | Running] -- C:\WINDOWS\System32\drivers\PQV2i.sys -- (PQV2i)
DRV - [2002/11/27 04:52:00 | 000,080,896 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET)
DRV - [2002/11/13 00:10:00 | 000,020,224 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvidesm.sys -- (nvidesm)
DRV - [2002/09/05 20:24:00 | 000,013,568 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2001/11/30 04:00:14 | 000,003,538 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WinFlash.sys -- (Winflash)
DRV - [2001/08/22 22:33:12 | 000,010,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ipfilter.sys -- (IPFilter)
DRV - [2000/06/15 19:54:02 | 000,206,368 | ---- | M] (Adaptec) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\udfreadr.BAK -- (UdfReadr)
DRV - [1996/04/03 12:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledItems: {C6128004-4838-4708-9A97-BB172D17767D}:1.3
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.0
FF - prefs.js..extensions.enabledItems: exif_viewer@mozilla.doslash.org:1.45
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:0.9.8
FF - prefs.js..extensions.enabledItems: {6e84150a-d526-41f1-a480-a67d3fed910d}:1.4
FF - prefs.js..extensions.enabledItems: {01c29d60-f7f0-416c-844a-ec8b2e1841d0}:1.7
FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.5.2008112201
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.7.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2009/02/04 16:40:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2010/11/25 05:38:55 | 000,000,000 | ---D | M]

[2009/01/08 18:52:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Extensions
[2010/11/25 05:54:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions
[2009/01/09 02:39:31 | 000,000,000 | ---D | M] (PhotoME Extension) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{01c29d60-f7f0-416c-844a-ec8b2e1841d0}
[2006/02/19 04:56:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{04352C84-9AC6-4d2f-A518-AB0962D62FA1}
[2009/01/09 02:39:32 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2006/09/27 03:55:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe6a}
[2009/01/09 02:39:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2009/01/09 02:39:53 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/01/08 18:52:53 | 000,000,000 | ---D | M] (IE View) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
[2009/01/09 02:39:33 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2007/09/18 20:13:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{9b9d2aaa-ae26-4447-a7a1-633a32b19ddd}
[2009/01/09 02:39:33 | 000,000,000 | ---D | M] (GetVideo) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{a51dd9d0-56c3-11db-b0de-0800200c9a66}
[2009/01/09 02:39:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{C6128004-4838-4708-9A97-BB172D17767D}
[2009/01/10 06:46:17 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2009/01/09 02:39:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2009/01/09 02:39:34 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009/01/09 02:39:34 | 000,000,000 | ---D | M] (CustomizeGoogle) -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\{fce36c1e-58d8-498a-b2a5-66ad1cedebbb}(2)
[2009/01/09 02:39:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\exif_viewer@mozilla.doslash.org
[2009/01/09 02:39:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\toolbarcleanup@supernova00.biz
[2009/01/09 02:39:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Mozilla\Firefox\Profiles\sgyupw4s.default\extensions\unplug@compunach

O1 HOSTS File: ([2010/11/26 12:20:54 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (no name) - {C333CF63-767F-4831-94AC-E683D962C63C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O4 - HKLM..\Run: [DiskeeperSystray] D:\Program Files\Executive Software\Diskeeper\DkIcon.exe (Executive Software International, Inc.)
O4 - HKLM..\Run: [LoadMSvcmm] D:\Program Files\Movielink\MovielinkManager\Movielink User.exe (Movielink LLC)
O4 - HKLM..\Run: [MBM 5] D:\Program Files\Motherboard Monitor 5\MBM5.EXE (Alex van Kaam)
O4 - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [updateMgr] D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\Ron\Start Menu\Programs\Startup\FileBox eXtender.lnk = D:\Program Files\FileBX\FileBX.exe (Hyperionics Technology LLC)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab (LSSupCtl Class)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photo.walgreens.com/WalgreensActivia.cab (Snapfish Activia)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1290690552625 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} https://www-secure.symantec.com/techsupp/asa/SymAData.cab (ActiveDataInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/10/31 14:21:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [1999/11/10 11:30:28 | 000,000,038 | R--- | M] () - E:\AutoRun.dat -- [ UDF ]
O32 - AutoRun File - [1998/12/14 14:31:14 | 000,000,051 | R--- | M] () - E:\AutoRun.inf -- [ UDF ]
O32 - AutoRun File - [1999/01/27 14:46:14 | 000,118,784 | R--- | M] () - E:\autorun.exe -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: VIDC.ACDV - ACDV.dll File not found
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619700398653440)

