also @ TechSpot: Codemasters announces £125,000 special edition of GRID 2

LSASS.exe Application Error

Discussion in 'Virus and Malware Removal' started by jayrez, Jun 18, 2011.

  1. jayrez Newcomer, in training Posts: 47

    Ok i think i did it right this time.

    OTL logfile created on: 6/20/2011 2:08:39 AM - Run
    OTLPE by OldTimer - Version 3.1.46.0 Folder = X:\Programs\OTLPE
    Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    510.00 Mb Total Physical Memory | 295.00 Mb Available Physical Memory | 58.00% Memory free
    462.00 Mb Paging File | 336.00 Mb Available in Paging File | 73.00% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 71.46 Gb Total Space | 29.48 Gb Free Space | 41.26% Space Free | Partition Type: NTFS
    Drive D: | 1.87 Gb Total Space | 1.78 Gb Free Space | 95.46% Space Free | Partition Type: FAT
    Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: REATOGO | User Name: SYSTEM
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
    Using ControlSet: ControlSet005

    ========== Win32 Services (SafeList) ==========

    SRV - File not found [On_Demand] -- -- (AppMgmt)
    SRV - [2011/03/18 11:11:02 | 000,947,528 | -H-- | M] () [On_Demand] -- C:\Program Files\AVG\AVG8\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
    SRV - [2009/11/25 18:46:28 | 000,908,056 | -H-- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc)
    SRV - [2009/11/25 18:46:25 | 000,297,752 | -H-- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd)
    SRV - [2008/06/27 19:24:34 | 000,467,028 | ---- | M] (Atheros) [Disabled] -- C:\WINDOWS\system32\acs.exe -- (ACS)
    SRV - [2008/02/27 14:54:52 | 000,360,547 | -H-- | M] (Atheros Communications, Inc.) [On_Demand] -- C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe -- (jswpsapi)
    SRV - [2005/06/21 16:19:38 | 000,491,520 | ---- | M] () [On_Demand] -- C:\WINDOWS\System32\dlcccoms.exe -- (dlcc_device)
    SRV - [2004/03/18 19:55:48 | 000,065,536 | ---- | M] (HP) [On_Demand] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
    DRV - File not found [Kernel | On_Demand] -- -- (wanatw) WAN Miniport (ATW)
    DRV - File not found [Kernel | Boot] -- -- (VolSnap)
    DRV - File not found [Kernel | On_Demand] -- -- (RimUsb)
    DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
    DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
    DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
    DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
    DRV - File not found [Kernel | System] -- -- (PCIDump)
    DRV - File not found [Kernel | Boot] -- -- (nielprt)
    DRV - File not found [Kernel | On_Demand] -- -- (NielGfx)
    DRV - File not found [Kernel | On_Demand] -- -- (MEMSWEEP2)
    DRV - File not found [Kernel | System] -- -- (lbrtfdc)
    DRV - File not found [Kernel | System] -- -- (Changer)
    DRV - File not found [Kernel | On_Demand] -- -- (bvrp_pci)
    DRV - [2011/05/29 12:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
    DRV - [2010/05/26 13:45:04 | 000,018,816 | ---- | M] (Sophos Plc) [Kernel | System] -- C:\WINDOWS\system32\SAVRKBootTasks.sys -- (SAVRKBootTasks)
    DRV - [2009/12/18 14:58:52 | 000,011,336 | -H-- | M] () [Kernel | On_Demand] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
    DRV - [2009/12/07 07:24:56 | 000,401,016 | R--- | M] (Ploytec GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\psabusbu.sys -- (PRESONUS_AUDIOBOX_USB)
    DRV - [2009/12/07 07:24:56 | 000,040,568 | R--- | M] (Ploytec GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\psabusba.sys -- (PRESONUS_AUDIOBOX_WDM)
    DRV - [2009/12/07 07:24:56 | 000,031,864 | R--- | M] (Ploytec GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\psabusbm.sys -- (PRESONUS_AUDIOBOX_MIDI)
    DRV - [2009/11/25 18:47:24 | 000,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
    DRV - [2009/11/25 18:47:23 | 000,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
    DRV - [2009/11/25 18:47:23 | 000,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
    DRV - [2009/03/18 19:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
    DRV - [2008/10/01 19:45:52 | 000,057,440 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\jswscimd.sys -- (JSWSCIMD)
    DRV - [2008/09/30 06:24:36 | 000,453,120 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WN111v2.sys -- (WN111v2)
    DRV - [2007/12/14 07:31:00 | 000,057,408 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wsimd.sys -- (WSIMD)
    DRV - [2004/09/17 16:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
    DRV - [2003/11/17 23:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
    DRV - [2003/11/17 23:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
    DRV - [2003/11/17 23:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
    DRV - [2003/07/24 15:10:34 | 000,017,149 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\DNINDIS5.sys -- (DNINDIS5)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    IE - HKLM\Software\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr7/*http://www.yahoo.com/ext/search/search.html
    IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4


    IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
    IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 36 AE 3A 04 E0 FD D8 46 91 AE 5E 70 C8 31 61 B1 [binary data]
    IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8592

    IE - HKU\Administrator.D9KV7191_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    IE - HKU\Administrator.D9KV7191_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    IE - HKU\Administrator.D9KV7191_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\Guest_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
    IE - HKU\Guest_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\JESSY_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    IE - HKU\JESSY_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
    IE - HKU\JESSY_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.weatherstudio.com/?src_id=352
    IE - HKU\JESSY_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKU\JESSY_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ieaddons.com/en/students
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://m.www.yahoo.com/ [binary data]
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.oovoostart.com/?cfg=2-201-0-33NUP&engine_id=1&provider_id=1&product_id=201&country=US
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 36 AE 3A 04 E0 FD D8 46 91 AE 5E 70 C8 31 61 B1 [binary data]
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
    IE - HKU\Lindsay_Dawedeit_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = socks=127.0.0.1:4021

    IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 36 AE 3A 04 E0 FD D8 46 91 AE 5E 70 C8 31 61 B1 [binary data]

    IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 36 AE 3A 04 E0 FD D8 46 91 AE 5E 70 C8 31 61 B1 [binary data]


    FF - HKLM\software\mozilla\Firefox\extensions\\{6E19037A-12E3-4295-8915-ED48BC341614}: C:\Program Files\OpinionSquare


    Hosts file not found
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
    O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
    O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
    O2 - BHO: (a4c3abe4) - {EAABFF34-C018-1663-DAE5-EADDB0233338} - File not found
    O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
    O3 - HKU\Lindsay_Dawedeit_ON_C\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
    O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
    O4 - HKLM..\Run: [DLCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.DLL ()
    O4 - HKLM..\Run: [dlccmon.exe] C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe (Dell)
    O4 - HKU\Administrator.D9KV7191_ON_C..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
    O4 - HKU\Guest_ON_C..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
    O4 - HKU\Guest_ON_C..\Run: [DellSupport-] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
    O4 - HKU\Lindsay_Dawedeit_ON_C..\Run: [bpbMHutRXor] C:\Documents and Settings\All Users\Application Data\bpbMHutRXor.exe (Sysinternals)
    O4 - HKU\Administrator.D9KV7191_ON_C..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG8\Notification\SPChecker.exe ()
    O4 - HKU\Administrator.D9KV7191_ON_C..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe (Adobe Systems, Inc.)
    O4 - HKU\Guest_ON_C..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG8\Notification\SPChecker.exe ()
    O4 - HKU\JESSY_ON_C..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG8\Notification\SPChecker.exe ()
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\Administrator.D9KV7191_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\Guest_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\JESSY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\Lindsay_Dawedeit_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\Lindsay_Dawedeit_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
    O7 - HKU\Lindsay_Dawedeit_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} http://www.slide.com/uploader/SlideImageUploader.cab (Slide Image Uploader Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab (SysInfo Class)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254 192.168.254.254
    O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
    O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
    O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
    O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  2. jayrez Newcomer, in training Posts: 47

