also @ TechSpot: Exploit allows command prompt to launch at Windows 7 login screen

TechSpot

[Solved] Icons and start bar don't load up when windows starts up

Discussion in 'Virus and Malware Removal' started by cbolguin, Oct 26, 2010.

Thread Status:
Not open for further replies.
Page 1 of 2

  1. cbolguin Newcomer, in training

    When starting the computer I get my desktop background to show up, but the icons and the start bar do not load.

    Prior to finding this forum I had went through msconfig in safemode and unchecked a startup item called isunoces. The command listed with it was 'rundll32.exe "C:\WINDOWS\isunoces.dll",Startup'. This allowed the icons and start bar to show up.

    Then I found this forum and ran through the 8 steps preliminary removal instructions. I was able to successfully run everything in the order listed except GMER. When running this the computer would either freeze up or reboot(even after unchecking devices). I went ahead and moved onto the next step.

    Oh, and without really thinking about it, I had run all of these in safe mode instead of booting normally. Hopefully this doesn't negatively impact the results of the logs.

    Here are the logs from Malwarebytes and DDS:
    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4946

    Windows 5.1.2600 Service Pack 3 (Safe Mode)
    Internet Explorer 8.0.6001.18702

    10/25/2010 6:42:11 PM
    mbam-log-2010-10-25 (18-42-11).txt

    Scan type: Quick scan
    Objects scanned: 143220
    Time elapsed: 10 minute(s), 18 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 20
    Registry Values Infected: 0
    Registry Data Items Infected: 2
    Folders Infected: 12
    Files Infected: 13

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Adware.Seekmo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\3.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\setups (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Documents and Settings\Mom\Desktop\Setup.exe (Adware.Seekmo) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Mom\My Documents\downloads\MyFunCards(2).exe (PUP.FunWebProducts) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Mom\My Documents\downloads\MyFunCards(3).exe (PUP.FunWebProducts) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Mom\My Documents\downloads\MyFunCards.exe (PUP.FunWebProducts) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\3.bin\F3EZSETP.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\3.bin\F3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\3.bin\NPFUNWEB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\Cache\043290BE.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Installr\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\ScreenSaver\Images\045F1C4F.urr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Settings\s_FeatCk.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.


    DDS (Ver_10-10-21.02) - NTFSx86 NETWORK
    Run by Administrator at 20:44:39.09 on Mon 10/25/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.687 [GMT -5:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\Administrator\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar3.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
    mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe"
    mRun: [Reminder] c:\windows\creator\Remind_XP.exe
    mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
    mRun: [ehTray] c:\windows\ehome\ehtray.exe
    mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
    dRun: [Cxixuhoge] rundll32.exe "c:\windows\lvcfcrx.dll",Startup
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\camera~1.lnk - c:\program files\pixela\everio mediabrowser hd edition\MBCameraMonitor.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
    IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
    IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} - hxxps://secure.sunterra.com/US/downloads/svideo3.cab
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\hdfeiea3.default\
    FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
    FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
    FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: XULRunner: {BCD0BB99-AC79-4A9C-8906-552C77CD3A22} - c:\documents and settings\mom\local settings\application data\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

    ============= SERVICES / DRIVERS ===============

    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-1 243024]
    S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-1 216400]
    S1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-1 29584]
    S2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-16 921952]
    S2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-16 308136]
    S2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    S2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-8-24 92008]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-18 430152]
    S3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-8-22 231424]

    =============== Created Last 30 ================

    2010-10-25 23:28:56 -------- d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
    2010-10-25 23:28:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-25 23:28:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-25 23:28:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-25 23:28:43 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-10-25 23:22:58 -------- d-----w- c:\windows\system32\wbem\Logs
    2010-10-25 23:07:41 -------- d-----w- c:\docume~1\admini~1\locals~1\applic~1\AVG Security Toolbar
    2010-10-25 23:06:39 -------- d-----w- c:\docume~1\admini~1\locals~1\applic~1\Mozilla
    2010-10-22 02:47:58 -------- dc----w- c:\docume~1\alluse~1\applic~1\{E961CE1B-C3EA-4882-9F67-F859B555D097}
    2010-10-22 02:35:47 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-10-22 02:03:47 -------- d-----w- c:\program files\Trend Micro
    2010-10-18 17:36:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
    2010-10-15 01:45:58 0 ----a-w- c:\windows\Kxigo.bin
    2010-10-14 23:44:02 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-10-03 21:26:43 -------- d-sh--w- c:\documents and settings\administrator\IETldCache
    2010-10-03 21:21:35 -------- dc----w- c:\docume~1\alluse~1\applic~1\{ECC164E0-3133-4C70-A831-F08DB2940F70}

    ==================== Find3M ====================

    2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe

    ============= FINISH: 20:45:49.76 ===============


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-10-21.02)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/1/2006 9:48:32 PM
    System Uptime: 10/25/2010 8:37:27 PM (0 hours ago)

    Motherboard: Hewlett-Packard | | 30AE
    Processor: AMD Turion(tm) 64 Mobile Technology ML-34 | U23 | 1790/mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 63 GiB total, 33.743 GiB free.
    D: is FIXED (FAT32) - 12 GiB total, 0.648 GiB free.
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    No restore point in system.

    ==== Installed Programs ======================


    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 8.1.3
    Adobe Shockwave Player 11.5
    Adobe® Photoshop® Album Starter Edition 3.2
    AiO_Scan_CDA
    AiOSoftwareNPI
    Apple Software Update
    Athlon 64 Processor Driver
    ATI Control Panel
    ATI Display Driver
    AVG Free 9.0
    BufferChm
    Conexant AC-Link Audio
    CP_AtenaShokunin1Config
    CP_CalendarTemplates1
    cp_LightScribeConfig
    cp_OnlineProjectsConfig
    CP_Package_Basic1
    CP_Package_Variety1
    CP_Package_Variety2
    CP_Package_Variety3
    CP_Panorama1Config
    cp_PosterPrintConfig
    cp_UpdateProjectsConfig
    Critical Update for Windows Media Player 11 (KB959772)
    CueTour
    Customer Experience Enhancement
    CustomerResearchQFolder
    Destinations
    Digital Photo Navigator 1.5
    Easy Internet Sign-up
    ESPNMotion
    eSupportQFolder
    Everio MediaBrowser HD Edition
    F300
    F300_Help
    Fax_CDA
    FullDPAppQFolder
    GemMaster Mystic
    Google Toolbar for Internet Explorer
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HP Customer Participation Program 7.0
    HP DVD Play 2.0
    HP Game Console and games
    HP Help and Support
    HP Imaging Device Functions 7.0
    HP Photosmart Essential
    HP Photosmart Premier Software 6.0
    HP Photosmart, Officejet and Deskjet 7.0.A
    HP Rhapsody
    HP Solution Center 7.0
    HP User Guides--System Recovery
    HP User Guides 0025
    HP Wireless Assistant 2.00 C1
    HPPhotoSmartExpress
    HPProductAssistant
    HpSdpAppCoreApp
    InstantShareDevices
    InstantShareDevicesMFC
    iTunes
    J2SE Runtime Environment 5.0 Update 6
    Java Auto Updater
    Java(TM) 6 Update 18
    LightScribe 1.4.56.1
    Malwarebytes' Anti-Malware
    MarketResearch
    Microsoft .NET Framework 1.0 Hotfix (KB953295)
    Microsoft .NET Framework 1.0 Hotfix (KB979904)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Money 2006
    Microsoft National Language Support Downlevel APIs
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    Mozilla Firefox (3.6.10)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    muvee autoProducer 4.5
    NewCopy_CDA
    Office 2003 Trial Assistant
    OptionalContentQFolder
    Otto
    PhotoGallery
    Picasa 3
    Power Commander 3 USB
    ProductContextNPI
    Protection Portfolio 1.0
    Quick Launch Buttons 5.20 G1
    Quicken 2006
    QuickTime
    RandMap
    Readme
    RealPlayer
    RealUpgrade 1.0
    Scan
    ScannerCopy
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    SkinsHP1
    Soft Data Fax Modem with SmartCP
    SolutionCenter
    Sonic Audio Module
    Sonic Copy Module
    Sonic Data Module
    Sonic Express Labeler
    Sonic MyDVD Plus
    Sonic Update Manager
    Sonic_PrimoSDK
    SonicAC3Encoder
    SonicMPEGEncoder
    Spybot - Search & Destroy
    Status
    Synaptics Pointing Device Driver
    Texas Instruments PCIxx21/x515/xx12 drivers.
    TIPCI
    TomTom HOME 2.7.6.2056
    TomTom HOME Visual Studio Merge Modules
    Toolbox
    TourSetup
    TrayApp
    Unload
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB971180)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows Media Player 10 (KB913800)
    Update for Windows Media Player 10 (KB926251)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update Rollup 2 for Windows XP Media Center Edition 2005
    WebFldrs XP
    WebReg
    Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
    Windows Genuine Advantage Notifications (KB905474)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player Firefox Plugin
    Windows XP Media Center Edition 2005 KB925766
    Windows XP Media Center Edition 2005 KB973768
    Windows XP Service Pack 3
    Wireless Home Network Setup

    ==== Event Viewer Messages From Past Week ========

    10/25/2010 6:58:41 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
    10/25/2010 6:46:49 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
    10/25/2010 6:46:13 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AliIde AmdK8 AvgLdx86 AvgMfx86 eabfiltr Fips IntelIde Pcmcia ViaIde
    10/25/2010 6:02:52 PM, error: Service Control Manager [7022] - The Automatic Updates service hung on starting.
    10/24/2010 9:27:10 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 AvgLdx86 AvgMfx86 eabfiltr Fips
    10/21/2010 9:47:48 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    10/21/2010 7:48:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    10/21/2010 7:47:21 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK8 AvgLdx86 AvgMfx86 AvgTdiX eabfiltr Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:18 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    10/21/2010 7:47:12 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The TomTomHOMEService service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7022] - The Themes service hung on starting.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the ShellHWDetection service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the lanmanworkstation service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Dhcp service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the AudioSrv service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The SSDP Discovery Service service depends on the HTTP service which failed to start because of the following error: Access is denied.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Media Center Extender Service service depends on the SSDP Discovery Service service which failed to start because of the following error: The dependency service or group failed to start.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The hpqwmiex service depends on the Windows Management Instrumentation service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Fast User Switching Compatibility service depends on the Terminal Services service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Workstation service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Wireless Zero Configuration service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Windows Audio service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Terminal Services service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Task Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Remote Registry service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Logical Disk Manager service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The HTTP service failed to start due to the following error: Access is denied.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Help and Support service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The DHCP Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Cryptographic Services service failed to start due to the following error: The pipe has been ended.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The COM+ Event System service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 11:27:14 PM, error: Dhcp [1002] - The IP address lease 192.168.2.3 for the Network Card with network address 0014A5E8E252 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    10/20/2010 7:42:42 AM, error: Service Control Manager [7023] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error: Access is denied.
    10/19/2010 2:56:06 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the SENS service.
    10/19/2010 2:55:36 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Schedule service.
    10/19/2010 2:55:01 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the RasMan service.
    10/19/2010 2:54:31 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the W32Time service.
    10/18/2010 8:43:49 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    10/18/2010 5:17:24 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
    10/18/2010 3:42:12 AM, error: DCOM [10005] - DCOM got error "%1068" attempting to start the service hpqwmiex with arguments "-Service" in order to run the server: {F5539356-2F02-40D4-999E-FA61F45FE12E}
    10/18/2010 3:21:17 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    10/18/2010 3:19:46 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    10/18/2010 3:18:46 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    10/18/2010 2:57:42 AM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    10/18/2010 2:26:21 AM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.