========== Files/Folders - Created Within 30 Days ==========

[2010/11/28 01:42:16 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
[2010/11/27 13:10:13 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Documents and Settings\Ron\Desktop\remover.exe
[2010/11/26 12:25:36 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/11/26 12:05:34 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/11/26 12:03:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/11/26 12:03:41 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/11/26 12:03:41 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/11/26 12:03:41 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/11/26 12:03:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/11/26 12:03:03 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/11/26 03:09:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ron\Application Data\Malwarebytes
[2010/11/26 03:09:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/26 03:09:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/26 03:09:00 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/26 03:09:00 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/26 02:59:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ron\Desktop\Scans
[2010/11/25 11:54:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ron\Application Data\SUPERAntiSpyware.com
[2010/11/25 11:54:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/11/25 11:54:29 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/11/25 11:47:47 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Ron\Recent
[2010/11/25 11:35:41 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/11/25 11:30:37 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Ron\IECompatCache
[2010/11/25 11:30:07 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Ron\PrivacIE
[2010/11/25 09:42:03 | 000,000,000 | ---D | C] -- C:\Program Files\Palm
[2010/11/25 07:26:30 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Ron\IETldCache
[2010/11/25 07:07:01 | 006,463,660 | ---- | C] (Punk Software ) -- C:\Documents and Settings\Ron\Desktop\RocketDock-v1.3.5.exe
[2010/11/25 07:01:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/11/25 06:59:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/11/25 06:50:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
[2010/11/25 06:07:02 | 000,000,000 | ---D | C] -- C:\Program Files\Magical Jelly Bean
[2010/11/25 06:02:57 | 001,004,072 | ---- | C] (Magical Jelly Bean ) -- C:\Documents and Settings\Ron\Desktop\KeyFinderInstaller.exe
[2010/11/25 05:56:51 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
[2010/11/25 05:39:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun

========== Files - Modified Within 30 Days ==========

[2010/11/28 01:44:47 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/11/28 01:42:52 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job
[2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
[2010/11/28 01:39:54 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/28 01:39:05 | 000,017,410 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/11/28 01:39:03 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/28 01:38:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/27 02:38:00 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/26 12:39:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\MBRCheck.exe
[2010/11/26 12:20:54 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/11/26 12:05:38 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/11/26 03:09:06 | 000,000,731 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/25 11:49:54 | 000,074,784 | ---- | M] () -- D:\My Documents\cc_20101125_114933.reg
[2010/11/25 11:35:34 | 000,001,848 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2010/11/25 11:35:34 | 000,001,826 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/11/25 10:58:37 | 000,001,950 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/11/25 09:09:20 | 000,000,942 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/11/25 09:09:20 | 000,000,937 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/11/25 09:09:20 | 000,000,101 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/11/25 07:26:21 | 000,090,296 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/25 07:07:06 | 006,463,660 | ---- | M] (Punk Software ) -- C:\Documents and Settings\Ron\Desktop\RocketDock-v1.3.5.exe
[2010/11/25 06:03:04 | 001,004,072 | ---- | M] (Magical Jelly Bean ) -- C:\Documents and Settings\Ron\Desktop\KeyFinderInstaller.exe
[2010/11/25 05:51:13 | 000,000,952 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\Revo Uninstaller.lnk
[2010/11/08 01:20:24 | 000,089,088 | ---- | M] () -- C:\WINDOWS\MBR.exe