    ========== Files - Modified Within 30 Days ==========

    [2011/06/19 17:58:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011/06/19 15:32:03 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2011/06/19 15:25:04 | 000,000,216 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~26074916
    [2011/06/19 15:25:04 | 000,000,152 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~26074916r
    [2011/06/19 15:25:03 | 000,000,795 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\Desktop\Windows XP Repair.lnk
    [2011/06/19 15:24:47 | 000,000,336 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\26074916
    [2011/06/19 15:24:36 | 000,360,448 | -H-- | M] (Sysinternals) -- C:\Documents and Settings\All Users\Application Data\26074916.exe
    [2011/06/19 15:23:14 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2011/06/19 15:18:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
    [2011/06/19 15:18:21 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    [2011/06/19 15:18:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
    [2011/06/19 15:18:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
    [2011/06/19 15:18:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\OpinionSquare
    [2011/06/19 15:18:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\NETGEAR WN111v2 Adapter
    [2011/06/19 15:18:17 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Mixxx
    [2011/06/19 15:18:17 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
    [2011/06/19 15:18:15 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/06/19 15:18:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\JDownloader
    [2011/06/19 15:18:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
    [2011/06/19 15:18:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\HP
    [2011/06/19 15:18:12 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Games
    [2011/06/19 15:18:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\DragonBall Online
    [2011/06/19 15:18:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Cool Edit Pro 2.1
    [2011/06/19 15:18:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
    [2011/06/19 15:18:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Canon MX860 series
    [2011/06/19 15:18:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\CamStudio
    [2011/06/19 15:18:00 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
    [2011/06/19 15:17:57 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
    [2011/06/19 15:14:08 | 000,444,416 | -H-- | M] (Sysinternals) -- C:\Documents and Settings\All Users\Application Data\bpbMHutRXor.exe
    [2011/06/19 15:04:20 | 077,861,148 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
    [2011/06/19 15:01:32 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/06/19 14:59:51 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2011/06/19 14:59:48 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2863605548-1053128589-1952253785-1006.job
    [2011/06/19 02:24:33 | 000,607,310 | RH-- | M] (Swearware) -- C:\Documents and Settings\Lindsay Dawedeit\Desktop\dds.scr
    [2011/06/19 01:42:22 | 000,000,444 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2011/06/12 00:50:57 | 000,000,097 | ---- | M] () -- C:\WINDOWS\System32\773778630
    [2011/06/11 04:28:18 | 000,004,500 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Gokubasedgod.bmp
    [2011/06/11 01:09:38 | 000,114,636 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\DBO_CT_TW_Setup.exe.torrent
    [2011/06/10 17:52:28 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2011/06/08 20:06:00 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2863605548-1053128589-1952253785-1006.job
    [2011/06/04 04:20:21 | 046,296,620 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\DO DO X2 - instrumental.wav
    [2011/06/04 00:37:31 | 003,455,269 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\JayRez- Far Away .mp3
    [2011/06/03 20:35:45 | 000,242,262 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\my last pic.BMP
    [2011/06/03 20:18:01 | 003,692,948 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2.wav
    [2011/06/03 20:18:01 | 000,057,776 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2.pk
    [2011/06/03 20:17:59 | 003,080,590 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (2).wav
    [2011/06/03 20:17:59 | 000,048,208 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (2).pk
    [2011/06/03 20:17:57 | 002,124,644 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3.wav
    [2011/06/03 20:17:57 | 000,033,272 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3.pk
    [2011/06/03 20:17:56 | 000,028,240 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (2).pk
    [2011/06/03 20:17:55 | 001,802,388 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (2).wav
    [2011/06/03 20:17:54 | 000,032,704 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 4.pk
    [2011/06/03 20:17:53 | 002,088,172 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 4.wav
    [2011/06/03 20:16:54 | 076,151,852 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down.wav
    [2011/06/03 20:16:54 | 000,343,276 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down.pk
    [2011/06/03 20:16:42 | 000,039,760 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (3).pk
    [2011/06/03 20:16:41 | 005,079,364 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (3).wav
    [2011/06/03 20:16:39 | 005,079,364 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (3).wav
    [2011/06/03 20:16:39 | 000,039,760 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (3).pk
    [2011/06/03 20:16:37 | 076,151,852 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (2).wav
    [2011/06/03 20:16:37 | 000,343,276 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (2).pk
    [2011/06/03 20:16:25 | 007,322,348 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (4).wav
    [2011/06/03 20:16:25 | 000,057,280 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (4).pk
    [2011/06/03 20:16:23 | 000,057,280 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (4).pk
    [2011/06/03 20:16:22 | 007,322,348 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (4).wav
    [2011/06/03 20:16:21 | 000,055,184 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (5).pk
    [2011/06/03 20:16:20 | 007,053,876 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (5).wav
    [2011/06/03 20:16:18 | 007,053,876 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (5).wav
    [2011/06/03 20:16:18 | 000,055,184 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (5).pk
    [2011/06/03 20:16:16 | 000,343,276 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (3).pk
    [2011/06/03 20:16:15 | 076,151,852 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (3).wav
    [2011/06/03 20:16:03 | 002,319,788 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (6).wav
    [2011/06/03 20:16:03 | 000,018,200 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (6).pk
    [2011/06/03 20:16:02 | 002,960,148 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (7).wav
    [2011/06/03 20:16:02 | 000,023,200 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (7).pk
    [2011/06/03 20:16:00 | 007,046,008 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (8).wav
    [2011/06/03 20:16:00 | 000,055,120 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (8).pk
    [2011/06/03 20:15:57 | 005,073,336 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (9).wav
    [2011/06/03 20:15:57 | 000,039,712 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (9).pk
    [2011/06/03 20:15:56 | 000,039,712 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (10).pk
    [2011/06/03 20:15:55 | 005,073,336 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (10).wav
    [2011/06/03 20:15:54 | 000,025,008 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (7).pk
    [2011/06/03 20:15:53 | 003,191,444 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (7).wav
    [2011/06/03 20:15:52 | 003,191,444 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (6).wav
    [2011/06/03 20:15:52 | 000,025,008 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (6).pk
    [2011/06/03 20:15:50 | 002,960,148 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (8).wav
    [2011/06/03 20:15:50 | 000,023,200 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (8).pk
    [2011/06/03 20:15:48 | 007,046,008 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (9).wav
    [2011/06/03 20:15:48 | 000,055,120 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (9).pk
    [2011/06/03 20:15:35 | 076,151,852 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (4).wav
    [2011/06/03 20:15:35 | 000,343,276 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (4).pk
    [2011/06/03 20:15:21 | 000,031,848 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (10).pk
    [2011/06/03 20:15:20 | 004,067,328 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (10).wav
    [2011/06/03 20:15:19 | 004,067,328 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (11).wav
    [2011/06/03 20:15:19 | 000,031,848 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (11).pk
    [2011/06/03 20:15:17 | 076,151,852 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (5).wav
    [2011/06/03 20:15:17 | 000,343,276 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (5).pk
    [2011/06/03 20:15:02 | 003,652,492 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (11).wav
    [2011/06/03 20:15:02 | 000,028,608 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (11).pk
    [2011/06/03 20:15:00 | 003,652,492 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (12).wav
    [2011/06/03 20:15:00 | 000,028,608 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (12).pk
    [2011/06/03 14:31:10 | 006,907,218 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Tyga Ft. Chris Richardson - Far Away (Instrumental with Hook).mp3
    [2011/06/01 19:11:52 | 002,640,631 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mac Miller-Donald Trump.mp3
    [2011/05/29 12:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2011/05/25 21:41:03 | 000,070,304 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\phpjVTrPqPM.jpg
    [2011/05/25 21:19:42 | 000,044,594 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\phpRG6OfsPM.jpg
    [2011/05/25 20:47:22 | 050,593,864 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\JayRez- My Last (cover).wav
    [2011/05/25 00:18:41 | 000,990,563 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mixdown (2).mp3
    [2011/05/25 00:09:15 | 000,328,934 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (2).mp3
    [2011/05/25 00:09:12 | 000,483,579 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3.mp3
    [2011/05/25 00:09:04 | 000,000,836 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mixdown.mp3
    [2011/05/25 00:08:51 | 000,506,567 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (2).mp3
    [2011/05/24 23:35:12 | 004,180,459 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\My Last (Good D.I.Y Acapella) - Big Sean ft. Chris Brown.mp3
    [2011/05/21 19:35:10 | 008,059,088 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\My Last (Hook).mp3
    [9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\Documents and Settings\Lindsay Dawedeit\Desktop\*.tmp files -> C:\Documents and Settings\Lindsay Dawedeit\Desktop\*.tmp -> ]
    [1 C:\Documents and Settings\Lindsay Dawedeit\*.tmp files -> C:\Documents and Settings\Lindsay Dawedeit\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/06/19 15:25:03 | 000,000,795 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\Desktop\Windows XP Repair.lnk
    [2011/06/19 15:25:03 | 000,000,216 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~26074916
    [2011/06/19 15:25:03 | 000,000,152 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~26074916r
    [2011/06/19 15:24:46 | 000,000,336 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\26074916
    [2011/06/19 01:42:22 | 000,000,444 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2011/06/12 00:49:52 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\773778630
    [2011/06/11 04:26:09 | 000,004,500 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Gokubasedgod.bmp
    [2011/06/11 01:09:32 | 000,114,636 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\DBO_CT_TW_Setup.exe.torrent
    [2011/06/04 04:20:13 | 046,296,620 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\DO DO X2 - instrumental.wav
    [2011/06/03 20:29:13 | 000,242,262 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\my last pic.BMP
    [2011/06/03 20:18:01 | 000,057,776 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2.pk
    [2011/06/03 20:18:00 | 003,692,948 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2.wav
    [2011/06/03 20:17:59 | 000,048,208 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (2).pk
    [2011/06/03 20:17:58 | 003,080,590 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (2).wav
    [2011/06/03 20:17:57 | 000,033,272 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3.pk
    [2011/06/03 20:17:56 | 002,124,644 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3.wav
    [2011/06/03 20:17:55 | 001,802,388 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (2).wav
    [2011/06/03 20:17:55 | 000,028,240 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (2).pk
    [2011/06/03 20:17:54 | 000,032,704 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 4.pk
    [2011/06/03 20:17:53 | 002,088,172 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 4.wav
    [2011/06/03 20:16:54 | 000,343,276 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down.pk