    ==== End Of File ===========================
    cbolguin, Oct 26, 2010
    #1

  2. Broni Malware Annihilator

    Welcome aboard [IMG]

    I need you to re-run both tools from normal mode and post new logs.
    Skip GMER for now.
    Broni, Oct 26, 2010
    #2

  3. cbolguin Newcomer, in training

    Here are the new logs:

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4946

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    10/26/2010 9:23:51 PM
    mbam-log-2010-10-26 (21-23-51).txt

    Scan type: Quick scan
    Objects scanned: 146845
    Time elapsed: 17 minute(s), 15 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 11
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)



    DDS (Ver_10-10-21.02) - NTFSx86
    Run by Mom at 21:29:00.65 on Tue 10/26/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.286 [GMT -5:00]

    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\PROGRA~1\AVG\AVG9\avgtray.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
    C:\Program Files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
    C:\Program Files\AVG\AVG9\avgemc.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\AVG\AVG9\avgui.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Documents and Settings\Administrator\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.yahoo.com/
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uDefault_Search_URL = hxxp://www.google.com/ie
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=laptop
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar3.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
    TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"
    uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_0_9
    mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
    mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe"
    mRun: [Reminder] c:\windows\creator\Remind_XP.exe
    mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
    mRun: [ehTray] c:\windows\ehome\ehtray.exe
    mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
    dRun: [Cxixuhoge] rundll32.exe "c:\windows\lvcfcrx.dll",Startup
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\camera~1.lnk - c:\program files\pixela\everio mediabrowser hd edition\MBCameraMonitor.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} - hxxps://secure.sunterra.com/US/downloads/svideo3.cab
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\mom\applic~1\mozilla\firefox\profiles\rdebbx65.default\
    FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
    FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: XULRunner: {BCD0BB99-AC79-4A9C-8906-552C77CD3A22} - c:\documents and settings\mom\local settings\application data\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-1 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-1 29584]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-1 243024]
    R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-16 921952]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-16 308136]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-8-24 92008]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-8-22 231424]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-26 517448]

    =============== Created Last 30 ================

    2010-10-26 00:27:00 -------- d-----w- c:\docume~1\mom\applic~1\Malwarebytes
    2010-10-25 23:28:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-25 23:28:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-25 23:28:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-25 23:28:43 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-10-25 23:22:58 -------- d-----w- c:\windows\system32\wbem\Logs
    2010-10-22 02:47:58 -------- dc----w- c:\docume~1\alluse~1\applic~1\{E961CE1B-C3EA-4882-9F67-F859B555D097}
    2010-10-22 02:35:47 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-10-22 02:03:50 388096 ----a-r- c:\docume~1\mom\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2010-10-22 02:03:47 -------- d-----w- c:\program files\Trend Micro
    2010-10-18 17:37:54 -------- d-----w- c:\docume~1\mom\locals~1\applic~1\AVG Security Toolbar
    2010-10-18 17:36:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
    2010-10-15 01:45:58 0 ----a-w- c:\windows\Kxigo.bin
    2010-10-15 01:45:49 -------- d-----w- c:\docume~1\mom\locals~1\applic~1\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}
    2010-10-14 23:44:02 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-10-03 21:21:35 -------- dc----w- c:\docume~1\alluse~1\applic~1\{ECC164E0-3133-4C70-A831-F08DB2940F70}

    ==================== Find3M ====================

    2010-10-03 20:57:46 89680 ----a-w- c:\documents and settings\mom\MSSSerif120.fon
    2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe

    ============= FINISH: 21:30:41.82 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-10-21.02)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/1/2006 9:48:32 PM
    System Uptime: 10/26/2010 7:12:14 PM (2 hours ago)

    Motherboard: Hewlett-Packard | | 30AE
    Processor: AMD Turion(tm) 64 Mobile Technology ML-34 | U23 | 1790/mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 63 GiB total, 32.838 GiB free.
    D: is FIXED (FAT32) - 12 GiB total, 0.648 GiB free.
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    No restore point in system.

    ==== Installed Programs ======================


    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 8.1.3
    Adobe Shockwave Player 11.5
    Adobe® Photoshop® Album Starter Edition 3.2
    AiO_Scan_CDA
    AiOSoftwareNPI
    Apple Software Update
    Athlon 64 Processor Driver
    ATI Control Panel
    ATI Display Driver
    AVG Free 9.0
    BufferChm
    Conexant AC-Link Audio
    CP_AtenaShokunin1Config
    CP_CalendarTemplates1
    cp_LightScribeConfig
    cp_OnlineProjectsConfig
    CP_Package_Basic1
    CP_Package_Variety1
    CP_Package_Variety2
    CP_Package_Variety3
    CP_Panorama1Config
    cp_PosterPrintConfig
    cp_UpdateProjectsConfig
    Critical Update for Windows Media Player 11 (KB959772)
    CueTour
    Customer Experience Enhancement
    CustomerResearchQFolder
    Destinations
    Digital Photo Navigator 1.5
    Easy Internet Sign-up
    ESPNMotion
    eSupportQFolder
    Everio MediaBrowser HD Edition
    F300
    F300_Help
    Fax_CDA
    FullDPAppQFolder
    GemMaster Mystic
    Google Toolbar for Internet Explorer
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HP Customer Participation Program 7.0
    HP DVD Play 2.0
    HP Game Console and games
    HP Help and Support
    HP Imaging Device Functions 7.0
    HP Photosmart Essential
    HP Photosmart Premier Software 6.0
    HP Photosmart, Officejet and Deskjet 7.0.A
    HP Rhapsody
    HP Solution Center 7.0
    HP User Guides--System Recovery
    HP User Guides 0025
    HP Wireless Assistant 2.00 C1
    HPPhotoSmartExpress
    HPProductAssistant
    HpSdpAppCoreApp
    InstantShareDevices
    InstantShareDevicesMFC
    iTunes
    J2SE Runtime Environment 5.0 Update 6
    Java Auto Updater
    Java(TM) 6 Update 18
    LightScribe 1.4.56.1
    Malwarebytes' Anti-Malware
    MarketResearch
    Microsoft .NET Framework 1.0 Hotfix (KB953295)
    Microsoft .NET Framework 1.0 Hotfix (KB979904)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Money 2006
    Microsoft National Language Support Downlevel APIs
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    Mozilla Firefox (3.6.10)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    muvee autoProducer 4.5
    NewCopy_CDA
    Office 2003 Trial Assistant
    OptionalContentQFolder
    Otto
    PhotoGallery
    Picasa 3
    Power Commander 3 USB
    ProductContextNPI
    Protection Portfolio 1.0
    Quick Launch Buttons 5.20 G1
    Quicken 2006
    QuickTime
    RandMap
    Readme
    RealPlayer
    RealUpgrade 1.0
    Scan
    ScannerCopy
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    SkinsHP1
    Soft Data Fax Modem with SmartCP
    SolutionCenter
    Sonic Audio Module
    Sonic Copy Module
    Sonic Data Module
    Sonic Express Labeler
    Sonic MyDVD Plus
    Sonic Update Manager
    Sonic_PrimoSDK
    SonicAC3Encoder
    SonicMPEGEncoder
    Spybot - Search & Destroy
    Status
    Synaptics Pointing Device Driver
    Texas Instruments PCIxx21/x515/xx12 drivers.
    TIPCI
    TomTom HOME 2.7.6.2056
    TomTom HOME Visual Studio Merge Modules
    Toolbox
    TourSetup
    TrayApp
    Unload
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB971180)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows Media Player 10 (KB913800)
    Update for Windows Media Player 10 (KB926251)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update Rollup 2 for Windows XP Media Center Edition 2005
    WebFldrs XP
    WebReg
    Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
    Windows Genuine Advantage Notifications (KB905474)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player Firefox Plugin
    Windows XP Media Center Edition 2005 KB925766
    Windows XP Media Center Edition 2005 KB973768
    Windows XP Service Pack 3
    Wireless Home Network Setup

    ==== Event Viewer Messages From Past Week ========

    10/25/2010 6:58:41 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
    10/25/2010 6:46:49 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
    10/25/2010 6:46:13 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AliIde AmdK8 AvgLdx86 AvgMfx86 eabfiltr Fips IntelIde Pcmcia ViaIde
    10/25/2010 6:02:52 PM, error: Service Control Manager [7022] - The Automatic Updates service hung on starting.
    10/24/2010 9:27:10 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 AvgLdx86 AvgMfx86 eabfiltr Fips
    10/21/2010 9:47:48 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    10/21/2010 7:48:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    10/21/2010 7:47:21 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK8 AvgLdx86 AvgMfx86 AvgTdiX eabfiltr Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:21 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    10/21/2010 7:47:18 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    10/21/2010 7:47:12 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The TomTomHOMEService service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7022] - The Themes service hung on starting.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the ShellHWDetection service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the lanmanworkstation service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Dhcp service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the AudioSrv service.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The SSDP Discovery Service service depends on the HTTP service which failed to start because of the following error: Access is denied.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Media Center Extender Service service depends on the SSDP Discovery Service service which failed to start because of the following error: The dependency service or group failed to start.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The hpqwmiex service depends on the Windows Management Instrumentation service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Fast User Switching Compatibility service depends on the Terminal Services service which failed to start because of the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Workstation service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Wireless Zero Configuration service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Windows Audio service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Terminal Services service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Task Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Remote Registry service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Logical Disk Manager service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The HTTP service failed to start due to the following error: Access is denied.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Help and Support service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The DHCP Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Cryptographic Services service failed to start due to the following error: The pipe has been ended.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The COM+ Event System service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 7:43:41 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The pipe state is invalid.
    10/21/2010 11:27:14 PM, error: Dhcp [1002] - The IP address lease 192.168.2.3 for the Network Card with network address 0014A5E8E252 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    10/20/2010 7:42:42 AM, error: Service Control Manager [7023] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error: Access is denied.
    10/19/2010 8:37:48 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    10/19/2010 8:37:48 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
    10/19/2010 8:35:59 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    10/19/2010 8:35:29 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    10/19/2010 7:48:18 PM, error: DCOM [10005] - DCOM got error "%1068" attempting to start the service hpqwmiex with arguments "-Service" in order to run the server: {F5539356-2F02-40D4-999E-FA61F45FE12E}
    10/19/2010 7:44:47 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    10/19/2010 7:43:17 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    10/19/2010 2:57:06 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the RasMan service.
    10/19/2010 2:56:36 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the W32Time service.
    10/19/2010 2:56:06 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the SENS service.
    10/19/2010 2:55:36 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Schedule service.
    10/19/2010 2:54:00 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.