========== Files Created - No Company Name ==========

[2010/11/26 12:05:38 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/11/26 12:05:35 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/11/26 12:03:41 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/11/26 12:03:41 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/11/26 12:03:41 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/11/26 12:03:41 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/11/26 12:03:41 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/11/26 11:42:47 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Ron\Desktop\MBRCheck.exe
[2010/11/26 03:09:06 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/25 11:49:37 | 000,074,784 | ---- | C] () -- D:\My Documents\cc_20101125_114933.reg
[2010/11/25 11:35:34 | 000,001,848 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2010/11/25 11:35:34 | 000,001,826 | ---- | C] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/11/25 11:33:58 | 000,000,880 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/25 11:33:58 | 000,000,876 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/25 11:30:34 | 000,000,418 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job
[2010/11/25 10:58:37 | 000,001,950 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/11/25 09:18:58 | 000,000,299 | ---- | C] () -- C:\Documents and Settings\Ron\Service Pack 3 Setup Error.txt
[2010/11/25 07:08:09 | 013,525,424 | ---- | C] () -- C:\Documents and Settings\Ron\Desktop\Dropbox 0.7.110.exe
[2010/11/25 06:02:00 | 000,000,408 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2005/02/05 12:25:31 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2005/01/08 15:02:41 | 000,000,186 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
[2005/01/08 14:58:23 | 000,046,592 | ---- | C] () -- C:\WINDOWS\System32\Prtserv.dll
[2005/01/04 15:18:16 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\Ron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/01/02 11:30:06 | 000,000,088 | ---- | C] () -- C:\WINDOWS\Spell Catcher.INI
[2005/01/01 09:41:44 | 000,003,538 | ---- | C] () -- C:\WINDOWS\System32\drivers\WinFlash.sys
[2004/12/18 13:46:59 | 000,000,078 | ---- | C] () -- C:\WINDOWS\qwimp.ini
[2004/12/04 12:51:03 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\OPDSL.DLL
[2004/11/11 12:48:19 | 000,003,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\PQNTDRV.SYS
[2004/11/05 05:10:08 | 000,112,128 | RH-- | C] () -- C:\WINDOWS\CdaC14BA.DLL
[2004/11/05 05:10:05 | 000,008,864 | ---- | C] () -- C:\WINDOWS\System32\drivers\CDAC15BA.SYS
[2004/11/05 05:08:32 | 000,000,765 | ---- | C] () -- C:\WINDOWS\efscan.ini
[2004/11/05 05:08:32 | 000,000,072 | ---- | C] () -- C:\WINDOWS\efaxview.ini
[2004/11/05 04:50:51 | 000,000,209 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2004/11/01 05:27:44 | 000,001,101 | ---- | C] () -- C:\WINDOWS\wbocx.ini
[2004/11/01 05:20:43 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Ron\Local Settings\Application Data\fusioncache.dat
[2004/10/31 09:04:15 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/04 05:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[1996/04/03 12:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2009/01/09 04:46:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2009/01/30 14:02:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GARMIN
[2009/01/09 05:09:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HotSync
[2006/05/19 13:48:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Movielink
[2004/11/11 12:56:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PowerQuest
[2009/01/24 05:39:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WholeSecurity
[2009/01/09 03:50:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\ACD Systems
[2009/01/30 14:02:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\GARMIN
[2009/01/09 05:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\HotSync
[2005/09/08 05:08:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Hyperionics
[2004/11/11 13:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\IsolatedStorage
[2004/11/11 12:32:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Leadertech
[2006/10/12 14:49:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Snapfish
[2005/01/02 11:27:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ron\Application Data\Spell Catcher Plus
[2010/11/28 01:44:47 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/11/28 01:42:52 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{4D193431-CCBE-4A03-8B4C-E834CFC7F0AB}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/01/09 16:22:48 | 000,004,262 | ---- | M] () -- C:\additdiag.txt
[2005/02/10 17:05:31 | 000,000,434 | ---- | M] () -- C:\ApplyPatch.cmd
[2004/10/31 14:21:11 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2004/11/05 04:36:23 | 000,518,792 | RHS- | M] () -- C:\AVG6DB_F.DAT
[2004/11/05 10:41:47 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2004/11/05 10:41:47 | 000,000,211 | -HS- | M] () -- C:\BOOT.BKK
[2010/11/26 12:05:38 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/11/26 12:24:21 | 000,010,148 | ---- | M] () -- C:\ComboFix.txt
[2004/10/31 14:21:11 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2005/02/10 17:05:31 | 000,040,720 | ---- | M] (Microsoft Corporation) -- C:\DRIVERS.EXE
[2005/02/11 16:24:57 | 000,010,155 | ---- | M] () -- C:\drivers.txt
[2004/10/31 14:21:11 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2004/10/31 14:21:11 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/11/28 01:38:54 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
[2005/02/10 17:05:33 | 000,000,251 | ---- | M] () -- C:\PQIMount.reg
[2005/02/10 17:05:33 | 000,000,401 | ---- | M] () -- C:\PQV2i.reg