    [2011/06/03 20:16:42 | 076,151,852 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down.wav
    [2011/06/03 20:16:41 | 000,039,760 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (3).pk
    [2011/06/03 20:16:40 | 005,079,364 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (3).wav
    [2011/06/03 20:16:39 | 000,039,760 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (3).pk
    [2011/06/03 20:16:38 | 005,079,364 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (3).wav
    [2011/06/03 20:16:37 | 000,343,276 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (2).pk
    [2011/06/03 20:16:25 | 076,151,852 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (2).wav
    [2011/06/03 20:16:25 | 000,057,280 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (4).pk
    [2011/06/03 20:16:23 | 007,322,348 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (4).wav
    [2011/06/03 20:16:23 | 000,057,280 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (4).pk
    [2011/06/03 20:16:21 | 007,322,348 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (4).wav
    [2011/06/03 20:16:20 | 000,055,184 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (5).pk
    [2011/06/03 20:16:19 | 007,053,876 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (5).wav
    [2011/06/03 20:16:18 | 000,055,184 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (5).pk
    [2011/06/03 20:16:17 | 007,053,876 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (5).wav
    [2011/06/03 20:16:16 | 000,343,276 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (3).pk
    [2011/06/03 20:16:04 | 076,151,852 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (3).wav
    [2011/06/03 20:16:03 | 000,018,200 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (6).pk
    [2011/06/03 20:16:02 | 002,319,788 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (6).wav
    [2011/06/03 20:16:02 | 000,023,200 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (7).pk
    [2011/06/03 20:16:01 | 002,960,148 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (7).wav
    [2011/06/03 20:16:00 | 000,055,120 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (8).pk
    [2011/06/03 20:15:58 | 007,046,008 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (8).wav
    [2011/06/03 20:15:57 | 000,039,712 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (9).pk
    [2011/06/03 20:15:56 | 005,073,336 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (9).wav
    [2011/06/03 20:15:55 | 000,039,712 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (10).pk
    [2011/06/03 20:15:54 | 005,073,336 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (10).wav
    [2011/06/03 20:15:54 | 000,025,008 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (7).pk
    [2011/06/03 20:15:53 | 003,191,444 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (7).wav
    [2011/06/03 20:15:52 | 000,025,008 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (6).pk
    [2011/06/03 20:15:51 | 003,191,444 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (6).wav
    [2011/06/03 20:15:50 | 000,023,200 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (8).pk
    [2011/06/03 20:15:49 | 002,960,148 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (8).wav
    [2011/06/03 20:15:48 | 000,055,120 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (9).pk
    [2011/06/03 20:15:44 | 007,046,008 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (9).wav
    [2011/06/03 20:15:35 | 000,343,276 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (4).pk
    [2011/06/03 20:15:21 | 076,151,852 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (4).wav
    [2011/06/03 20:15:20 | 004,067,328 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (10).wav
    [2011/06/03 20:15:20 | 000,031,848 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (10).pk
    [2011/06/03 20:15:19 | 000,031,848 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (11).pk
    [2011/06/03 20:15:18 | 004,067,328 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (11).wav
    [2011/06/03 20:15:17 | 000,343,276 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (5).pk
    [2011/06/03 20:15:03 | 076,151,852 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mix Down (5).wav
    [2011/06/03 20:15:02 | 000,028,608 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (11).pk
    [2011/06/03 20:15:01 | 003,652,492 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (11).wav
    [2011/06/03 20:15:00 | 000,028,608 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (12).pk
    [2011/06/03 20:14:58 | 003,652,492 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (12).wav
    [2011/06/03 20:14:28 | 003,455,269 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\JayRez- Far Away .mp3
    [2011/06/03 14:31:10 | 006,907,218 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Tyga Ft. Chris Richardson - Far Away (Instrumental with Hook).mp3
    [2011/06/01 19:11:52 | 002,640,631 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mac Miller-Donald Trump.mp3
    [2011/05/25 21:29:28 | 000,070,304 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\phpjVTrPqPM.jpg
    [2011/05/25 21:06:33 | 000,044,594 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\phpRG6OfsPM.jpg
    [2011/05/25 20:40:22 | 050,593,864 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\JayRez- My Last (cover).wav
    [2011/05/25 02:26:49 | 000,001,204 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\Desktop\hosts
    [2011/05/25 00:18:34 | 000,990,563 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mixdown (2).mp3
    [2011/05/25 00:09:13 | 000,328,934 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 2 (2).mp3
    [2011/05/25 00:09:10 | 000,483,579 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3.mp3
    [2011/05/25 00:09:03 | 000,000,836 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Mixdown.mp3
    [2011/05/25 00:08:47 | 000,506,567 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Track 3 (2).mp3
    [2011/05/24 23:35:12 | 004,180,459 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\My Last (Good D.I.Y Acapella) - Big Sean ft. Chris Brown.mp3
    [2011/05/24 20:17:50 | 006,703,756 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Setup.exe
    [2011/05/24 20:17:50 | 000,015,609 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\H2O.nfo
    [2011/05/24 20:17:50 | 000,002,255 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\Heaven.nfo
    [2011/05/24 20:17:50 | 000,000,575 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\file_id.diz
    [2011/05/21 19:35:10 | 008,059,088 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\My Documents\My Last (Hook).mp3
    [2011/05/04 22:49:05 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
    [2011/03/09 19:02:48 | 000,002,496 | ---- | C] () -- C:\WINDOWS\System32\AVRedirector.ini
    [2011/03/09 19:02:48 | 000,001,248 | ---- | C] () -- C:\WINDOWS\System32\AVRedirectorOff.ini
    [2011/03/01 01:09:50 | 000,638,976 | ---- | C] () -- C:\WINDOWS\System32\dlccpmui.dll
    [2011/03/01 01:09:50 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlccinsr.dll
    [2011/03/01 01:09:49 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\dlccins.dll
    [2011/03/01 01:09:48 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\dlccih.exe
    [2011/03/01 01:09:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlccvs.dll
    [2011/03/01 01:09:47 | 000,368,640 | ---- | C] () -- C:\WINDOWS\System32\dlcccfg.exe
    [2011/03/01 01:09:47 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\dlccpplc.dll
    [2011/03/01 01:09:46 | 000,483,328 | ---- | C] () -- C:\WINDOWS\System32\dlcclmpm.dll
    [2011/03/01 01:09:46 | 000,413,696 | ---- | C] () -- C:\WINDOWS\System32\dlcccomm.dll
    [2011/03/01 01:09:45 | 001,134,592 | ---- | C] () -- C:\WINDOWS\System32\dlccusb1.dll
    [2011/03/01 01:09:44 | 000,770,048 | ---- | C] () -- C:\WINDOWS\System32\dlcchbn3.dll
    [2011/03/01 01:09:43 | 000,491,520 | ---- | C] () -- C:\WINDOWS\System32\dlcccoms.exe
    [2011/03/01 01:09:42 | 000,704,512 | ---- | C] () -- C:\WINDOWS\System32\dlcccomc.dll
    [2011/03/01 01:09:42 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\dlccprox.dll
    [2011/03/01 01:09:41 | 001,183,744 | ---- | C] () -- C:\WINDOWS\System32\dlccserv.dll
    [2011/03/01 01:09:39 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcccu.dll
    [2011/03/01 01:09:39 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcccur.dll
    [2011/03/01 01:09:38 | 000,430,080 | ---- | C] () -- C:\WINDOWS\System32\dlccutil.dll
    [2011/03/01 01:09:33 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\dlccinsb.dll
    [2011/03/01 01:09:33 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcccub.dll
    [2011/03/01 01:09:29 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\dlccjswr.dll
    [2011/03/01 01:09:23 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\dlcccfg.dll
    [2011/01/21 20:32:52 | 000,011,230 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\all
    [2011/01/05 22:31:47 | 000,000,117 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\jagex_runescape_preferences2.dat
    [2011/01/05 22:28:26 | 000,000,034 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\jagex_runescape_preferences.dat
    [2009/12/29 23:01:40 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\pool.bin
    [2009/11/25 15:20:56 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
    [2008/06/27 19:18:04 | 000,262,216 | ---- | C] () -- C:\WINDOWS\System32\IPTests.dll
    [2007/06/26 01:03:50 | 000,005,632 | -H-- | C] () -- C:\Documents and Settings\Guest\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2007/04/16 03:13:23 | 000,000,128 | -H-- | C] () -- C:\Documents and Settings\Guest\Local Settings\Application Data\fusioncache.dat
    [2007/04/03 23:56:04 | 000,000,023 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\presets.ini
    [2007/01/14 19:54:46 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2007/01/05 21:09:50 | 000,002,301 | ---- | C] () -- C:\WINDOWS\mozver.dat
    [2006/12/07 00:01:09 | 000,033,280 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2006/11/01 01:06:23 | 000,104,279 | ---- | C] () -- C:\WINDOWS\hpoins04.dat.temp
    [2006/11/01 01:06:23 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat.temp
    [2006/10/25 17:10:41 | 000,000,128 | -H-- | C] () -- C:\Documents and Settings\JESSY\Local Settings\Application Data\fusioncache.dat
    [2006/10/25 11:32:54 | 000,104,279 | ---- | C] () -- C:\WINDOWS\hpoins04.dat
    [2006/10/25 11:32:54 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat
    [2006/10/05 21:16:33 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
    [2006/10/05 20:05:35 | 000,061,678 | -H-- | C] () -- C:\Documents and Settings\JESSY\Application Data\PFP120JPR.{PB
    [2006/10/05 20:05:35 | 000,012,358 | -H-- | C] () -- C:\Documents and Settings\JESSY\Application Data\PFP120JCM.{PB
    [2006/05/24 02:01:14 | 000,000,436 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\IPH.BAK
    [2006/05/23 19:08:15 | 000,000,028 | ---- | C] () -- C:\WINDOWS\atid.ini
    [2006/02/25 19:15:23 | 000,000,297 | ---- | C] () -- C:\WINDOWS\EReg072.dat
    [2006/01/21 19:56:10 | 000,002,620 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
    [2006/01/18 21:21:48 | 000,000,139 | -H-- | C] () -- C:\Documents and Settings\Lindsay Dawedeit\Local Settings\Application Data\fusioncache.dat
    [2006/01/09 23:29:01 | 000,000,130 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2006/01/09 23:12:29 | 000,481,280 | ---- | C] () -- C:\WINDOWS\System32\aswBoot.exe
    [2005/12/25 22:09:12 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2005/12/19 00:15:58 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/12/19 00:11:01 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
    [2005/12/19 00:05:43 | 000,000,460 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2005/12/19 00:04:15 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
    [2005/12/18 23:43:26 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
    [2005/12/18 23:43:10 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2005/12/18 23:43:08 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2004/08/10 15:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/08/10 15:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2004/08/10 15:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2004/08/10 15:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2004/08/10 14:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/08/10 14:57:15 | 000,278,152 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2004/08/10 14:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
    [2004/08/10 14:51:20 | 000,467,868 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
    [2004/08/10 14:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
    [2004/08/10 14:51:20 | 000,080,238 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
    [2004/08/10 14:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
    [2004/08/10 14:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
    [2004/08/10 14:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
    [2004/08/10 14:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
    [2004/08/10 14:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
    [2004/08/10 14:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
    [2004/08/10 14:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
    [2004/08/10 14:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
    [2004/04/18 19:43:46 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
    [2004/04/18 19:43:44 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll

    ========== LOP Check ==========

    [2006/10/08 19:38:43 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\JESSY\Application Data\EA
    [2006/09/29 03:09:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\JESSY\Application Data\FilmLoop
    [2006/10/05 20:42:15 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\JESSY\Application Data\Smilebox
    [2011/06/13 03:17:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Lindsay Dawedeit\Application Data\uTorrent

    ========== Purity Check ==========



    ========== Custom Scans ==========



    < MD5 for: VOLSNAP.SYS >
    [2008/04/13 14:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
    [2004/08/04 07:00:00 | 000,052,352 | -H-- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B -- C:\i386\volsnap.sys
    [2004/08/04 07:00:00 | 000,052,352 | -H-- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B -- C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys
    < End of report >
  3. Broni Malware Annihilator Posts: 39,388   +177

    Very good :)

    Do this on the computer you are posting from:
    Copy the text in the codebox below:


    Code:
    :OTL
    O2 - BHO: (a4c3abe4) - {EAABFF34-C018-1663-DAE5-EADDB0233338} - File not found
    O4 - HKU\Lindsay_Dawedeit_ON_C..\Run: [bpbMHutRXor] C:\Documents and Settings\All Users\Application Data\bpbMHutRXor.exe (Sysinternals)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    O7 - HKU\Lindsay_Dawedeit_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
    O7 - HKU\Lindsay_Dawedeit_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    [2011/06/19 15:25:04 | 000,000,216 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~26074916
    [2011/06/19 15:25:04 | 000,000,152 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~26074916r
    [2011/06/19 15:25:03 | 000,000,795 | -H-- | M] () -- C:\Documents and Settings\Lindsay Dawedeit\Desktop\Windows XP Repair.lnk
    [2011/06/19 15:24:47 | 000,000,336 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\26074916
    [2011/06/19 15:24:36 | 000,360,448 | -H-- | M] (Sysinternals) -- C:\Documents and Settings\All Users\Application Data\26074916.exe
    [2011/06/19 15:14:08 | 000,444,416 | -H-- | M] (Sysinternals) -- C:\Documents and Settings\All Users\Application Data\bpbMHutRXor.exe
    
    
    :Services
    
    :Reg
    
    :Files
    C:\Windows\system32\DRIVERS\volsnap.sys|C:\WINDOWS\ServicePackFiles\i386\volsnap.sys /replace
    
    :Commands
    [purity]
    
    Open Notepad and paste it.
    Save the document as Fix.txt on to a USB flash drive


    On the infected computer the following...

    Run OTLPE

    • Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
      • (The content of Fix.txt should appear in the box)
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post the log produced (you'll need to transfer it with USB stick)
    • Attempt to reboot normally into Windows.
  4. jayrez Newcomer, in training Posts: 47

    Ok I ran the fix and booted with no problem, thanks. However the only thing on my desktop now is Internet Explorer and Recycle Bin. And when I go to the start menu it shows no programs.
    However I have AVG and Skype running on startup.
    What is also weird is it seems that everything on my USB was erased too... so I do not have the log I saved.
    Also my screen resolution is still low but I suppose thats a whole different problem.
  5. Broni Malware Annihilator Posts: 39,388   +177

    The most important things is....you're able to boot.
    Now we'll try to fix all other issues.

    Let's see, if we can recover your missing features.
    Download and run UnHide
    Let me know, if it worked.
  6. jayrez Newcomer, in training Posts: 47

    True and that worked that problem out. my start button list is still a bit off but everything else is back where its supposed to be. Thanks
     
  7. Broni Malware Annihilator Posts: 39,388   +177

    Good job :)

    We just started though :)

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.
  8. jayrez Newcomer, in training Posts: 47

    Sorry I was not able to get on yesterday. Here are the Logs.

    -----MALWARE BYTES LOG----
    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 6893

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    6/21/2011 3:26:15 AM
    mbam-log-2011-06-21 (03-26-15).txt

    Scan type: Quick scan
    Objects scanned: 234886
    Time elapsed: 34 minute(s), 27 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  9. jayrez Newcomer, in training Posts: 47

    -----GMER LOG----

    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit scan 2011-06-22 23:09:46
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD800BB-75JHC0 rev.06.01C06
    Running: mgtk0wc4.exe; Driver: C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\uwlyapob.sys


    ---- Kernel code sections - GMER 1.0.15 ----

    init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF7AEAF80]

    ---- User code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\System32\svchost.exe[856] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00CB000A
    .text C:\WINDOWS\System32\svchost.exe[856] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00CC000A
    .text C:\WINDOWS\System32\svchost.exe[856] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00CA000C
    .text C:\WINDOWS\System32\svchost.exe[856] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00D8000A
    .text C:\WINDOWS\Explorer.EXE[1208] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BD000A
    .text C:\WINDOWS\Explorer.EXE[1208] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00BE000A
    .text C:\WINDOWS\Explorer.EXE[1208] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B7000C

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8375F39B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8375F39B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 8375F39B

    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \FileSystem\Fastfat \Fat EB907D20

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD800BB-75JHC0______________________06.01C06#5&2a84b1a5&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x7A 0x45 0x05 0xFD ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xE9 0x02 0x6C 0xFA ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x37 0xA4 0xAA 0xC3 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...

    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
    Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

    ---- EOF - GMER 1.0.15 ----
  10. jayrez Newcomer, in training Posts: 47

    ----DDS LOG 1----

    .
    DDS (Ver_2011-06-12.02) - NTFSx86
    Internet Explorer: 8.0.6001.18702
    Run by Lindsay Dawedeit at 23:14:14 on 2011-06-22
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.234 [GMT -7:00]
    .
    AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\DLCCserv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\dlcccoms.exe
    C:\Documents and Settings\Lindsay Dawedeit\Desktop\mgtk0wc4.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.oovoostart.com/?cfg=2-201-0-33NUP&engine_id=1&provider_id=1&product_id=201&country=US
    uDefault_Page_URL = hxxp://ieaddons.com/en/students
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mDefault_Page_URL = hxxp://www.yahoo.com
    mStart Page = hxxp://www.yahoo.com
    uInternet Settings,ProxyServer = socks=127.0.0.1:4021
    uInternet Settings,ProxyOverride = local
    mSearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
    mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [dlccmon.exe] "c:\program files\dell photo aio printer 924\dlccmon.exe"
    mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,_RunDLLEntry@16
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
    DPF: {55027008-315F-4F45-BBC3-8BE119764741} - hxxp://www.slide.com/uploader/SlideImageUploader.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Filter: text/html - {fddeb10c-be9a-4c4f-ab1b-df353fd36a67} -
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: avgrsstarter - avgrsstx.dll
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-25 335240]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-7-30 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-25 108552]
    R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2011-3-28 18816]
    R2 DLCCCustomerConnect;DLCCCustomerConnect;c:\windows\system32\spool\drivers\w32x86\3\dlccserv.exe [2011-2-28 57344]
    R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2008-10-1 57440]
    S0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys --> c:\windows\system32\drivers\nielprt.sys [?]
    S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-11-25 908056]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-13 135664]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg8\toolbar\ToolbarBroker.exe [2011-1-6 947528]
    S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
    S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2003-7-24 17149]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-13 135664]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\netgear\wn111v2\jswpsapi.exe [2008-2-27 360547]
    S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-18 39984]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\5.tmp --> c:\windows\system32\5.tmp [?]
    S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys --> c:\windows\system32\drivers\nielgfx.sys [?]
    S3 PRESONUS_AUDIOBOX_MIDI;Presonus AudioBox WDM MIDI Device;c:\windows\system32\drivers\psabusbm.sys [2011-3-21 31864]
    S3 PRESONUS_AUDIOBOX_USB;Presonus AudioBox USB driver;c:\windows\system32\drivers\psabusbu.sys [2011-3-21 401016]
    S3 PRESONUS_AUDIOBOX_WDM;Presonus AudioBox USB WDM;c:\windows\system32\drivers\psabusba.sys [2011-3-21 40568]
    S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2.sys [2008-9-30 453120]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-11-25 297752]
    .
    =============== Created Last 30 ================
    .
    2011-06-21 05:20:01 52352 ----a-w- c:\windows\system32\drivers\volsnap.sys
    2011-06-19 06:08:10 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-06-19 05:55:42 -------- d-----w- c:\documents and settings\lindsay dawedeit\application data\Malwarebytes
    2011-06-19 05:55:42 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
    2011-06-19 05:48:32 -------- d-----w- c:\documents and settings\lindsay dawedeit\local settings\application data\Deployment
    2011-06-19 05:42:14 -------- d-----w- c:\program files\SystemRequirementsLab
    2011-06-19 05:38:11 -------- d-----w- c:\documents and settings\all users\application data\Atheros
    2011-06-19 05:26:06 135168 ----a-w- c:\windows\system32\igfxres.dll
    2011-06-18 22:03:13 -------- d-----w- C:\_OTL
    2011-06-12 18:48:51 0 ----a-w- c:\documents and settings\lindsay dawedeit\dkjujdsdwh.tmp
    2011-06-11 09:10:02 -------- d-----w- c:\program files\DBO_CT_TW
    2011-06-11 05:09:54 -------- d-----w- c:\documents and settings\lindsay dawedeit\application data\uTorrent
    2011-06-10 22:11:09 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-06-10 22:11:09 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-05-26 18:47:49 -------- d-sh--w- C:\found.000
    2011-05-25 21:05:07 -------- d-----w- c:\windows\ie8
    2011-05-25 06:27:03 -------- d-----w- c:\program files\Adobe Download Assistant
    .
    ==================== Find3M ====================
    .
    2006-10-06 00:36:18 774144 ----a-w- c:\program files\RngInterstitial.dll
    .
    =================== ROOTKIT ====================
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: WDC_WD800BB-75JHC0 rev.06.01C06 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3
    .
    device: opened successfully
    user: MBR read successfully
    .
    Disk trace:
    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8375F555]<<
    _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x837657b0]; MOV EAX, [0x8376582c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
    1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x83792AB8]
    3 CLASSPNP[0xF88C7FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x836FFBC8]
    \Driver\atapi[0x837CB320] -> IRP_MJ_CREATE -> 0x8375F555
    kernel: MBR read successfully
    _asm { MOV AX, 0x0; MOV SS, AX; MOV SP, 0x7c00; MOV DS, AX; CLD ; MOV CX, 0x80; MOV SI, SP; MOV DI, 0x600; MOV ES, AX; REP MOVSD ; JMP FAR 0x0:0x62d; }
    detected disk devices:
    \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD800BB-75JHC0______________________06.01C06#5&2a84b1a5&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
    detected hooks:
    \Driver\atapi DriverStartIo -> 0x8375F39B
    user & kernel MBR OK
    Warning: possible TDL3 rootkit infection !
    .
    ============= FINISH: 23:15:42.68 ===============
  11. jayrez Newcomer, in training Posts: 47