    ==== End Of File ===========================
    cbolguin, Oct 26, 2010
    #3

  4. Broni Malware Annihilator

    Thank you :)

    You have some Norton's leftovers. Please, run this tool to remove them: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

    ========================================================================

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

    ==================================================================

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.
    Broni, Oct 26, 2010
    #4

  5. cbolguin Newcomer, in training

    I ran the norton removal tool and it looks like it was successful.

    Here are the logs from TDSSKiller and MBRCheck:

    2010/10/26 22:06:26.0468 TDSS rootkit removing tool 2.4.5.1 Oct 26 2010 11:28:49
    2010/10/26 22:06:26.0468 ================================================================================
    2010/10/26 22:06:26.0468 SystemInfo:
    2010/10/26 22:06:26.0468
    2010/10/26 22:06:26.0468 OS Version: 5.1.2600 ServicePack: 3.0
    2010/10/26 22:06:26.0468 Product type: Workstation
    2010/10/26 22:06:26.0468 ComputerName: MATILDA
    2010/10/26 22:06:26.0468 UserName: Mom
    2010/10/26 22:06:26.0468 Windows directory: C:\WINDOWS
    2010/10/26 22:06:26.0468 System windows directory: C:\WINDOWS
    2010/10/26 22:06:26.0468 Processor architecture: Intel x86
    2010/10/26 22:06:26.0468 Number of processors: 1
    2010/10/26 22:06:26.0468 Page size: 0x1000
    2010/10/26 22:06:26.0468 Boot type: Normal boot
    2010/10/26 22:06:26.0468 ================================================================================
    2010/10/26 22:06:26.0703 Initialize success
    2010/10/26 22:06:38.0281 ================================================================================
    2010/10/26 22:06:38.0281 Scan started
    2010/10/26 22:06:38.0281 Mode: Manual;
    2010/10/26 22:06:38.0281 ================================================================================
    2010/10/26 22:06:39.0515 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2010/10/26 22:06:39.0796 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
    2010/10/26 22:06:40.0156 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2010/10/26 22:06:40.0437 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
    2010/10/26 22:06:41.0328 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
    2010/10/26 22:06:41.0578 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
    2010/10/26 22:06:41.0968 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
    2010/10/26 22:06:42.0750 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2010/10/26 22:06:42.0875 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2010/10/26 22:06:43.0343 ati2mtag (287b11a781f2b7a28f283fd4b7434daf) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
    2010/10/26 22:06:43.0656 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2010/10/26 22:06:43.0843 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2010/10/26 22:06:44.0093 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\System32\Drivers\avgldx86.sys
    2010/10/26 22:06:44.0343 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\System32\Drivers\avgmfx86.sys
    2010/10/26 22:06:44.0640 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\WINDOWS\System32\Drivers\avgtdix.sys
    2010/10/26 22:06:44.0953 BCM43XX (30d20fc98bcfd52e1da778cf19b223d4) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
    2010/10/26 22:06:45.0234 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2010/10/26 22:06:45.0406 BTWUSB (e76dc88f00d50f46072feb2371769978) C:\WINDOWS\system32\Drivers\btwusb.sys
    2010/10/26 22:06:45.0625 CAMCAUD (c2ef37f09cfee9665e6cd7c0b0afb84f) C:\WINDOWS\system32\drivers\camc6aud.sys
    2010/10/26 22:06:45.0937 CAMCHALA (512df898de5c0654647acd5c82f0bd99) C:\WINDOWS\system32\drivers\camc6hal.sys
    2010/10/26 22:06:46.0218 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2010/10/26 22:06:46.0562 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2010/10/26 22:06:46.0843 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2010/10/26 22:06:47.0093 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2010/10/26 22:06:47.0406 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
    2010/10/26 22:06:47.0718 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
    2010/10/26 22:06:48.0562 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2010/10/26 22:06:48.0859 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    2010/10/26 22:06:49.0125 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
    2010/10/26 22:06:49.0406 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2010/10/26 22:06:49.0609 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2010/10/26 22:06:50.0031 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2010/10/26 22:06:50.0203 eabfiltr (c6aca0190ee7b614673ee0c91863b1eb) C:\WINDOWS\system32\drivers\EABFiltr.sys
    2010/10/26 22:06:50.0484 eabusb (da1011db09ad641de40cd5cca70c0c43) C:\WINDOWS\system32\drivers\eabusb.sys
    2010/10/26 22:06:50.0781 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2010/10/26 22:06:50.0906 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
    2010/10/26 22:06:51.0187 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    2010/10/26 22:06:51.0484 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
    2010/10/26 22:06:52.0015 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2010/10/26 22:06:52.0406 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2010/10/26 22:06:52.0687 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2010/10/26 22:06:52.0921 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
    2010/10/26 22:06:53.0171 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2010/10/26 22:06:53.0343 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2010/10/26 22:06:53.0859 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
    2010/10/26 22:06:54.0109 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
    2010/10/26 22:06:54.0343 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
    2010/10/26 22:06:54.0687 HSFHWATI (14794f142befc962ab142584607a6631) C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys
    2010/10/26 22:06:55.0046 HSF_DP (f99bb4e2b462198b2b0a82d0949f0c41) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
    2010/10/26 22:06:55.0359 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2010/10/26 22:06:55.0953 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2010/10/26 22:06:56.0203 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2010/10/26 22:06:56.0671 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
    2010/10/26 22:06:56.0906 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2010/10/26 22:06:57.0156 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2010/10/26 22:06:57.0578 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2010/10/26 22:06:57.0734 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2010/10/26 22:06:58.0015 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2010/10/26 22:06:58.0203 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2010/10/26 22:06:58.0359 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2010/10/26 22:06:58.0578 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2010/10/26 22:06:58.0781 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2010/10/26 22:06:59.0046 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2010/10/26 22:06:59.0500 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
    2010/10/26 22:06:59.0750 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
    2010/10/26 22:06:59.0906 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2010/10/26 22:07:00.0375 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    2010/10/26 22:07:00.0765 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2010/10/26 22:07:01.0015 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2010/10/26 22:07:01.0281 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2010/10/26 22:07:01.0656 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2010/10/26 22:07:01.0953 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2010/10/26 22:07:02.0468 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2010/10/26 22:07:03.0046 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2010/10/26 22:07:03.0656 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2010/10/26 22:07:04.0000 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2010/10/26 22:07:04.0359 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2010/10/26 22:07:04.0671 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2010/10/26 22:07:04.0984 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2010/10/26 22:07:05.0250 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2010/10/26 22:07:05.0453 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2010/10/26 22:07:05.0656 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2010/10/26 22:07:05.0890 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
    2010/10/26 22:07:06.0062 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2010/10/26 22:07:06.0296 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2010/10/26 22:07:06.0640 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
    2010/10/26 22:07:06.0828 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2010/10/26 22:07:07.0031 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2010/10/26 22:07:07.0343 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2010/10/26 22:07:07.0546 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2010/10/26 22:07:07.0718 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2010/10/26 22:07:07.0890 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
    2010/10/26 22:07:08.0046 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
    2010/10/26 22:07:08.0234 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2010/10/26 22:07:08.0406 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2010/10/26 22:07:08.0640 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    2010/10/26 22:07:09.0000 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2010/10/26 22:07:09.0156 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
    2010/10/26 22:07:10.0593 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2010/10/26 22:07:10.0812 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
    2010/10/26 22:07:11.0031 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2010/10/26 22:07:11.0203 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2010/10/26 22:07:11.0390 PxHelp20 (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    2010/10/26 22:07:12.0578 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2010/10/26 22:07:12.0796 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2010/10/26 22:07:12.0937 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2010/10/26 22:07:13.0187 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2010/10/26 22:07:13.0453 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2010/10/26 22:07:13.0703 RDPCDD (79e61fed7ee9a77a13af5d08a5e8db66) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2010/10/26 22:07:13.0703 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\RDPCDD.sys. Real md5: 79e61fed7ee9a77a13af5d08a5e8db66, Fake md5: 4912d5b403614ce99c28420f75353332
    2010/10/26 22:07:13.0734 RDPCDD - detected Rootkit.Win32.TDSS.tdl3 (0)
    2010/10/26 22:07:13.0890 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2010/10/26 22:07:14.0140 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2010/10/26 22:07:14.0390 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2010/10/26 22:07:14.0656 RTL8023xp (7889e3981e0a5d347e037abd467d53a5) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
    2010/10/26 22:07:14.0875 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
    2010/10/26 22:07:15.0171 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
    2010/10/26 22:07:15.0328 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2010/10/26 22:07:15.0578 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
    2010/10/26 22:07:15.0765 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2010/10/26 22:07:16.0359 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2010/10/26 22:07:16.0578 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    2010/10/26 22:07:16.0750 Srv (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys
    2010/10/26 22:07:17.0031 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2010/10/26 22:07:17.0187 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2010/10/26 22:07:18.0250 SynTP (f484c77f748729129d5cc9c965d9f701) C:\WINDOWS\system32\DRIVERS\SynTP.sys
    2010/10/26 22:07:18.0562 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2010/10/26 22:07:18.0796 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2010/10/26 22:07:19.0062 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2010/10/26 22:07:19.0187 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2010/10/26 22:07:19.0390 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2010/10/26 22:07:19.0718 tifm21 (9179e07503630d6fb2e4162ff0196191) C:\WINDOWS\system32\drivers\tifm21.sys
    2010/10/26 22:07:20.0250 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2010/10/26 22:07:20.0765 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2010/10/26 22:07:21.0046 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2010/10/26 22:07:21.0218 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2010/10/26 22:07:21.0406 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2010/10/26 22:07:21.0609 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
    2010/10/26 22:07:21.0906 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2010/10/26 22:07:22.0109 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2010/10/26 22:07:22.0343 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2010/10/26 22:07:22.0562 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2010/10/26 22:07:22.0812 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
    2010/10/26 22:07:23.0046 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    2010/10/26 22:07:23.0328 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2010/10/26 22:07:23.0765 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2010/10/26 22:07:24.0000 winachsf (214bc3ad84907ad6ad655ac5465f449a) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
    2010/10/26 22:07:24.0359 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
    2010/10/26 22:07:24.0531 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
    2010/10/26 22:07:24.0765 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2010/10/26 22:07:24.0921 ================================================================================
    2010/10/26 22:07:24.0921 Scan finished
    2010/10/26 22:07:24.0921 ================================================================================
    2010/10/26 22:07:24.0953 Detected object count: 1
    2010/10/26 22:08:54.0937 RDPCDD (79e61fed7ee9a77a13af5d08a5e8db66) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2010/10/26 22:08:54.0937 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\RDPCDD.sys. Real md5: 79e61fed7ee9a77a13af5d08a5e8db66, Fake md5: 4912d5b403614ce99c28420f75353332
    2010/10/26 22:08:58.0359 Backup copy found, using it..
    2010/10/26 22:08:58.0375 C:\WINDOWS\system32\DRIVERS\RDPCDD.sys - will be cured after reboot
    2010/10/26 22:08:58.0375 Rootkit.Win32.TDSS.tdl3(RDPCDD) - User select action: Cure
    2010/10/26 22:09:38.0062 Deinitialize success