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/10/31 14:20:38 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >
[2005/01/18 15:03:02 | 000,318,916 | ---- | M] () -- C:\WINDOWS\ElectricWindows.jpg

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/10/31 09:01:58 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/10/31 09:01:58 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/10/31 09:01:58 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2004/10/31 14:21:18 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2004/10/31 14:29:26 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/11/25 09:09:20 | 000,000,101 | ---- | M] () -- C:\Documents and Settings\Ron\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/09/23 02:17:04 | 013,525,424 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\Dropbox 0.7.110.exe
[2010/11/25 06:03:04 | 001,004,072 | ---- | M] (Magical Jelly Bean ) -- C:\Documents and Settings\Ron\Desktop\KeyFinderInstaller.exe
[2010/11/26 12:39:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Ron\Desktop\MBRCheck.exe
[2010/11/28 01:42:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ron\Desktop\OTL.exe
[2010/09/01 15:33:50 | 000,083,968 | ---- | M] (eSage Lab) -- C:\Documents and Settings\Ron\Desktop\remover.exe
[2010/11/25 07:07:06 | 006,463,660 | ---- | M] (Punk Software ) -- C:\Documents and Settings\Ron\Desktop\RocketDock-v1.3.5.exe
[2009/01/09 15:17:11 | 331,805,736 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Ron\Desktop\WindowsXP-KB936929-SP3-x86-ENU.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/11/25 09:09:20 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Ron\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/11/28 01:42:49 | 000,065,536 | ---- | M] () -- C:\Documents and Settings\Ron\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/09/22 16:46:10 | 000,192,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2004/08/04 05:00:00 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 00:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 00:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 07:22:02 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2004/08/04 00:06:34 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2004/10/13 09:24:37 | 001,694,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 05:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 05:00:00 | 000,018,052 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 05:00:00 | 000,009,306 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 00:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 00:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-11-25 15:38:46

< End of report >

NorGitram · Nov 28, 2010

OTL Extras logfile created on: 11/28/2010 1:51:09 AM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Ron\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 696.00 Mb Available Physical Memory | 68.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.29 Gb Total Space | 20.33 Gb Free Space | 69.41% Space Free | Partition Type: NTFS
Drive D: | 45.26 Gb Total Space | 32.23 Gb Free Space | 71.21% Space Free | Partition Type: NTFS
Drive E: | 591.50 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: SHUTTLE | User Name: Ron | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee Pro 2.5.Browse] -- "C:\Program Files\ACD Systems\ACDSee Pro\2.5\ACDSeeQVPro25.exe" "%1" (ACD Systems)
Directory [Browse with &IrfanView] -- "D:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled

xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled

xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled

xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled

xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled

xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled

xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled

xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled

xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01BDFB08-EE88-4E5E-94A6-AE9EDCFA40C5}" = Microsoft IntelliPoint 4.0
"{121634B0-2F4A-11D3-ADA3-00C04F52DD53}" = Windows Installer Clean Up
"{1A2E804D-0AB2-424A-A72E-E104E5C4A0B8}" = MapSource - US Topo 24K National Parks, West v2
"{1BF38C77-E678-49AF-885A-BBD10AED2FF3}" = ACDSee RAW Image Decoder Plug-In Update 4.0
"{1E5007FA-DA5E-4EDD-BDE5-14D128D66887}" = PowerQuest PartitionMagic 7.0
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{261B0BDC-13A6-4B1D-A27D-B4803A58294F}" = Spell Catcher Plus
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 22
"{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006
"{2A1A690D-7030-4B92-A93B-B80378F1F580}" = Diskeeper Professional Edition
"{2D95950E-6D76-43E7-94A5-D9DBA2FD29E4}" = ACDSee Pro 2.5
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5414086B-AE06-4332-8A59-26FF0F630D1B}" = Garmin Trip and Waypoint Manager v3
"{5E3CFCA6-C95A-47CB-A822-7FA80D423AF2}" = MapSource
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74EC78BC-B379-4E29-9006-8F161DCAABA6}" = Apple Software Update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{8D538DFC-1E7A-45F0-9C7B-D8B6629CC2DC}" = PowerQuest Drive Image 7.0
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{974530D2-AE96-4C99-B549-99CADA653CE5}" = Garmin MapSource
"{A75949C3-DC28-42CA-9C56-24C002B93D89}" = Garmin City Navigator North America v8
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0.7
"{AD4203ED-7683-435E-B436-C299773A9936}" = MapSource - US Topo v3.02
"{C7793EE8-F666-4E6B-9827-76468679480E}" = Tweakui Powertoy for Windows XP
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D7A6C517-11F2-419F-B5BB-27772B939698}" = NvMixer
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"7-Zip" = 7-Zip 4.64
"Adaptec UDF Reader" = Adaptec UDF Reader
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"CCleaner" = CCleaner
"CdaC13Ba" = Cda Product Service - shared component
"FileBox eXtender" = FileBox eXtender
"GeoBuddy_is1" = GeoBuddy 3.0
"Google Chrome" = Google Chrome
"Google Updater" = Google Updater
"Icon Restore_is1" = Icon Restore 1.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"KeyFinder_is1" = Magical Jelly Bean KeyFinder
"Linksys PrintServer Driver" = Linksys PrintServer Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft Security Essentials" = Microsoft Security Essentials
"Motherboard Monitor 5_is1" = Motherboard Monitor 5
"Movielink Manager" = Movielink Manager
"Mozilla Firefox (3.0.6)" = Mozilla Firefox (3.0.6)
"MSN Music Assistant" = MSN Music Assistant
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"RealPlayer 6.0" = RealPlayer
"Revo Uninstaller" = Revo Uninstaller 1.90
"ShockwaveFlash" = Macromedia Flash Player 8
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinFlash" = WinFlash

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/25/2010 2:21:35 PM | Computer Name = SHUTTLE | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.3156, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/25/2010 2:21:35 PM | Computer Name = SHUTTLE | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.3156, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/26/2010 6:31:10 AM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
Description = Description: Unable to successfully reconcile changes since last session.
Unable to enumerate the current drives on this system. Cannot initialize the Storage
Management Engine. Error E0020002: Device \\.\PhysicalDrive0 cannot be opened. Error
00000020: The process cannot access the file because it is being used by another
process. Details: 0xE0020002 Source: PowerQuest Drive Image 7.0

Error - 11/26/2010 6:31:16 AM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
Description = Description: Unable to successfully reconcile changes since last session.
Unable to enumerate the current drives on this system. Cannot initialize the Storage
Management Engine. Error E0020002: Device \\.\PhysicalDrive0 cannot be opened. Error
00000020: The process cannot access the file because it is being used by another
process. Details: 0xE0020002 Source: PowerQuest Drive Image 7.0

Error - 11/26/2010 6:40:37 AM | Computer Name = SHUTTLE | Source = Google Update | ID = 20
Description =

Error - 11/26/2010 2:38:06 PM | Computer Name = SHUTTLE | Source = Google Update | ID = 20
Description =

Error - 11/26/2010 3:16:22 PM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
Description = Description: Unable to successfully reconcile changes since last session.
Unable to enumerate the current drives on this system. Cannot initialize the Storage
Management Engine. Details: Unspecified error Source: PowerQuest Drive Image 7.0

Error - 11/26/2010 3:19:38 PM | Computer Name = SHUTTLE | Source = PowerQuest Drive Image 7.0 | ID = 100
Description = Description: Unable to successfully reconcile changes since last session.
Unable to enumerate the current drives on this system. Cannot initialize the Storage
Management Engine. Details: Unspecified error Source: PowerQuest Drive Image 7.0

Error - 11/26/2010 3:19:40 PM | Computer Name = SHUTTLE | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

Error - 11/26/2010 3:21:28 PM | Computer Name = SHUTTLE | Source = Application Error | ID = 1000
Description = Faulting application PQV2iSvc.exe, version 2.0.1.309, faulting module
PQSmeCOM.dll, version 2.0.1.309, fault address 0x00318da0.