    ---DDS LOG 2---

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-12.02)
    .
    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 12/25/2005 7:04:28 PM
    System Uptime: 6/22/2011 10:26:36 PM (1 hours ago)
    .
    Motherboard: Dell Computer Corp. | | 0CF458
    Processor: Intel(R) Celeron(R) CPU 2.66GHz | Microprocessor | 2660/533mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 71 GiB total, 29.909 GiB free.
    D: is CDROM (CDFS)
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Intel(R) PRO/100 VE Network Connection
    Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_01D51028&REV_02\4&1C660DD6&0&40F0
    Manufacturer: Intel
    Name: Intel(R) PRO/100 VE Network Connection
    PNP Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_01D51028&REV_02\4&1C660DD6&0&40F0
    Service: E100B
    .
    Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
    Description: Canon MX860 ser Network
    Device ID: ROOT\CANON_IJ_NETWORK\0000
    Manufacturer: Canon
    Name: Canon MX860 ser Network
    PNP Device ID: ROOT\CANON_IJ_NETWORK\0000
    Service: StillCam
    .
    ==== System Restore Points ===================
    .
    RP147: 3/24/2011 8:13:13 PM - System Checkpoint
    RP148: 3/26/2011 12:59:03 PM - System Checkpoint
    RP149: 3/27/2011 7:39:44 PM - System Checkpoint
    RP150: 3/28/2011 8:14:55 PM - System Checkpoint
    RP151: 3/29/2011 5:14:24 PM - Restore Operation
    RP152: 3/30/2011 5:35:45 PM - System Checkpoint
    RP153: 3/31/2011 9:37:12 PM - System Checkpoint
    RP154: 4/2/2011 11:09:31 PM - System Checkpoint
    RP155: 4/3/2011 11:18:58 PM - System Checkpoint
    RP156: 4/5/2011 2:01:35 PM - System Checkpoint
    RP157: 4/7/2011 6:55:07 AM - System Checkpoint
    RP158: 4/8/2011 1:32:40 PM - System Checkpoint
    RP159: 4/9/2011 3:38:42 PM - System Checkpoint
    RP160: 4/11/2011 7:02:47 AM - System Checkpoint
    RP161: 4/12/2011 7:59:09 AM - System Checkpoint
    RP162: 4/13/2011 1:22:16 PM - System Checkpoint
    RP163: 4/14/2011 8:14:15 PM - System Checkpoint
    RP164: 4/15/2011 8:40:54 PM - Restore Operation
    RP165: 4/17/2011 11:32:21 AM - System Checkpoint
    RP166: 4/17/2011 6:46:05 PM - Restore Operation
    RP167: 4/18/2011 2:48:59 PM - Restore Operation
    RP168: 4/19/2011 10:58:50 PM - System Checkpoint
    RP169: 4/21/2011 12:19:24 AM - System Checkpoint
    RP170: 4/23/2011 11:49:15 PM - System Checkpoint
    RP171: 4/25/2011 12:21:58 AM - System Checkpoint
    RP172: 4/26/2011 6:52:36 AM - System Checkpoint
    RP173: 4/28/2011 6:35:25 AM - System Checkpoint
    RP174: 4/28/2011 4:39:30 PM - Restore Operation
    RP175: 4/29/2011 7:33:30 PM - System Checkpoint
    RP176: 5/1/2011 4:53:54 AM - System Checkpoint
    RP177: 5/3/2011 8:44:10 AM - System Checkpoint
    RP178: 5/4/2011 4:04:15 PM - System Checkpoint
    RP179: 5/6/2011 6:31:49 AM - System Checkpoint
    RP180: 5/7/2011 1:30:18 AM - Installed Windows Internet Explorer 8.
    RP181: 5/8/2011 1:41:31 AM - System Checkpoint
    RP182: 5/9/2011 2:39:04 AM - System Checkpoint
    RP183: 5/10/2011 5:25:22 PM - System Checkpoint
    RP184: 5/11/2011 3:26:56 PM - Avg8 Update
    RP185: 5/12/2011 6:40:36 PM - System Checkpoint
    RP186: 5/14/2011 12:50:35 AM - System Checkpoint
    RP187: 5/15/2011 2:20:54 PM - System Checkpoint
    RP188: 5/15/2011 4:29:06 PM - Restore Operation
    RP189: 5/17/2011 1:17:23 PM - Restore Operation
    RP190: 5/21/2011 11:23:17 AM - System Checkpoint
    RP191: 5/21/2011 2:41:42 PM - Restore Operation
    RP192: 5/21/2011 3:02:18 PM - Avg8 Update
    RP193: 5/21/2011 4:03:50 PM - Removed ooVoo
    RP194: 5/25/2011 2:02:46 PM - Restore Operation
    RP195: 5/25/2011 2:10:34 PM - Restore Operation
    RP196: 5/26/2011 6:45:47 PM - System Checkpoint
    RP197: 5/26/2011 9:26:22 PM - Restore Operation
    RP198: 5/27/2011 11:19:02 AM - Restore Operation
    RP199: 5/28/2011 3:56:33 PM - System Checkpoint
    RP200: 5/28/2011 5:28:51 PM - Restore Operation
    RP201: 5/30/2011 5:51:17 AM - System Checkpoint
    RP202: 5/31/2011 6:36:57 AM - System Checkpoint
    RP203: 6/1/2011 7:25:00 AM - System Checkpoint
    RP204: 6/2/2011 8:47:11 AM - System Checkpoint
    RP205: 6/3/2011 8:51:52 PM - Restore Operation
    RP206: 6/3/2011 10:34:59 PM - Restore Operation
    RP207: 6/5/2011 2:15:23 AM - System Checkpoint
    RP208: 6/6/2011 2:20:58 AM - System Checkpoint
    RP209: 6/7/2011 2:55:39 AM - System Checkpoint
    RP210: 6/8/2011 3:55:37 AM - System Checkpoint
    RP211: 6/8/2011 3:10:14 PM - Restore Operation
    RP212: 6/10/2011 12:51:35 AM - System Checkpoint
    RP213: 6/10/2011 3:10:34 PM - Restore Operation
    RP214: 6/10/2011 7:54:08 PM - Removed ooVoo
    RP215: 6/11/2011 2:09:25 AM - ??? DBO_CT_TW
    RP216: 6/12/2011 3:00:06 AM - System Checkpoint
    RP217: 6/18/2011 11:02:07 PM - Removed Jasc Paint Shop Photo Album 5
    RP218: 6/18/2011 11:04:44 PM - Removed Jasc Paint Shop Pro Studio, Dell Editon
    RP219: 6/21/2011 1:58:37 AM - System Checkpoint
    RP220: 6/22/2011 4:41:45 AM - System Checkpoint
    .
    ==== Installed Programs ======================
    .
    µTorrent
    DBO_CT_TW
    Dell Driver Download Manager
    Intel(R) Extreme Graphics 2 Driver
    Malwarebytes' Anti-Malware version 1.51.0.1200
    System Requirements Lab for Intel
    .
    ==== Event Viewer Messages From Past Week ========
    .
    6/21/2011 8:06:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
    6/21/2011 8:06:27 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    6/21/2011 5:29:26 AM, error: Service Control Manager [7001] - The AVG Free8 E-mail Scanner service depends on the AVG Free8 WatchDog service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    6/21/2011 5:01:29 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls.mui. Reference error message: Insufficient system resources exist to complete the requested service. .
    6/21/2011 5:01:29 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls. Reference error message: Insufficient system resources exist to complete the requested service. .
    6/21/2011 5:01:29 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\shell32.dll. Reference error message: The operation completed successfully. .
    6/21/2011 4:55:09 AM, error: Application Popup [877] - There was error [DATABASE OPEN FAILED] processing the driver database.
    6/21/2011 4:40:42 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
    6/21/2011 3:39:02 AM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
    6/21/2011 3:37:27 AM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the AVG Free8 WatchDog service, but this action failed with the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    6/21/2011 3:37:27 AM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    6/21/2011 3:29:11 AM, error: Service Control Manager [7001] - The Fax service depends on the Print Spooler service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    6/21/2011 3:29:05 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
    6/21/2011 2:04:12 AM, error: Dhcp [1002] - The IP address lease 192.168.254.3 for the Network Card with network address 00223F91B3F3 has been denied by the DHCP server 192.168.254.254 (The DHCP Server sent a DHCPNACK message).
    6/19/2011 12:01:14 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the dlcc_device service to connect.
    6/19/2011 12:01:14 PM, error: Service Control Manager [7000] - The dlcc_device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    6/19/2011 12:01:13 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service dlcc_device with arguments "" in order to run the server: {323CE21C-A448-40AA-BA74-7FCF1E441069}
    6/19/2011 12:00:18 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde
    6/18/2011 8:50:02 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    6/18/2011 11:05:50 PM, error: Dhcp [1002] - The IP address lease 192.168.254.1 for the Network Card with network address 00223F91B3F3 has been denied by the DHCP server 192.168.254.254 (The DHCP Server sent a DHCPNACK message).
    6/18/2011 10:45:10 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
    .
    ==== End Of File ===========================
  12. Broni Malware Annihilator Posts: 39,388   +177

    Can you explain with more details?

    We have a rootkit there...