    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000001c

    Kernel Drivers (total 123):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806D0000 \WINDOWS\system32\hal.dll
    0xF7AD2000 \WINDOWS\system32\KDCOM.DLL
    0xF79E2000 \WINDOWS\system32\BOOTVID.dll
    0xF74BF000 klmdb.sys
    0xF7491000 ACPI.sys
    0xF7AD4000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF7480000 pci.sys
    0xF75D2000 isapnp.sys
    0xF79E6000 compbatt.sys
    0xF79EA000 \WINDOWS\system32\DRIVERS\BATTC.SYS
    0xF7B9A000 pciide.sys
    0xF7852000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF75E2000 MountMgr.sys
    0xF7443000 ftdisk.sys
    0xF7ADC000 dmload.sys
    0xF741D000 dmio.sys
    0xF79EE000 ACPIEC.sys
    0xF7B9B000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xF785A000 PartMgr.sys
    0xF75F2000 VolSnap.sys
    0xF7405000 atapi.sys
    0xF7602000 disk.sys
    0xF7612000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF73E5000 fltmgr.sys
    0xF7862000 PxHelp20.sys
    0xF73CE000 KSecDD.sys
    0xF73BB000 WudfPf.sys
    0xF732E000 Ntfs.sys
    0xF7301000 NDIS.sys
    0xF72E7000 Mup.sys
    0xF7672000 \SystemRoot\system32\DRIVERS\AmdK8.sys
    0xF7AB2000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
    0xF712D000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xF7119000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF795A000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0xF70F5000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF7962000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF7682000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xF7692000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xF76A2000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xF70D2000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF796A000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0xF76B2000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF797A000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF70A3000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xF7B06000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF7982000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF7ABA000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xF703B000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
    0xF7027000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
    0xF6FD1000 \SystemRoot\system32\drivers\camc6hal.sys
    0xF76C2000 \SystemRoot\system32\drivers\camc6aud.sys
    0xF6FAD000 \SystemRoot\system32\drivers\portcls.sys
    0xF76D2000 \SystemRoot\system32\drivers\drmk.sys
    0xF6F74000 \SystemRoot\system32\DRIVERS\HSFHWATI.sys
    0xF6E77000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
    0xF6DC7000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
    0xF798A000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF7D03000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF76E2000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF7ABE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF6DB0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF76F2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF7702000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF7992000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF6D9F000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF7712000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF799A000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF79A2000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF6D47000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xF7722000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF7B08000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF6CE9000 \SystemRoot\system32\DRIVERS\update.sys
    0xF72AA000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF7732000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF7762000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7B10000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7BF2000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7B12000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF79C2000 \SystemRoot\System32\drivers\vga.sys
    0xF7B14000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7B16000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF79CA000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF79D2000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF7A8A000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xEEA7A000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xEEA21000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xEE9E7000 \SystemRoot\System32\Drivers\avgtdix.sys
    0xEE9A8000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF7772000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xEE926000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xEE904000 \SystemRoot\System32\drivers\afd.sys
    0xF7782000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xEE8D9000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xEE869000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF77A2000 \SystemRoot\System32\Drivers\Fips.SYS
    0xF7B1C000 \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
    0xF788A000 \SystemRoot\System32\Drivers\avgmfx86.sys
    0xEE835000 \SystemRoot\System32\Drivers\avgldx86.sys
    0xED362000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xED34A000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF7B5E000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xEE990000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF7972000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7CA0000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF052000 \SystemRoot\System32\ati2cqag.dll
    0xBF08C000 \SystemRoot\System32\atikvmag.dll
    0xBF0C2000 \SystemRoot\System32\ati3duag.dll
    0xBF323000 \SystemRoot\System32\ativvaxx.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0x99F15000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0x99AF4000 \SystemRoot\system32\drivers\wdmaud.sys
    0x99F79000 \SystemRoot\system32\drivers\sysaudio.sys
    0x99B19000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0x99891000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0x99760000 \SystemRoot\System32\Drivers\HTTP.sys
    0x99579000 \SystemRoot\system32\DRIVERS\srv.sys
    0x99698000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 67):
    0 System Idle Process
    4 System
    724 C:\WINDOWS\system32\smss.exe
    796 csrss.exe
    824 C:\WINDOWS\system32\winlogon.exe
    868 C:\WINDOWS\system32\services.exe
    880 C:\WINDOWS\system32\lsass.exe
    1020 C:\WINDOWS\system32\ati2evxx.exe
    1052 C:\WINDOWS\system32\svchost.exe
    1160 svchost.exe
    1220 C:\WINDOWS\system32\svchost.exe
    1256 C:\WINDOWS\system32\svchost.exe
    1300 C:\Program Files\AVG\AVG9\avgchsvx.exe
    1308 C:\Program Files\AVG\AVG9\avgrsx.exe
    1380 svchost.exe
    1468 svchost.exe
    1544 C:\Program Files\AVG\AVG9\avgcsrvx.exe
    208 C:\WINDOWS\system32\spoolsv.exe
    380 C:\WINDOWS\system32\ati2evxx.exe
    512 C:\WINDOWS\explorer.exe
    520 C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\shell.exe
    128 C:\Documents and Settings\Mom\Application Data\Microsoft\svchost.exe
    1600 C:\DOCUME~1\Mom\LOCALS~1\Temp\dwm.exe
    2044 svchost.exe
    244 C:\Program Files\AVG\AVG9\avgwdsvc.exe
    1556 C:\WINDOWS\ehome\ehrecvr.exe
    360 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
    448 C:\WINDOWS\ehome\ehSched.exe
    560 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    664 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    764 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    1084 C:\Program Files\Java\jre6\bin\jqs.exe
    1328 C:\Program Files\HP\QuickPlay\QPService.exe
    364 C:\Program Files\iTunes\iTunesHelper.exe
    1168 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    1560 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
    1604 C:\PROGRA~1\AVG\AVG9\avgtray.exe
    1616 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    1636 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    1404 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    1588 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    1780 C:\WINDOWS\ehome\ehtray.exe
    2128 C:\WINDOWS\system32\ctfmon.exe
    2156 C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
    2188 C:\Program Files\AVG\AVG9\avgnsx.exe
    2280 svchost.exe
    2300 C:\WINDOWS\system32\svchost.exe
    2308 C:\Program Files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe
    2320 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
    2420 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    2508 C:\Program Files\AVG\AVG9\avgemc.exe
    2692 mcrdsvc.exe
    2868 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    3160 C:\Program Files\AVG\AVG9\avgcsrvx.exe
    3260 C:\WINDOWS\system32\wuauclt.exe
    3452 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    3648 C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    3920 C:\WINDOWS\ehome\ehmsas.exe
    3940 wmiprvse.exe
    3988 C:\Program Files\iPod\bin\iPodService.exe
    2516 alg.exe
    1788 C:\WINDOWS\system32\dllhost.exe
    3360 C:\PROGRA~1\HPQ\shared\HPQTOA~1.EXE
    3600 C:\WINDOWS\system32\svchost.exe
    1688 C:\Program Files\Mozilla Firefox\firefox.exe
    3788 C:\Program Files\Mozilla Firefox\plugin-container.exe
    4908 C:\Documents and Settings\Mom\My Documents\Downloads\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000f`ab58ec00 (FAT32)

    PhysicalDrive0 Model Number: WDCWD800UE-22KVT0, Rev: 01.03K01

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: D0919EC9044E217466E4B6B4F0D4E99E29BDE3F9


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:

    Done!
    cbolguin, Oct 26, 2010
    #5

  6. Broni Malware Annihilator

    TDSSKiller removed a rootkit, but your MBR seems to infected as well.

    Please download NTBR by noahdfear and save it to your Desktop.
    File size: 2.44 MB (2,565,432 bytes)

    • Place a blank CD in your CD drive.
    • Double click on NTBR_CD.exe file and a folder of the same name will appear.
    • Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
    • Follow the prompts to burn the CD.
    • Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
    • If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.
    • Insert the newly created CD into your infected PC and reboot your computer.
    • Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
    • Read the warning and then continue as prompted.
    • You first need to select your keyboard layout - press Enter for English.
    • Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
    • On the following screen enter 5 to select Install Standard MBR code.
    • Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
    • When asked to confirm please do so.
    • Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
    • Eject the disc and then press ctrl+alt+del to reboot the PC.
    Once rebooted, run MBRCheck again and post its log.
    Broni, Oct 26, 2010
    #6

  7. cbolguin Newcomer, in training

    Here are the new MBRCheck Logs:

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000001c

    Kernel Drivers (total 130):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806D0000 \WINDOWS\system32\hal.dll
    0xF7AD2000 \WINDOWS\system32\KDCOM.DLL
    0xF79E2000 \WINDOWS\system32\BOOTVID.dll
    0xF74A3000 ACPI.sys
    0xF7AD4000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF7492000 pci.sys
    0xF75D2000 isapnp.sys
    0xF79E6000 compbatt.sys
    0xF79EA000 \WINDOWS\system32\DRIVERS\BATTC.SYS
    0xF7B9A000 pciide.sys
    0xF7852000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF7AD6000 intelide.sys
    0xF7AD8000 viaide.sys
    0xF7ADA000 aliide.sys
    0xF7474000 pcmcia.sys
    0xF75E2000 MountMgr.sys
    0xF7455000 ftdisk.sys
    0xF7ADC000 dmload.sys
    0xF742F000 dmio.sys
    0xF79EE000 ACPIEC.sys
    0xF7B9B000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xF785A000 PartMgr.sys
    0xF75F2000 VolSnap.sys
    0xF7417000 atapi.sys
    0xF7602000 disk.sys
    0xF7612000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF73F7000 fltmgr.sys
    0xF7862000 PxHelp20.sys
    0xF73E0000 KSecDD.sys
    0xF73CD000 WudfPf.sys
    0xF7340000 Ntfs.sys
    0xF7313000 NDIS.sys
    0xF7622000 Serial.sys
    0xF7632000 ohci1394.sys
    0xF7642000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xF72F9000 Mup.sys
    0xF66D6000 \SystemRoot\system32\DRIVERS\AmdK8.sys
    0xF7AA6000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
    0xF6505000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xF64F1000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF7942000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0xF64CD000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF794A000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF66C6000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xF66B6000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xF66A6000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xF64AA000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF7952000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0xF6696000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF795A000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF647B000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xF7B08000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF7962000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF7AAE000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xF6413000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
    0xF63FF000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
    0xF63A9000 \SystemRoot\system32\drivers\camc6hal.sys
    0xF6686000 \SystemRoot\system32\drivers\camc6aud.sys
    0xF6385000 \SystemRoot\system32\drivers\portcls.sys
    0xF6676000 \SystemRoot\system32\drivers\drmk.sys
    0xF634C000 \SystemRoot\system32\DRIVERS\HSFHWATI.sys
    0xF624F000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
    0xF619F000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
    0xF796A000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF7B9C000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF6666000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF7AB2000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF6188000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF7672000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF7682000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF7972000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF6177000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF7692000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF797A000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF7982000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF611F000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xF76A2000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF7B0A000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF60C1000 \SystemRoot\system32\DRIVERS\update.sys
    0xF7ACE000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF76B2000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF76E2000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7B0E000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7C13000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7B10000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF79A2000 \SystemRoot\System32\drivers\vga.sys
    0xF7B12000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7B14000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF79AA000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF79B2000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF7A7A000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xEDEF2000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xEDE99000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xEDE5F000 \SystemRoot\System32\Drivers\avgtdix.sys
    0xEDA5D000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF76F2000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xEDA0D000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xED9EB000 \SystemRoot\System32\drivers\afd.sys
    0xF7702000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xED9C0000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xED950000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF7722000 \SystemRoot\System32\Drivers\Fips.SYS
    0xF7B18000 \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
    0xF79C2000 \SystemRoot\System32\Drivers\avgmfx86.sys
    0xED762000 \SystemRoot\System32\Drivers\avgldx86.sys
    0xEBE5E000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xEBE46000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF7B56000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xEDA4D000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF79BA000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7CD2000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF052000 \SystemRoot\System32\ati2cqag.dll
    0xBF08C000 \SystemRoot\System32\atikvmag.dll
    0xBF0C2000 \SystemRoot\System32\ati3duag.dll
    0xBF323000 \SystemRoot\System32\ativvaxx.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xB8724000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xB82EB000 \SystemRoot\system32\drivers\wdmaud.sys
    0xB84D0000 \SystemRoot\system32\drivers\sysaudio.sys
    0xB81A8000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xB8077000 \SystemRoot\System32\Drivers\HTTP.sys
    0xB7FF8000 \SystemRoot\system32\DRIVERS\srv.sys
    0xB819C000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xB7860000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xB71E1000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 66):
    0 System Idle Process
    4 System
    724 C:\WINDOWS\system32\smss.exe
    796 csrss.exe
    824 C:\WINDOWS\system32\winlogon.exe
    868 C:\WINDOWS\system32\services.exe
    880 C:\WINDOWS\system32\lsass.exe
    1028 C:\WINDOWS\system32\ati2evxx.exe
    1044 C:\WINDOWS\system32\svchost.exe
    1144 svchost.exe
    1184 C:\WINDOWS\system32\svchost.exe
    1220 C:\WINDOWS\system32\svchost.exe
    1280 C:\Program Files\AVG\AVG9\avgchsvx.exe
    1288 C:\Program Files\AVG\AVG9\avgrsx.exe
    1408 C:\Program Files\AVG\AVG9\avgcsrvx.exe
    1576 C:\WINDOWS\system32\ati2evxx.exe
    1656 svchost.exe
    1696 C:\WINDOWS\explorer.exe
    1740 C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\shell.exe
    1752 svchost.exe
    436 C:\WINDOWS\system32\spoolsv.exe
    460 C:\Documents and Settings\Mom\Application Data\Microsoft\svchost.exe
    572 C:\DOCUME~1\Mom\LOCALS~1\Temp\dwm.exe
    2028 svchost.exe
    200 C:\Program Files\AVG\AVG9\avgwdsvc.exe
    244 C:\WINDOWS\ehome\ehrecvr.exe
    280 C:\WINDOWS\ehome\ehSched.exe
    528 C:\Program Files\Java\jre6\bin\jqs.exe
    276 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    1472 svchost.exe
    1456 C:\WINDOWS\system32\svchost.exe
    1460 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
    2072 mcrdsvc.exe
    2224 C:\WINDOWS\system32\wuauclt.exe
    2340 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    2384 C:\Program Files\AVG\AVG9\avgemc.exe
    2452 C:\Program Files\AVG\AVG9\avgnsx.exe
    2608 C:\Program Files\AVG\AVG9\avgcsrvx.exe
    2972 C:\WINDOWS\system32\dllhost.exe
    2980 wmiprvse.exe
    3192 alg.exe
    3368 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
    3408 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    3436 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    3448 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    3460 C:\Program Files\HP\QuickPlay\QPService.exe
    3600 C:\Program Files\iTunes\iTunesHelper.exe
    3664 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    3680 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
    3700 C:\PROGRA~1\AVG\AVG9\avgtray.exe
    3728 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    3744 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    3760 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    3804 C:\WINDOWS\ehome\ehtray.exe
    3880 C:\WINDOWS\system32\ctfmon.exe
    3952 C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
    4020 C:\WINDOWS\ehome\ehmsas.exe
    4052 C:\Program Files\iPod\bin\iPodService.exe
    764 wmiprvse.exe
    1072 C:\Program Files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe
    1316 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    1956 C:\WINDOWS\system32\svchost.exe
    2080 C:\PROGRA~1\HPQ\shared\HPQTOA~1.EXE
    3348 C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    3564 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    3768 C:\Documents and Settings\Mom\My Documents\Downloads\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000f`ab58ec00 (FAT32)

    PhysicalDrive0 Model Number: WDCWD800UE-22KVT0, Rev: 01.03K01

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!
    cbolguin, Oct 26, 2010
    #7

  8. Broni Malware Annihilator

    Looks good now :)

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE. If Combofix asks you to install Recovery Console, please allow it.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
    Broni, Oct 27, 2010
    #8

  9. cbolguin Newcomer, in training

    I really appreciate you helping me with this!

    Here are the ComboFix logs:
    ComboFix 10-10-26.01 - Mom 10/26/2010 23:18:28.1.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.403 [GMT -5:00]
    Running from: c:\documents and settings\Mom\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Mom\Application Data\Microsoft\stor.cfg
    c:\documents and settings\Mom\Application Data\Microsoft\svchost.exe
    c:\documents and settings\Mom\Application Data\Microsoft\Windows\shell.exe
    c:\documents and settings\Mom\Local Settings\Application Data\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}
    c:\documents and settings\Mom\Local Settings\Application Data\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}\chrome.manifest
    c:\documents and settings\Mom\Local Settings\Application Data\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}\chrome\content\_cfg.js
    c:\documents and settings\Mom\Local Settings\Application Data\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}\chrome\content\overlay.xul
    c:\documents and settings\Mom\Local Settings\Application Data\{BCD0BB99-AC79-4A9C-8906-552C77CD3A22}\install.rdf
    C:\Microsoft
    c:\program files\Internet Explorer\svchost.exe
    c:\windows\system32\_000006_.tmp.dll
    c:\windows\system32\_000007_.tmp.dll
    c:\windows\system32\_000008_.tmp.dll
    c:\windows\system32\_000011_.tmp.dll
    c:\windows\system32\_000025_.tmp.dll
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2010-09-27 to 2010-10-27 )))))))))))))))))))))))))))))))
    .

    2010-10-27 02:47 . 2010-10-27 02:47 128512 ----a-w- c:\program files\Windows NT\shell.exe
    2010-10-26 00:27 . 2010-10-26 00:27 -------- d-----w- c:\documents and settings\Mom\Application Data\Malwarebytes
    2010-10-25 23:28 . 2010-10-25 23:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2010-10-25 23:28 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-25 23:28 . 2010-10-25 23:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-25 23:28 . 2010-10-25 23:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-10-25 23:28 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-25 23:22 . 2010-10-27 00:15 -------- d-----w- c:\windows\system32\wbem\Logs
    2010-10-25 23:07 . 2010-10-25 23:07 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
    2010-10-25 23:06 . 2010-10-25 23:06 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
    2010-10-22 02:47 . 2010-10-22 02:47 -------- dc----w- c:\documents and settings\All Users\Application Data\{E961CE1B-C3EA-4882-9F67-F859B555D097}
    2010-10-22 02:35 . 2010-10-22 02:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-10-22 02:03 . 2010-10-22 02:03 388096 ----a-r- c:\documents and settings\Mom\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-10-22 02:03 . 2010-10-22 02:03 -------- d-----w- c:\program files\Trend Micro
    2010-10-22 00:48 . 2010-10-22 00:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\Leadertech
    2010-10-18 17:37 . 2010-10-18 17:37 -------- d-----w- c:\documents and settings\Mom\Local Settings\Application Data\AVG Security Toolbar
    2010-10-18 17:36 . 2010-10-18 17:36 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
    2010-10-15 01:45 . 2010-10-21 18:26 0 ----a-w- c:\windows\Kxigo.bin
    2010-10-15 00:59 . 2010-10-16 10:03 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2010-10-14 23:44 . 2010-10-14 23:44 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-10-14 14:05 . 2010-10-14 14:05 -------- d-----w- c:\documents and settings\Mom\Application Data\GTek
    2010-10-14 00:57 . 2010-10-14 00:58 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2010-10-12 19:59 . 2010-10-12 19:59 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-10-12 19:20 . 2010-10-12 19:20 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-10-03 21:26 . 2010-10-03 21:26 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2010-10-03 21:21 . 2010-10-03 21:21 -------- dc----w- c:\documents and settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-10-27 03:10 . 2004-08-10 15:00 4224 ----a-w- c:\windows\system32\drivers\rdpcdd.sys
    2010-10-03 20:57 . 2007-12-16 22:04 89680 ----a-w- c:\documents and settings\Mom\MSSSerif120.fon
    2010-08-17 13:17 . 2004-08-10 15:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-10-06 2475336]