[ System Events ]
Error - 11/26/2010 4:27:30 PM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 11/26/2010 6:29:37 PM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 11/27/2010 4:50:32 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 11/27/2010 5:25:26 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 11/27/2010 5:45:05 AM | Computer Name = SHUTTLE | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 11/27/2010 5:45:07 AM | Computer Name = SHUTTLE | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 11/27/2010 5:47:50 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 11/27/2010 4:06:59 PM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 11/27/2010 4:17:43 PM | Computer Name = SHUTTLE | Source = Ntfs | ID = 262199
Description = The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume C:.

Error - 11/28/2010 4:39:23 AM | Computer Name = SHUTTLE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

< End of report >

Broni · Nov 28, 2010

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
O2 - BHO: (no name) - {C333CF63-767F-4831-94AC-E683D962C63C} - No CLSID value found.
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)


:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

========================================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
IMPORTANT! UN-check Remove found threats
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

NorGitram · Nov 28, 2010

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C333CF63-767F-4831-94AC-E683D962C63C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C333CF63-767F-4831-94AC-E683D962C63C}\ deleted successfully.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 16440 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Ron
->Temp folder emptied: 2007 bytes
->Temporary Internet Files folder emptied: 5285706 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 8061098 bytes
->Google Chrome cache emptied: 4906645 bytes
->Flash cache emptied: 405 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1342475 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 1848 bytes

Total Files Cleaned = 19.00 mb

[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Ron
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.17.3 log created on 11282010_141829

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

NorGitram · Nov 28, 2010

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 22
Java(TM) 6 Update 2
Out of date Java installed!
Adobe Flash Player 10.0.12.36
Adobe Reader 7.0.7
Out of date Adobe Reader installed!
Mozilla Firefox (3.0.6) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Broni · Nov 28, 2010

Update Firefox to current 3.6.12 version.

========================================================================

We need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.

====================================================================

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
On this page:

make sure, you have both boxes UN-checked AND (important!) click on Decline button

NorGitram · Nov 28, 2010

ESETScan results

D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe probably a variant of Win32/Genetik trojan
Operating memory probably a variant of Win32/Genetik trojan

Broni · Nov 28, 2010

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL

:Services

:Reg

:Files
D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

=====================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current (now, you're ready to try SP3 again)

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how your computer is doing.

NorGitram · Nov 29, 2010

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
D:\Program Files\Movielink\MovielinkManager\MovielinkCore.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 2286 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Ron
->Temp folder emptied: 401 bytes
->Temporary Internet Files folder emptied: 11005890 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 61742947 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 405 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2061 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 69.00 mb

[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Ron
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.17.3 log created on 11292010_031741

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

NorGitram · Nov 29, 2010

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 1226 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Ron
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 5517251 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 671 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1273 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 5.00 mb

[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Ron
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.17.3 log created on 11292010_032320

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

NorGitram · Nov 29, 2010

SP3 installed fine now, and the computer seems fine also.
Thanks for all your help and quick responses.

Broni · Nov 29, 2010

Way to go!!

Good luck and stay safe

Solved Can't install XP Service Pack 3 on old computer

Posts: 112 +0

Posts: 56,041 +516

Posts: 112 +0

Posts: 56,041 +516

Posts: 112 +0

Posts: 56,041 +516

Posts: 112 +0

Posts: 56,041 +516

Posts: 112 +0

Posts: 112 +0

Posts: 56,041 +516

Posts: 112 +0

Posts: 112 +0

Posts: 56,041 +516

Posts: 112 +0

Posts: 56,041 +516

Posts: 112 +0

Posts: 112 +0

Posts: 112 +0

Posts: 56,041 +516

Similar threads