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
  13. jayrez Newcomer, in training Posts: 47

    Some of the start directeries say empty when there is really a program there. Well most of them actually.
    Ok I will do that.
  14. jayrez Newcomer, in training Posts: 47

    2011/06/22 23:43:54.0812 0352 TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15
    2011/06/22 23:43:55.0453 0352 ================================================================================
    2011/06/22 23:43:55.0453 0352 SystemInfo:
    2011/06/22 23:43:55.0453 0352
    2011/06/22 23:43:55.0453 0352 OS Version: 5.1.2600 ServicePack: 3.0
    2011/06/22 23:43:55.0453 0352 Product type: Workstation
    2011/06/22 23:43:55.0453 0352 ComputerName: D9KV7191
    2011/06/22 23:43:55.0453 0352 UserName: Lindsay Dawedeit
    2011/06/22 23:43:55.0453 0352 Windows directory: C:\WINDOWS
    2011/06/22 23:43:55.0453 0352 System windows directory: C:\WINDOWS
    2011/06/22 23:43:55.0453 0352 Processor architecture: Intel x86
    2011/06/22 23:43:55.0453 0352 Number of processors: 1
    2011/06/22 23:43:55.0453 0352 Page size: 0x1000
    2011/06/22 23:43:55.0453 0352 Boot type: Normal boot
    2011/06/22 23:43:55.0453 0352 ================================================================================
    2011/06/22 23:43:57.0375 0352 Initialize success
    2011/06/22 23:44:00.0687 1672 ================================================================================
    2011/06/22 23:44:00.0687 1672 Scan started
    2011/06/22 23:44:00.0687 1672 Mode: Manual;
    2011/06/22 23:44:00.0687 1672 ================================================================================
    2011/06/22 23:44:03.0500 1672 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
    2011/06/22 23:44:04.0031 1672 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/06/22 23:44:04.0468 1672 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2011/06/22 23:44:04.0890 1672 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
    2011/06/22 23:44:05.0328 1672 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2011/06/22 23:44:05.0812 1672 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
    2011/06/22 23:44:06.0281 1672 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
    2011/06/22 23:44:06.0703 1672 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
    2011/06/22 23:44:07.0140 1672 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
    2011/06/22 23:44:07.0562 1672 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
    2011/06/22 23:44:08.0031 1672 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
    2011/06/22 23:44:08.0437 1672 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
    2011/06/22 23:44:08.0843 1672 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
    2011/06/22 23:44:09.0265 1672 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
    2011/06/22 23:44:09.0718 1672 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
    2011/06/22 23:44:10.0140 1672 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
    2011/06/22 23:44:10.0531 1672 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
    2011/06/22 23:44:10.0937 1672 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
    2011/06/22 23:44:11.0328 1672 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/06/22 23:44:11.0781 1672 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/06/22 23:44:12.0500 1672 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/06/22 23:44:12.0953 1672 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/06/22 23:44:13.0531 1672 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
    2011/06/22 23:44:14.0046 1672 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
    2011/06/22 23:44:14.0468 1672 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
    2011/06/22 23:44:14.0937 1672 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/06/22 23:44:15.0593 1672 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
    2011/06/22 23:44:15.0890 1672 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/06/22 23:44:16.0281 1672 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2011/06/22 23:44:16.0640 1672 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
    2011/06/22 23:44:17.0000 1672 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/06/22 23:44:17.0406 1672 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/06/22 23:44:17.0781 1672 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/06/22 23:44:18.0515 1672 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
    2011/06/22 23:44:18.0921 1672 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
    2011/06/22 23:44:19.0046 1672 cpudrv (d01f685f8b4598d144b0cce9ff95d8d5) C:\Program Files\SystemRequirementsLab\cpudrv.sys
    2011/06/22 23:44:19.0468 1672 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
    2011/06/22 23:44:19.0906 1672 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
    2011/06/22 23:44:20.0359 1672 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/06/22 23:44:21.0093 1672 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/06/22 23:44:21.0828 1672 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
    2011/06/22 23:44:22.0296 1672 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/06/22 23:44:22.0656 1672 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/06/22 23:44:23.0000 1672 DNINDIS5 (d2ee54cdbced01d48f2b18642be79a98) C:\WINDOWS\system32\DNINDIS5.SYS
    2011/06/22 23:44:23.0562 1672 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
    2011/06/22 23:44:23.0937 1672 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/06/22 23:44:24.0406 1672 E100B (7d91dc6342248369f94d6eba0cf42e99) C:\WINDOWS\system32\DRIVERS\e100b325.sys
    2011/06/22 23:44:24.0906 1672 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/06/22 23:44:25.0375 1672 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/06/22 23:44:25.0750 1672 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    2011/06/22 23:44:26.0218 1672 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2011/06/22 23:44:26.0640 1672 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2011/06/22 23:44:27.0078 1672 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/06/22 23:44:27.0515 1672 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/06/22 23:44:27.0953 1672 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
    2011/06/22 23:44:28.0421 1672 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/06/22 23:44:28.0828 1672 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys
    2011/06/22 23:44:29.0250 1672 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2011/06/22 23:44:29.0625 1672 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
    2011/06/22 23:44:30.0031 1672 HPZid412 (5faba4775d4c61e55ec669d643ffc71f) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
    2011/06/22 23:44:30.0484 1672 HPZipr12 (a3c43980ee1f1beac778b44ea65dbdd4) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
    2011/06/22 23:44:30.0875 1672 HPZius12 (2906949bd4e206f2bb0dd1896ce9f66f) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
    2011/06/22 23:44:31.0375 1672 HSFHWBS2 (77e4ff0b73bc0aeaaf39bf0c8104231f) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
    2011/06/22 23:44:32.0281 1672 HSF_DP (60e1604729a15ef4a3b05f298427b3b1) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
    2011/06/22 23:44:33.0203 1672 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/06/22 23:44:33.0750 1672 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
    2011/06/22 23:44:34.0140 1672 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
    2011/06/22 23:44:34.0578 1672 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/06/22 23:44:35.0437 1672 ialm (0294a30b302ca71a2c26e582dda93486) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
    2011/06/22 23:44:36.0203 1672 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/06/22 23:44:36.0796 1672 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
    2011/06/22 23:44:37.0312 1672 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
    2011/06/22 23:44:37.0765 1672 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/06/22 23:44:38.0296 1672 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2011/06/22 23:44:38.0890 1672 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/06/22 23:44:39.0453 1672 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/06/22 23:44:39.0953 1672 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/06/22 23:44:40.0453 1672 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/06/22 23:44:41.0000 1672 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/06/22 23:44:41.0531 1672 JSWSCIMD (ad67795900aa8c05cc4570f5349e0639) C:\WINDOWS\system32\DRIVERS\jswscimd.sys
    2011/06/22 23:44:42.0109 1672 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/06/22 23:44:42.0546 1672 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    2011/06/22 23:44:43.0046 1672 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/06/22 23:44:43.0625 1672 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/06/22 23:44:44.0515 1672 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2011/06/22 23:44:44.0968 1672 mdmxsdk (eeaea6514ba7c9d273b5e87c4e1aab30) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
    2011/06/22 23:44:45.0703 1672 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/06/22 23:44:46.0093 1672 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    2011/06/22 23:44:46.0562 1672 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
    2011/06/22 23:44:47.0046 1672 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/06/22 23:44:47.0562 1672 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2011/06/22 23:44:48.0093 1672 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/06/22 23:44:48.0625 1672 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
    2011/06/22 23:44:49.0125 1672 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/06/22 23:44:49.0843 1672 MRxSmb (421f7b922cec5a5f340e7574a98f7b7c) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/06/22 23:44:50.0531 1672 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/06/22 23:44:50.0968 1672 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/06/22 23:44:51.0421 1672 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/06/22 23:44:51.0828 1672 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/06/22 23:44:52.0156 1672 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/06/22 23:44:52.0656 1672 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
    2011/06/22 23:44:53.0062 1672 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2011/06/22 23:44:53.0625 1672 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2011/06/22 23:44:54.0125 1672 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/06/22 23:44:54.0656 1672 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2011/06/22 23:44:55.0078 1672 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/06/22 23:44:55.0562 1672 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/06/22 23:44:55.0984 1672 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/06/22 23:44:56.0468 1672 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/06/22 23:44:56.0890 1672 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/06/22 23:44:57.0359 1672 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/06/22 23:44:58.0390 1672 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/06/22 23:44:59.0046 1672 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/06/22 23:44:59.0687 1672 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/06/22 23:45:01.0093 1672 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2011/06/22 23:45:02.0281 1672 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/06/22 23:45:02.0656 1672 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/06/22 23:45:03.0062 1672 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
    2011/06/22 23:45:03.0515 1672 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/06/22 23:45:03.0968 1672 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/06/22 23:45:04.0343 1672 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/06/22 23:45:05.0046 1672 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/06/22 23:45:05.0515 1672 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2011/06/22 23:45:07.0062 1672 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
    2011/06/22 23:45:07.0453 1672 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
    2011/06/22 23:45:07.0921 1672 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/06/22 23:45:08.0328 1672 PRESONUS_AUDIOBOX_MIDI (ed7f742b0eacf745afb5b2fe5baec618) C:\WINDOWS\system32\drivers\psabusbm.sys
    2011/06/22 23:45:08.0937 1672 PRESONUS_AUDIOBOX_USB (dd02c038c7a24dd23aaa75595bec80ba) C:\WINDOWS\system32\Drivers\psabusbu.sys
    2011/06/22 23:45:09.0484 1672 PRESONUS_AUDIOBOX_WDM (08ac58a2bc1084e6eb4800b98368ccaa) C:\WINDOWS\system32\drivers\psabusba.sys
    2011/06/22 23:45:10.0000 1672 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/06/22 23:45:10.0406 1672 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/06/22 23:45:10.0718 1672 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
    2011/06/22 23:45:11.0109 1672 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
    2011/06/22 23:45:11.0531 1672 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
    2011/06/22 23:45:11.0953 1672 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
    2011/06/22 23:45:12.0343 1672 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
    2011/06/22 23:45:12.0718 1672 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/06/22 23:45:13.0109 1672 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/06/22 23:45:13.0515 1672 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/06/22 23:45:13.0906 1672 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/06/22 23:45:14.0468 1672 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/06/22 23:45:14.0906 1672 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/06/22 23:45:15.0375 1672 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/06/22 23:45:15.0953 1672 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/06/22 23:45:16.0390 1672 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/06/22 23:45:17.0078 1672 RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
    2011/06/22 23:45:17.0484 1672 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
    2011/06/22 23:45:17.0921 1672 SAVRKBootTasks (0aef47e0a6b0cba8c9833d55298b2791) C:\WINDOWS\system32\SAVRKBootTasks.sys
    2011/06/22 23:45:18.0328 1672 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/06/22 23:45:19.0031 1672 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys
    2011/06/22 23:45:19.0734 1672 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2011/06/22 23:45:20.0156 1672 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
    2011/06/22 23:45:20.0609 1672 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2011/06/22 23:45:21.0343 1672 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
    2011/06/22 23:45:21.0750 1672 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2011/06/22 23:45:22.0218 1672 smwdm (0066ff77aeb4ae70066f7e94d5a6d866) C:\WINDOWS\system32\drivers\smwdm.sys
    2011/06/22 23:45:22.0703 1672 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
    2011/06/22 23:45:23.0062 1672 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
    2011/06/22 23:45:23.0437 1672 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2011/06/22 23:45:23.0796 1672 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/06/22 23:45:24.0406 1672 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/06/22 23:45:24.0906 1672 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
    2011/06/22 23:45:25.0343 1672 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2011/06/22 23:45:25.0781 1672 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/06/22 23:45:26.0187 1672 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/06/22 23:45:26.0593 1672 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
    2011/06/22 23:45:26.0968 1672 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
    2011/06/22 23:45:27.0343 1672 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
    2011/06/22 23:45:27.0750 1672 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
    2011/06/22 23:45:28.0140 1672 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/06/22 23:45:28.0750 1672 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/06/22 23:45:29.0281 1672 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/06/22 23:45:29.0750 1672 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/06/22 23:45:30.0125 1672 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/06/22 23:45:30.0562 1672 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
    2011/06/22 23:45:30.0968 1672 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/06/22 23:45:31.0359 1672 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
    2011/06/22 23:45:31.0906 1672 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/06/22 23:45:32.0453 1672 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
    2011/06/22 23:45:32.0890 1672 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
    2011/06/22 23:45:33.0296 1672 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/06/22 23:45:33.0750 1672 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/06/22 23:45:34.0171 1672 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/06/22 23:45:34.0593 1672 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2011/06/22 23:45:35.0078 1672 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2011/06/22 23:45:35.0468 1672 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/06/22 23:45:35.0890 1672 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/06/22 23:45:36.0328 1672 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
    2011/06/22 23:45:36.0906 1672 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2011/06/22 23:45:37.0375 1672 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
    2011/06/22 23:45:37.0875 1672 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
    2011/06/22 23:45:38.0250 1672 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/06/22 23:45:38.0703 1672 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/06/22 23:45:39.0578 1672 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys
    2011/06/22 23:45:40.0500 1672 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/06/22 23:45:41.0171 1672 winachsf (f59ed5a43b988a18ef582bb07b2327a7) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
    2011/06/22 23:45:42.0046 1672 WN111v2 (93ea7d94959bef66d0e4adbc8ce4e073) C:\WINDOWS\system32\DRIVERS\WN111v2.sys
    2011/06/22 23:45:42.0640 1672 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
    2011/06/22 23:45:43.0093 1672 WSIMD (43f767d59bfc25d8f4fc2eb42043ec1e) C:\WINDOWS\system32\DRIVERS\wsimd.sys
    2011/06/22 23:45:43.0500 1672 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2011/06/22 23:45:43.0921 1672 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2011/06/22 23:45:44.0359 1672 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    2011/06/22 23:45:44.0453 1672 MBR (0x1B8) (3e3a57c3edd4ef2b3344bdfa5be57750) \Device\Harddisk0\DR0
    2011/06/22 23:45:44.0453 1672 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
    2011/06/22 23:45:44.0453 1672 ================================================================================
    2011/06/22 23:45:44.0453 1672 Scan finished
    2011/06/22 23:45:44.0453 1672 ================================================================================
    2011/06/22 23:45:44.0484 1184 Detected object count: 1
    2011/06/22 23:45:44.0484 1184 Actual detected object count: 1
    2011/06/22 23:49:40.0000 1184 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
    2011/06/22 23:49:40.0000 1184 \Device\Harddisk0\DR0 - ok
    2011/06/22 23:49:40.0000 1184 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure
    2011/06/22 23:50:09.0812 1260 Deinitialize success
  15. jayrez Newcomer, in training Posts: 47