    [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
    2010-10-06 16:31 2475336 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-10-06 2475336]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-26 282624]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-15 202256]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-19 729178]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2005-12-12 94208]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
    "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 405504]
    "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-08-01 233534]
    "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-10-04 2067808]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-11 344064]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
    "Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
    "RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Camera Monitor HD.lnk - c:\program files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe [2010-9-1 541976]
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
    HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2010-07-16 13:53 12536 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\HP Rhapsody\\rhapsody.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/1/2009 5:11 PM 216400]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/1/2009 5:11 PM 243024]
    R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/16/2010 8:53 AM 921952]
    R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/16/2010 8:53 AM 308136]
    R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [8/24/2010 4:38 AM 92008]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [8/22/2005 4:06 AM 231424]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 7:25 PM 517448]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-10-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-387748528-3001526100-3984265221-1005.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2010-10-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2010-10-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-387748528-3001526100-3984265221-1005.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2010-10-26 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    uDefault_Search_URL = hxxp://www.google.com/ie
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=laptop
    uInternet Settings,ProxyServer = http=127.0.0.1:50370
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
    FF - ProfilePath - c:\documents and settings\Mom\Application Data\Mozilla\Firefox\Profiles\rdebbx65.default\
    FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4cbc85a8&v=6.010.006.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q=
    FF - prefs.js: network.proxy.http - 127.0.0.1
    FF - prefs.js: network.proxy.http_port - 50370
    FF - prefs.js: network.proxy.type - 1
    FF - component: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
    FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
    FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
    HKU-Default-Run-Cxixuhoge - c:\windows\lvcfcrx.dll
    SafeBoot-klmdb.sys
    MSConfigStartUp-Edilazu - c:\windows\isunoces.dll



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-10-26 23:22
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????n??|?`???? ???B?????????????hLC? ??????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(824)
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2010-10-26 23:25:45
    ComboFix-quarantined-files.txt 2010-10-27 04:25

    Pre-Run: 35,106,775,040 bytes free
    Post-Run: 35,176,841,216 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

    - - End Of File - - FF43245988213A488EDA7E372D650443
    cbolguin, Oct 27, 2010
    #9

  10. Broni Malware Annihilator

    You're very welcome :)

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\windows\Kxigo.bin

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:50370

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Reminder"=-

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    Broni, Oct 27, 2010
    #10

  11. cbolguin Newcomer, in training

    Here are the new ComboFix Logs:
    ComboFix 10-10-26.01 - Mom 10/26/2010 23:57:19.2.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.432 [GMT -5:00]
    Running from: c:\documents and settings\Mom\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Mom\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    FILE ::
    "c:\windows\Kxigo.bin"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Kxigo.bin

    .
    ((((((((((((((((((((((((( Files Created from 2010-09-27 to 2010-10-27 )))))))))))))))))))))))))))))))
    .

    2010-10-27 02:47 . 2010-10-27 02:47 128512 ----a-w- c:\program files\Windows NT\shell.exe
    2010-10-26 00:27 . 2010-10-26 00:27 -------- d-----w- c:\documents and settings\Mom\Application Data\Malwarebytes
    2010-10-25 23:28 . 2010-10-25 23:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2010-10-25 23:28 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-25 23:28 . 2010-10-25 23:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-25 23:28 . 2010-10-25 23:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-10-25 23:28 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-25 23:22 . 2010-10-27 00:15 -------- d-----w- c:\windows\system32\wbem\Logs
    2010-10-25 23:07 . 2010-10-25 23:07 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
    2010-10-25 23:06 . 2010-10-25 23:06 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
    2010-10-22 02:47 . 2010-10-22 02:47 -------- dc----w- c:\documents and settings\All Users\Application Data\{E961CE1B-C3EA-4882-9F67-F859B555D097}
    2010-10-22 02:35 . 2010-10-22 02:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-10-22 02:03 . 2010-10-22 02:03 388096 ----a-r- c:\documents and settings\Mom\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-10-22 02:03 . 2010-10-22 02:03 -------- d-----w- c:\program files\Trend Micro
    2010-10-22 00:48 . 2010-10-22 00:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\Leadertech
    2010-10-18 17:37 . 2010-10-18 17:37 -------- d-----w- c:\documents and settings\Mom\Local Settings\Application Data\AVG Security Toolbar
    2010-10-18 17:36 . 2010-10-18 17:36 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
    2010-10-15 00:59 . 2010-10-16 10:03 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2010-10-14 23:44 . 2010-10-14 23:44 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-10-14 14:05 . 2010-10-14 14:05 -------- d-----w- c:\documents and settings\Mom\Application Data\GTek
    2010-10-14 00:57 . 2010-10-14 00:58 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2010-10-12 19:59 . 2010-10-12 19:59 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-10-12 19:20 . 2010-10-12 19:20 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-10-03 21:26 . 2010-10-03 21:26 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2010-10-03 21:21 . 2010-10-03 21:21 -------- dc----w- c:\documents and settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-10-27 03:10 . 2004-08-10 15:00 4224 ----a-w- c:\windows\system32\drivers\rdpcdd.sys
    2010-10-03 20:57 . 2007-12-16 22:04 89680 ----a-w- c:\documents and settings\Mom\MSSSerif120.fon
    2010-08-17 13:17 . 2004-08-10 15:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
    .

    ((((((((((((((((((((((((((((( SnapShot@2010-10-27_04.22.54 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2010-10-27 04:33 . 2010-10-27 04:33 16384 c:\windows\Temp\Perflib_Perfdata_1bc.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-10-06 2475336]

    [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
    2010-10-06 16:31 2475336 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-10-06 2475336]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-26 282624]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-15 202256]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-19 729178]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2005-12-12 94208]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
    "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 405504]
    "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-08-01 233534]
    "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-10-04 2067808]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-11 344064]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
    "RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Camera Monitor HD.lnk - c:\program files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe [2010-9-1 541976]
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
    HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2010-07-16 13:53 12536 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\HP Rhapsody\\rhapsody.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/1/2009 5:11 PM 216400]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/1/2009 5:11 PM 243024]
    R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/16/2010 8:53 AM 921952]
    R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/16/2010 8:53 AM 308136]
    R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [8/24/2010 4:38 AM 92008]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [8/22/2005 4:06 AM 231424]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 7:25 PM 517448]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-10-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-387748528-3001526100-3984265221-1005.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2010-10-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2010-10-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-387748528-3001526100-3984265221-1005.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2010-10-26 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    uDefault_Search_URL = hxxp://www.google.com/ie
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=laptop
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
    FF - ProfilePath - c:\documents and settings\Mom\Application Data\Mozilla\Firefox\Profiles\rdebbx65.default\
    FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4cbc85a8&v=6.010.006.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q=
    FF - prefs.js: network.proxy.http - 127.0.0.1
    FF - prefs.js: network.proxy.http_port - 50370
    FF - prefs.js: network.proxy.type - 0
    FF - component: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
    FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
    FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-10-27 00:02
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????n??|?????? ???B?????????????hLC? ??????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(824)
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2010-10-27 00:05:11
    ComboFix-quarantined-files.txt 2010-10-27 05:05
    ComboFix2.txt 2010-10-27 04:25

    Pre-Run: 35,175,092,224 bytes free
    Post-Run: 35,167,518,720 bytes free

    - - End Of File - - 0599EBAE998756C91C6E5B42B8695ADC
    cbolguin, Oct 27, 2010
    #11

  12. Broni Malware Annihilator

    Good :)

    How is computer doing at the moment?

    My bed time is coming, so I'll leave with a homework :)

    Download OTL to your Desktop.

    * Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    * Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop



    * Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
    Broni, Oct 27, 2010
    #12

  13. cbolguin Newcomer, in training

    The computer seems to be running quite a bit better. No more issues on the start up.

    I have some windows updates that popped up. Should I install those now, or wait I've been declared clear?

    I have to call it a night as well. I should be able to start up again tomorrow evening. Thanks again for taking the time to help me tonight! Your responses were very quick!
    cbolguin, Oct 27, 2010
    #13

  14. Broni Malware Annihilator

    You're very welcome :)
    I'd better, if you hold on with updates for now.
    Broni, Oct 27, 2010
    #14

  15. cbolguin Newcomer, in training

    Here is OTL.txt:
    OTL logfile created on: 10/27/2010 12:33:08 AM - Run 1
    OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Mom\Desktop
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    894.00 Mb Total Physical Memory | 434.00 Mb Available Physical Memory | 49.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 62.67 Gb Total Space | 32.66 Gb Free Space | 52.11% Space Free | Partition Type: NTFS
    Drive D: | 11.83 Gb Total Space | 0.65 Gb Free Space | 5.48% Space Free | Partition Type: FAT32

    Computer Name: MATILDA | User Name: Mom | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/10/27 00:30:13 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mom\Desktop\OTL.exe
    PRC - [2010/10/04 11:41:18 | 002,067,808 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
    PRC - [2010/09/23 08:51:38 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
    PRC - [2010/08/24 04:38:18 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
    PRC - [2010/08/24 04:38:16 | 000,247,144 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
    PRC - [2010/07/21 09:37:30 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
    PRC - [2010/07/16 08:53:56 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
    PRC - [2010/07/16 08:53:49 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
    PRC - [2010/07/16 08:53:30 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
    PRC - [2010/07/16 08:53:15 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
    PRC - [2010/03/15 15:01:35 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    PRC - [2009/07/21 17:25:42 | 000,541,976 | ---- | M] (PIXELA CORPORATION) -- C:\Program Files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe
    PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/03/09 11:09:58 | 000,063,712 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    PRC - [2005/12/22 10:57:10 | 000,405,504 | ---- | M] (Hewlett-Packard ) -- C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
    PRC - [2005/12/08 15:45:12 | 000,516,182 | ---- | M] () -- C:\Program Files\HPQ\shared\HpqToaster.exe
    PRC - [2005/09/24 02:42:32 | 000,475,136 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/10/27 00:30:13 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mom\Desktop\OTL.exe
    MOD - [2010/03/15 15:02:41 | 000,118,784 | ---- | M] (RealPlayer) -- C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
    MOD - [2009/08/13 08:55:04 | 001,748,992 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
    MOD - [2005/11/30 17:31:34 | 000,282,624 | ---- | M] (Hewlett-Packard ) -- C:\Program Files\HPQ\Quick Launch Buttons\cpqinfo.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
    SRV - [2010/10/06 11:31:48 | 000,517,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
    SRV - [2010/08/24 04:38:18 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
    SRV - [2010/07/21 09:37:30 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
    SRV - [2010/07/16 08:53:49 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
    SRV - [2006/03/03 22:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Mom\LOCALS~1\Temp\catchme.sys -- (catchme)
    DRV - [2010/07/16 08:54:03 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
    DRV - [2010/07/16 08:53:31 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
    DRV - [2010/06/02 08:43:33 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
    DRV - [2005/11/28 04:35:38 | 000,424,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
    DRV - [2005/11/10 17:51:00 | 001,396,224 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
    DRV - [2005/09/30 06:11:00 | 000,078,720 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
    DRV - [2005/09/20 05:30:56 | 000,162,432 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
    DRV - [2005/08/22 04:06:00 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
    DRV - [2005/08/22 04:06:00 | 000,718,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
    DRV - [2005/08/22 04:06:00 | 000,231,424 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWATI.sys -- (HSFHWATI)
    DRV - [2005/08/18 03:22:54 | 000,056,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
    DRV - [2005/08/02 05:00:00 | 000,349,312 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6hal.sys -- (CAMCHALA)
    DRV - [2005/08/02 04:58:00 | 000,038,016 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6aud.sys -- (CAMCAUD)
    DRV - [2005/06/19 15:33:18 | 000,190,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
    DRV - [2005/05/05 12:04:08 | 000,007,936 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
    DRV - [2005/05/05 12:04:04 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
    DRV - [2005/03/09 17:53:00 | 000,036,352 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
    DRV - [2004/08/04 01:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
    DRV - [2001/08/17 23:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
    FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
    FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
    FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.863
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.1
    FF - prefs.js..extensions.enabledItems: avg@igeared:6.010.006.004
    FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4cbc85a8&v=6.010.006.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q="
    FF - prefs.js..network.proxy.http: "127.0.0.1"
    FF - prefs.js..network.proxy.http_port: 50370
    FF - prefs.js..network.proxy.type: 0

    FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/10/26 22:02:19 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/15 15:02:42 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/10/26 19:25:27 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/16 12:42:05 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/17 09:54:36 | 000,000,000 | ---D | M]

    [2008/08/29 18:27:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Mozilla\Extensions
    [2008/05/17 08:31:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Mozilla\Extensions\home2@tomtom.com
    [2010/10/26 19:25:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Mozilla\Firefox\Profiles\rdebbx65.default\extensions
    [2010/09/04 14:21:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Mom\Application Data\Mozilla\Firefox\Profiles\rdebbx65.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2007/08/01 15:45:00 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Mom\Application Data\Mozilla\Firefox\Profiles\rdebbx65.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
    [2010/06/20 11:36:02 | 000,010,025 | ---- | M] () -- C:\Documents and Settings\Mom\Application Data\Mozilla\Firefox\Profiles\rdebbx65.default\searchplugins\mywebsearch.xml
    [2010/10/26 19:25:08 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2006/01/18 13:50:00 | 000,319,488 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll

    O1 HOSTS File: ([2010/10/27 00:02:52 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
    O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
    O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
    O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O3 - HKCU\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
    O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
    O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
    O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
    O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
    O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
    O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Camera Monitor HD.lnk = C:\Program Files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe (PIXELA CORPORATION)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
    O16 - DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} https://secure.sunterra.com/US/downloads/svideo3.cab (Surround Video V3.0 Control Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
    O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
    O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
    O24 - Desktop WallPaper: C:\Documents and Settings\Mom\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Mom\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2001/07/27 22:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: vidc.LEAD - LCODCCMP.DLL File not found

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (17183584330711040)

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/10/27 00:30:12 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Mom\Desktop\OTL.exe
    [2010/10/27 00:17:53 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
    [2010/10/27 00:17:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
    [2010/10/26 23:17:02 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/10/26 23:14:55 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/10/26 23:14:55 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/10/26 23:14:55 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/10/26 23:14:55 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2010/10/26 23:14:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/10/26 23:13:51 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/10/25 19:27:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Mom\Application Data\Malwarebytes
    [2010/10/25 19:26:31 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Mom\Cookies
    [2010/10/25 19:25:44 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Mom\Recent
    [2010/10/25 18:28:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/10/25 18:28:43 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/10/25 18:28:43 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/10/25 18:28:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/10/25 18:26:23 | 000,000,000 | -HSD | C] -- C:\System Volume Information
    [2010/10/25 18:22:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\Temp
    [2010/10/24 21:25:37 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
    [2010/10/21 21:47:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{E961CE1B-C3EA-4882-9F67-F859B555D097}
    [2010/10/21 21:35:47 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
    [2010/10/21 21:03:47 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
    [2010/10/18 12:37:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Mom\Local Settings\Application Data\AVG Security Toolbar
    [2010/10/18 12:36:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
    [2010/10/16 07:22:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Identities
    [2010/10/14 19:59:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
    [2010/10/14 19:30:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
    [2010/10/14 09:05:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Mom\Application Data\GTek
    [2010/10/13 19:58:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Real
    [2010/10/13 19:57:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
    [2010/10/13 19:56:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
    [2010/10/12 14:58:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
    [2010/10/12 14:58:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
    [2010/10/12 11:21:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
    [2010/10/12 11:21:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
    [2010/10/03 16:21:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}
    [76 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2010/10/27 00:31:52 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-387748528-3001526100-3984265221-1005.job
    [2010/10/27 00:31:51 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-387748528-3001526100-3984265221-1005.job
    [2010/10/27 00:30:13 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mom\Desktop\OTL.exe
    [2010/10/27 00:10:51 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/10/27 00:10:22 | 000,000,297 | ---- | M] () -- C:\hpqp.ini
    [2010/10/27 00:10:22 | 000,000,039 | ---- | M] () -- C:\XP_TV.ini
    [2010/10/27 00:09:50 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    [2010/10/27 00:09:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/10/27 00:09:40 | 937,676,800 | -HS- | M] () -- C:\hiberfil.sys
    [2010/10/27 00:02:52 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/10/26 23:51:31 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Mom\Local Settings\Application Data\prvlcl.dat
    [2010/10/26 23:17:08 | 000,000,325 | RHS- | M] () -- C:\boot.ini
    [2010/10/26 23:06:47 | 003,887,102 | R--- | M] () -- C:\Documents and Settings\Mom\Desktop\ComboFix.exe
    [2010/10/26 21:49:29 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2010/10/26 19:19:56 | 066,872,513 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
    [2010/10/25 22:16:10 | 000,079,872 | ---- | M] () -- C:\WINDOWS\MBR.exe
    [2010/10/25 19:25:45 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    [2010/10/25 18:03:04 | 000,000,209 | ---- | M] () -- C:\Boot.bak
    [2010/10/24 20:42:14 | 000,000,777 | ---- | M] () -- C:\Documents and Settings\Mom\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
    [2010/10/24 20:42:14 | 000,000,759 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
    [2010/10/21 23:33:52 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\Mom\Desktop\HiJackThis.lnk
    [2010/10/21 20:35:32 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\Mom\Desktop\regbackup_20101021.reg
    [2010/10/21 19:54:33 | 000,000,851 | ---- | M] () -- C:\Documents and Settings\Mom\Desktop\Shortcut to Digital Camera Photos.lnk
    [2010/10/19 09:48:26 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Kbelologiwa.dat
    [2010/10/18 02:51:31 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/10/08 03:18:32 | 000,441,692 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/10/08 03:18:32 | 000,071,462 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [76 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2010/10/26 23:17:08 | 000,000,209 | ---- | C] () -- C:\Boot.bak
    [2010/10/26 23:17:04 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2010/10/26 23:14:55 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/10/26 23:14:55 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/10/26 23:14:55 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/10/26 23:14:55 | 000,079,872 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/10/26 23:14:55 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/10/26 23:06:36 | 003,887,102 | R--- | C] () -- C:\Documents and Settings\Mom\Desktop\ComboFix.exe
    [2010/10/26 19:13:13 | 937,676,800 | -HS- | C] () -- C:\hiberfil.sys
    [2010/10/25 18:17:23 | 000,000,302 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    [2010/10/25 18:17:23 | 000,000,294 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-387748528-3001526100-3984265221-500.job
    [2010/10/24 20:42:14 | 000,000,777 | ---- | C] () -- C:\Documents and Settings\Mom\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
    [2010/10/24 20:42:14 | 000,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
    [2010/10/21 21:03:48 | 000,002,443 | ---- | C] () -- C:\Documents and Settings\Mom\Desktop\HiJackThis.lnk
    [2010/10/21 20:35:32 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Mom\Desktop\regbackup_20101021.reg
    [2010/10/17 20:01:35 | 000,001,808 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    [2010/10/17 20:01:35 | 000,000,798 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
    [2010/10/14 20:45:58 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Kbelologiwa.dat
    [2009/12/03 17:36:45 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Mom\Local Settings\Application Data\prvlcl.dat
    [2008/01/07 18:46:24 | 000,001,359 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
    [2007/06/10 01:41:56 | 000,000,305 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
    [2007/03/22 17:40:00 | 000,000,029 | ---- | C] () -- C:\WINDOWS\TSMLite.INI
    [2006/12/10 19:26:20 | 000,013,824 | ---- | C] () -- C:\Documents and Settings\Mom\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2006/12/03 19:55:47 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
    [2006/12/02 01:29:46 | 000,003,268 | ---- | C] () -- C:\Documents and Settings\Mom\Application Data\wklnhst.dat
    [2006/12/01 22:49:48 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Mom\Local Settings\Application Data\fusioncache.dat
    [2006/06/19 03:55:13 | 000,000,219 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
    [2006/06/19 03:53:19 | 000,000,698 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini
    [2006/06/19 03:37:38 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WININIT.INI
    [2006/06/19 03:18:26 | 000,028,836 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2006/06/19 03:16:00 | 000,001,453 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
    [2005/12/02 05:09:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2005/08/17 12:39:42 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/08/17 12:21:06 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2005/08/17 11:58:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2005/08/06 00:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2001/07/07 04:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

    ========== LOP Check ==========

    [2010/10/18 12:36:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
    [2010/10/21 13:32:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
    [2006/06/19 03:20:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
    [2006/06/19 03:54:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
    [2010/09/02 13:14:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PIXELA
    [2008/02/04 12:07:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom
    [2010/10/21 21:47:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{E961CE1B-C3EA-4882-9F67-F859B555D097}
    [2010/10/03 16:21:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}
    [2009/11/30 23:35:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\eMusic
    [2010/07/14 15:47:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Image Zone Express
    [2007/12/16 17:04:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Leadertech
    [2008/01/22 19:44:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Snapfish
    [2006/12/11 15:10:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Template
    [2008/05/17 08:30:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\TomTom
    [2009/11/29 14:56:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\W Photo Studio Viewer
    [2006/12/29 12:20:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mom\Application Data\Walgreens