    I also forgot to mention that when i booted up this morning my screen resolution was back to normal. Before I did the GMER scan.
  16. Broni Malware Annihilator Posts: 39,388   +177

    Very good :)

    Let's see, if we can fix your Start menu empty items...

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    64-bit users go HERE
    • Double-click SystemLook.exe to run it.
    • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box into the main textfield:
      Code:
      :dir
      %Temp%\smtmp /s
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
  17. jayrez Newcomer, in training Posts: 47

    SystemLook 04.09.10 by jpshortstuff
    Log created at 02:57 on 23/06/2011 by Lindsay Dawedeit
    Administrator - Elevation successful

    ========== dir ==========

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp - Parameters: "/s"

    ---Files---
    None found.

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1 d------ [19:17 19/06/2011]
    desktop.ini --ahs-- 272 bytes [18:57 10/08/2004] [02:20 23/01/2009]
    HP Image Zone.lnk ------- 902 bytes [16:20 25/10/2006] [16:20 25/10/2006]
    HP Director.lnk ------- 804 bytes [16:15 25/10/2006] [16:15 25/10/2006]
    Install Netscape Internet Service.lnk ------- 1161 bytes [04:07 19/12/2005] [04:07 19/12/2005]
    Program Updates.lnk ------- 995 bytes [02:56 26/12/2005] [02:56 26/12/2005]
    Software Manager.lnk ------- 1978 bytes [02:56 30/12/2009] [02:56 30/12/2009]
    µTorrent.lnk ------- 630 bytes [03:58 13/01/2011] [03:58 13/01/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs d------ [19:17 19/06/2011]
    Apple Software Update.lnk --a---- 2265 bytes [11:53 08/01/2011] [02:02 11/01/2011]
    Audacity.lnk --a---- 636 bytes [05:18 12/01/2011] [05:18 12/01/2011]
    desktop.ini --ahs-- 150 bytes [18:57 10/08/2004] [19:02 10/08/2004]
    Microsoft Plus! Photo Story 2 LE.lnk --a---- 1934 bytes [04:02 19/12/2005] [04:02 19/12/2005]
    PowerDVD.lnk --a---- 1690 bytes [04:01 19/12/2005] [04:01 19/12/2005]
    Vuze.lnk --a---- 1505 bytes [02:32 11/01/2011] [08:10 13/02/2011]
    Windows Movie Maker.lnk --a---- 690 bytes [19:02 10/08/2004] [19:02 10/08/2004]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories d------ [19:17 19/06/2011]
    Calculator.lnk --a---- 1498 bytes [19:01 10/08/2004] [23:18 06/04/2006]
    desktop.ini --ahs-- 255 bytes [19:01 10/08/2004] [19:28 26/03/2011]
    Paint.lnk --a---- 1515 bytes [19:01 10/08/2004] [08:32 15/01/2011]
    Scanner and Camera Wizard.lnk --a---- 710 bytes [01:25 27/02/2006] [19:28 26/03/2011]
    Sound Recorder.lnk --a---- 1432 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    WordPad.lnk --a---- 783 bytes [19:01 10/08/2004] [19:01 10/08/2004]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility d------ [19:17 19/06/2011]
    Accessibility Wizard.lnk --a---- 1424 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    desktop.ini --ahs-- 90 bytes [19:01 10/08/2004] [19:01 10/08/2004]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications d------ [19:17 19/06/2011]
    desktop.ini --ahs-- 516 bytes [19:00 10/08/2004] [02:22 23/01/2009]
    HyperTerminal.lnk --a---- 690 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    Network Connections.lnk --a---- 1661 bytes [19:00 10/08/2004] [19:00 10/08/2004]
    Network Setup Wizard.lnk --a---- 1544 bytes [19:02 10/08/2004] [19:02 10/08/2004]
    New Connection Wizard.lnk --a---- 1550 bytes [19:00 10/08/2004] [19:00 10/08/2004]
    Wireless Network Setup Wizard.lnk --a---- 1656 bytes [19:04 10/08/2004] [02:22 23/01/2009]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Fax d------ [19:17 19/06/2011]
    desktop.ini --ahs-- 283 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    Fax Console.lnk --a---- 1509 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    Fax Cover Page Editor.lnk --a---- 1614 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    Send a Fax....lnk --a---- 1497 bytes [19:01 10/08/2004] [19:01 10/08/2004]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment d------ [19:17 19/06/2011]
    desktop.ini --ahs-- 146 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    Volume Control.lnk --a---- 1528 bytes [19:01 10/08/2004] [04:45 16/06/2006]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools d------ [19:17 19/06/2011]
    Character Map.lnk --a---- 1425 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    desktop.ini --ahs-- 703 bytes [19:01 10/08/2004] [19:04 10/08/2004]
    Disk Cleanup.lnk --a---- 1436 bytes [19:02 10/08/2004] [19:02 10/08/2004]
    Disk Defragmenter.lnk --a---- 1572 bytes [19:02 10/08/2004] [03:59 28/05/2007]
    Files and Settings Transfer Wizard.lnk --a---- 1495 bytes [19:04 10/08/2004] [19:04 10/08/2004]
    Scheduled Tasks.lnk --a---- 1657 bytes [19:02 10/08/2004] [19:02 10/08/2004]
    System Information.lnk --a---- 974 bytes [19:02 10/08/2004] [19:02 10/08/2004]
    System Restore.lnk --a---- 1520 bytes [19:02 10/08/2004] [19:02 10/08/2004]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools d------ [19:17 19/06/2011]
    Component Services.lnk --a---- 1486 bytes [19:02 10/08/2004] [19:02 10/08/2004]
    Computer Management.lnk --a---- 1602 bytes [19:04 10/08/2004] [02:41 25/11/2009]
    Data Sources (ODBC).lnk --a---- 1596 bytes [19:04 10/08/2004] [02:32 25/11/2009]
    desktop.ini --ahs-- 476 bytes [19:02 10/08/2004] [19:04 10/08/2004]
    Event Viewer.lnk --a---- 1592 bytes [19:04 10/08/2004] [03:09 25/11/2009]
    Microsoft .NET Framework 1.1 Configuration.lnk --a---- 1011 bytes [19:09 10/08/2004] [19:10 10/08/2004]
    Microsoft .NET Framework 1.1 Wizards.lnk --a---- 1062 bytes [19:09 10/08/2004] [19:10 10/08/2004]
    Performance.lnk --a---- 1591 bytes [19:04 10/08/2004] [02:31 25/11/2009]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\AVG Free 8.5 d------ [19:17 19/06/2011]
    AVG Free Tray Icon.lnk --a---- 1535 bytes [22:47 25/11/2009] [22:47 25/11/2009]
    AVG Free User Interface.lnk --a---- 1519 bytes [22:47 25/11/2009] [22:47 25/11/2009]
    Uninstall AVG Free.lnk --a---- 1541 bytes [22:47 25/11/2009] [22:47 25/11/2009]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Malwarebytes' Anti-Malware d------ [19:17 19/06/2011]
    Malwarebytes' Anti-Malware Help.lnk --a---- 708 bytes [19:20 09/10/2010] [19:20 09/10/2010]
    Malwarebytes' Anti-Malware.lnk --a---- 708 bytes [19:20 09/10/2010] [19:20 09/10/2010]
    Uninstall Malwarebytes' Anti-Malware.lnk --a---- 732 bytes [19:20 09/10/2010] [19:20 09/10/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\NETGEAR WN111v2 Adapter d------ [19:18 19/06/2011]