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2010/10/25 18:03:04 | 000,000,209 | ---- | M] () -- C:\Boot.bak
    [2010/10/26 23:17:08 | 000,000,325 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/10/27 00:05:12 | 000,014,876 | ---- | M] () -- C:\ComboFix.txt
    [2010/10/27 00:09:40 | 937,676,800 | -HS- | M] () -- C:\hiberfil.sys
    [2010/10/27 00:10:22 | 000,000,297 | ---- | M] () -- C:\hpqp.ini
    [2004/08/10 10:00:00 | 000,047,564 | RHS- | M] () -- C:\ntdetect.com
    [2008/09/15 12:10:40 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2010/10/27 00:09:39 | 1409,286,144 | -HS- | M] () -- C:\pagefile.sys
    [2010/10/27 00:10:22 | 000,000,039 | ---- | M] () -- C:\XP_TV.ini

    < %systemroot%\Fonts\*.com >
    [2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >
    [2005/09/24 02:49:16 | 000,012,288 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\WINDOWS\Fonts\RandFont.dll

    < %systemroot%\Fonts\*.ini >
    [2005/08/17 11:58:14 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2006/04/10 15:02:32 | 000,074,240 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp054.dll
    [2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2005/08/17 04:43:50 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2005/08/17 04:43:50 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2005/08/17 04:43:50 | 000,884,736 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2008/09/15 12:24:53 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2006/12/01 23:02:03 | 000,000,170 | -HS- | M] () -- C:\Documents and Settings\Mom\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2005/08/17 12:05:24 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Mom\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/10/26 23:06:47 | 003,887,102 | R--- | M] () -- C:\Documents and Settings\Mom\Desktop\ComboFix.exe
    [2008/05/25 20:34:17 | 000,098,304 | ---- | M] () -- C:\Documents and Settings\Mom\Desktop\m304-310(2).exe
    [2008/05/25 20:24:16 | 000,098,304 | ---- | M] () -- C:\Documents and Settings\Mom\Desktop\m304-310.exe
    [2008/05/25 20:32:47 | 000,102,400 | ---- | M] () -- C:\Documents and Settings\Mom\Desktop\m304-ALL3(2).exe
    [2008/05/25 20:31:01 | 000,102,400 | ---- | M] () -- C:\Documents and Settings\Mom\Desktop\m304-ALL3.exe
    [2010/10/27 00:30:13 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mom\Desktop\OTL.exe
    [2007/03/08 21:20:08 | 012,711,440 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\Mom\Desktop\RealPlayer10-5GOLD.exe
    [2007/03/21 16:14:51 | 025,755,448 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Mom\Desktop\wmp11-windowsxp-x86-enu.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2006/12/01 22:51:56 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Mom\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/10/27 00:31:50 | 000,032,768 | -HS- | M] () -- C:\Documents and Settings\Mom\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 11:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 11:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/04 11:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 11:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 11:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/04 11:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 11:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Files - Unicode (All) ==========
    [2009/10/10 08:16:47 | 000,000,000 | ---D | M](C:\Documents and Settings\Mom\Favorites\??sorted Bookmarks) -- C:\Documents and Settings\Mom\Favorites\艠“sorted Bookmarks

    < End of report >
    cbolguin, Oct 27, 2010
    #15

  16. cbolguin Newcomer, in training

    I thought I posted the Extras log but it hasn't shown up yet. I'll give it a little longer in case it is still pending approval.

    Yesterday I had cancelled the windows updates but it looks like today they were downloaded automatically while I was away from the computer today. Now it's pending a restart.
    cbolguin, Oct 27, 2010
    #16

  17. Broni Malware Annihilator

    Restart and meanwhile I'll look at your OTL log.
    Broni, Oct 27, 2010
    #17

  18. Broni Malware Annihilator

    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =====================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
[76 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]


:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ============================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
    Broni, Oct 27, 2010
    #18

  19. cbolguin Newcomer, in training

    Here are the logs from OTL and the Security Check. The Online Scanner is about to start and I will post those logs, if there are any, when it's done.

    All processes killed
    ========== OTL ==========
    Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
    C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
    C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
    C:\WINDOWS\System32\SET1B7.tmp deleted successfully.
    C:\WINDOWS\System32\SET1B8.tmp deleted successfully.
    C:\WINDOWS\System32\SET1B9.tmp deleted successfully.
    C:\WINDOWS\System32\SET1C2.tmp deleted successfully.
    C:\WINDOWS\System32\SET1C3.tmp deleted successfully.
    C:\WINDOWS\System32\SET1C4.tmp deleted successfully.
    C:\WINDOWS\System32\SET1CE.tmp deleted successfully.
    C:\WINDOWS\System32\SET1CF.tmp deleted successfully.
    C:\WINDOWS\System32\SET1D4.tmp deleted successfully.
    C:\WINDOWS\System32\SET1D5.tmp deleted successfully.
    C:\WINDOWS\System32\SET1E0.tmp deleted successfully.
    C:\WINDOWS\System32\SET1E1.tmp deleted successfully.
    C:\WINDOWS\System32\SET1E2.tmp deleted successfully.
    C:\WINDOWS\System32\SET1E3.tmp deleted successfully.
    C:\WINDOWS\System32\SET1E8.tmp deleted successfully.
    C:\WINDOWS\System32\SET1F2.tmp deleted successfully.
    C:\WINDOWS\System32\SET211.tmp deleted successfully.
    C:\WINDOWS\System32\SET216.tmp deleted successfully.
    C:\WINDOWS\System32\SET217.tmp deleted successfully.
    C:\WINDOWS\System32\SET218.tmp deleted successfully.
    C:\WINDOWS\System32\SET219.tmp deleted successfully.
    C:\WINDOWS\System32\SET21A.tmp deleted successfully.
    C:\WINDOWS\System32\SET221.tmp deleted successfully.
    C:\WINDOWS\System32\SET22E.tmp deleted successfully.
    C:\WINDOWS\System32\SET232.tmp deleted successfully.
    C:\WINDOWS\System32\SET234.tmp deleted successfully.
    C:\WINDOWS\System32\SET236.tmp deleted successfully.
    C:\WINDOWS\System32\SET23B.tmp deleted successfully.
    C:\WINDOWS\System32\SET244.tmp deleted successfully.
    C:\WINDOWS\System32\SET24B.tmp deleted successfully.
    C:\WINDOWS\System32\SET250B.tmp deleted successfully.
    C:\WINDOWS\System32\SET250C.tmp deleted successfully.
    C:\WINDOWS\System32\SET251.tmp deleted successfully.
    C:\WINDOWS\System32\SET252.tmp deleted successfully.
    C:\WINDOWS\System32\SET2541.tmp deleted successfully.
    C:\WINDOWS\System32\SET254D.tmp deleted successfully.
    C:\WINDOWS\System32\SET25A.tmp deleted successfully.
    C:\WINDOWS\System32\SET25B.tmp deleted successfully.
    C:\WINDOWS\System32\SET261.tmp deleted successfully.
    C:\WINDOWS\System32\SET262.tmp deleted successfully.
    C:\WINDOWS\System32\SET269.tmp deleted successfully.
    C:\WINDOWS\System32\SET26A.tmp deleted successfully.
    C:\WINDOWS\System32\SET27B.tmp deleted successfully.
    C:\WINDOWS\System32\SET27D.tmp deleted successfully.
    C:\WINDOWS\System32\SET284.tmp deleted successfully.
    C:\WINDOWS\System32\SET285.tmp deleted successfully.
    C:\WINDOWS\System32\SET28C.tmp deleted successfully.
    C:\WINDOWS\System32\SET28D.tmp deleted successfully.
    C:\WINDOWS\System32\SET2A2.tmp deleted successfully.
    C:\WINDOWS\System32\SET2A3.tmp deleted successfully.
    C:\WINDOWS\System32\SET2A4.tmp deleted successfully.
    C:\WINDOWS\System32\SET2A5.tmp deleted successfully.
    C:\WINDOWS\System32\SET2A7.tmp deleted successfully.
    C:\WINDOWS\System32\SET2AB.tmp deleted successfully.
    C:\WINDOWS\System32\SET2AD.tmp deleted successfully.
    C:\WINDOWS\System32\SET2AF.tmp deleted successfully.
    C:\WINDOWS\System32\SET2B0.tmp deleted successfully.
    C:\WINDOWS\System32\SET2B2.tmp deleted successfully.
    C:\WINDOWS\System32\SET2B3.tmp deleted successfully.
    C:\WINDOWS\System32\SET2CB.tmp deleted successfully.
    C:\WINDOWS\System32\SET2CC.tmp deleted successfully.
    C:\WINDOWS\System32\SET2CE.tmp deleted successfully.
    C:\WINDOWS\System32\SET2CF.tmp deleted successfully.
    C:\WINDOWS\System32\SET2D1.tmp deleted successfully.
    C:\WINDOWS\System32\SET2D3.tmp deleted successfully.
    C:\WINDOWS\System32\SET2D7.tmp deleted successfully.
    C:\WINDOWS\System32\SET2D9.tmp deleted successfully.
    C:\WINDOWS\System32\SET2DA.tmp deleted successfully.
    C:\WINDOWS\System32\SET2DB.tmp deleted successfully.
    C:\WINDOWS\System32\SET2DC.tmp deleted successfully.
    C:\WINDOWS\System32\SET2FB.tmp deleted successfully.
    C:\WINDOWS\System32\SET2FD.tmp deleted successfully.
    C:\WINDOWS\System32\SET2FF.tmp deleted successfully.
    C:\WINDOWS\System32\SET303.tmp deleted successfully.
    C:\WINDOWS\System32\SET30A.tmp deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->FireFox cache emptied: 15662578 bytes

    User: All Users

    User: Default User

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: Mom
    ->Temp folder emptied: 9326660 bytes
    ->Temporary Internet Files folder emptied: 134665 bytes
    ->Java cache emptied: 2027 bytes
    ->FireFox cache emptied: 45543639 bytes
    ->Google Chrome cache emptied: 37146203 bytes
    ->Flash cache emptied: 1363 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 934022 bytes
    ->Java cache emptied: 24660 bytes
    ->Flash cache emptied: 6705 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 664 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 104.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService

    User: Mom
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.1 log created on 10272010_204348

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...


    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 3
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    AVG Free 9.0
    Antivirus up to date!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 22
    Out of date Java installed!
    Adobe Flash Player 10.1.85.3
    Adobe Reader 8.1.3
    Out of date Adobe Reader installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    AVG avgwdsvc.exe
    AVG avgtray.exe
    AVG avgrsx.exe
    AVG avgnsx.exe
    AVG avgemc.exe
    ````````````````````````````````
    DNS Vulnerability Check:
    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````
    cbolguin, Oct 27, 2010
    #19

  20. Broni Malware Annihilator

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button
    Broni, Oct 27, 2010
    #20
Page 1 of 2
Thread Status:
Not open for further replies.