    NETGEAR Smart Wizard.lnk --a---- 1720 bytes [18:15 25/11/2009] [18:15 25/11/2009]
    Uninstall NETGEAR WN111v2 Software.lnk --a---- 831 bytes [18:15 25/11/2009] [18:15 25/11/2009]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\CamStudio d------ [19:18 19/06/2011]
    CamStudio.lnk --a---- 701 bytes [03:14 27/03/2011] [03:14 27/03/2011]
    Movie Player 2.1.lnk --a---- 647 bytes [03:14 27/03/2011] [03:14 27/03/2011]
    Movie Player.lnk --a---- 635 bytes [03:14 27/03/2011] [03:14 27/03/2011]
    SWF Producer.lnk --a---- 647 bytes [03:14 27/03/2011] [03:14 27/03/2011]
    Uninstall.lnk --a---- 706 bytes [03:14 27/03/2011] [03:14 27/03/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series d------ [19:18 19/06/2011]
    MP Drivers Uninstaller.lnk --a---- 1280 bytes [03:50 22/01/2010] [03:50 22/01/2010]
    Readme.lnk --a---- 902 bytes [03:50 22/01/2010] [03:50 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon IJ Network Utilities d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon IJ Network Utilities\Canon IJ Network Scan Utility d------ [19:18 19/06/2011]
    Canon IJ Network Scan Utility ReadMe.lnk --a---- 921 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    Canon IJ Network Scan Utility.lnk --a---- 1844 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    Uninstaller.lnk --a---- 1837 bytes [03:22 22/01/2010] [03:22 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon IJ Network Utilities\Canon IJ Network Tool d------ [19:18 19/06/2011]
    Canon IJ Network Tool ReadMe.lnk --a---- 865 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    Canon IJ Network Tool.lnk --a---- 1772 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    Uninstaller.lnk --a---- 1765 bytes [03:22 22/01/2010] [03:22 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon MX860 series Manual d------ [19:18 19/06/2011]
    Canon MX860 series On-screen Manual.lnk --a---- 1967 bytes [03:21 22/01/2010] [03:21 22/01/2010]
    Uninstall.lnk --a---- 865 bytes [03:21 22/01/2010] [03:21 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon MX860 series User Registration d------ [19:18 19/06/2011]
    User Registration Uninstall.LNK --a---- 1697 bytes [04:14 22/01/2010] [04:14 22/01/2010]
    User Registration.LNK --a---- 1697 bytes [04:14 22/01/2010] [04:14 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon Utilities d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon Utilities\Easy-PhotoPrint EX d------ [19:18 19/06/2011]
    Easy-PhotoPrint EX Readme.lnk --a---- 1736 bytes [03:24 22/01/2010] [03:24 22/01/2010]
    Easy-PhotoPrint EX Uninstall.lnk --a---- 1798 bytes [03:24 22/01/2010] [03:24 22/01/2010]
    Easy-PhotoPrint EX.lnk --a---- 1752 bytes [03:24 22/01/2010] [03:24 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon Utilities\MP Navigator EX 2.1 d------ [19:18 19/06/2011]
    MP Navigator EX 2.1.lnk --a---- 1754 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    MP Navigator EX Readme.lnk --a---- 1747 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    MP Navigator EX Uninstall.lnk --a---- 1834 bytes [03:22 22/01/2010] [03:22 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon Utilities\My Printer d------ [19:18 19/06/2011]
    My Printer Readme.lnk --a---- 1655 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    My Printer Uninstall.lnk --a---- 1717 bytes [03:22 22/01/2010] [03:22 22/01/2010]
    My Printer.lnk --a---- 1670 bytes [03:22 22/01/2010] [03:22 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Canon MX860 series\Canon Utilities\Solution Menu d------ [19:18 19/06/2011]
    Solution Menu Readme.lnk --a---- 1682 bytes [03:24 22/01/2010] [03:24 22/01/2010]
    Solution Menu Uninstall.lnk --a---- 1744 bytes [03:24 22/01/2010] [03:24 22/01/2010]
    Solution Menu.lnk --a---- 1698 bytes [03:24 22/01/2010] [03:24 22/01/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\CCleaner d------ [19:18 19/06/2011]
    CCleaner Homepage.url --a---- 82 bytes [00:32 20/01/2011] [00:32 20/01/2011]
    CCleaner.lnk --a---- 694 bytes [00:32 20/01/2011] [00:32 20/01/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Cool Edit Pro 2.1 d------ [19:18 19/06/2011]
    Cool Edit Pro 2.1 .lnk --a---- 694 bytes [06:21 25/03/2011] [06:21 25/03/2011]
    Cool Edit Pro 2.1 Loop Library.lnk --a---- 242 bytes [06:21 25/03/2011] [06:21 25/03/2011]
    Cool Edit Pro 2.1 Online Resources.lnk --a---- 294 bytes [06:21 25/03/2011] [06:21 25/03/2011]
    Download Cool Edit Pro 2.1 Manual.lnk --a---- 242 bytes [06:21 25/03/2011] [06:21 25/03/2011]
    Uninstall Cool Edit Pro 2.1.lnk --a---- 694 bytes [06:21 25/03/2011] [06:21 25/03/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Dell Printers d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Dell Printers\Dell Photo AIO Printer 924 d------ [19:18 19/06/2011]
    Dell All-In-One Center.LNK --a---- 826 bytes [05:15 01/03/2011] [05:15 01/03/2011]
    Dell Order Ink Cartridges.lnk --a---- 1883 bytes [05:12 01/03/2011] [05:12 01/03/2011]
    Uninstall Dell Photo AIO Printer 924.lnk --a---- 921 bytes [05:12 01/03/2011] [05:12 01/03/2011]
    View Dell User's Guide.lnk --a---- 441 bytes [05:12 01/03/2011] [05:12 01/03/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\DragonBall Online d------ [19:18 19/06/2011]
    ¤CÀs¯]Online Uninstall.lnk --a---- 1769 bytes [09:10 11/06/2011] [09:10 11/06/2011]
    ¤CÀs¯]Online.lnk --a---- 1411 bytes [09:09 11/06/2011] [09:09 11/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Easy-Hide-IP d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Games d------ [19:18 19/06/2011]
    desktop.ini --ahs-- 798 bytes [19:01 10/08/2004] [02:03 25/11/2009]
    Freecell.lnk --a---- 1522 bytes [19:01 10/08/2004] [19:05 24/09/2006]
    Minesweeper.lnk --a---- 1515 bytes [19:01 10/08/2004] [00:25 07/08/2006]
    Pinball.lnk --a---- 789 bytes [19:01 10/08/2004] [19:01 10/08/2004]
    Solitaire.lnk --a---- 1491 bytes [19:01 10/08/2004] [00:44 27/12/2005]
    Spider Solitaire.lnk --a---- 1502 bytes [19:01 10/08/2004] [20:50 09/10/2010]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\HP d------ [19:18 19/06/2011]
    HP Diagnostic Assistant.lnk --a---- 817 bytes [16:16 25/10/2006] [16:16 25/10/2006]
    HP Director.lnk --a---- 816 bytes [16:15 25/10/2006] [16:15 25/10/2006]
    HP Document Viewer.lnk --a---- 1822 bytes [16:19 25/10/2006] [16:19 25/10/2006]
    HP Image Zone Tour.lnk --a---- 864 bytes [16:18 25/10/2006] [16:18 25/10/2006]
    HP Print Screen.lnk --a---- 1854 bytes [16:20 25/10/2006] [16:20 25/10/2006]
    Image Zone .lnk --a---- 914 bytes [16:20 25/10/2006] [16:20 25/10/2006]
    System Diagnostics.lnk --a---- 892 bytes [16:16 25/10/2006] [16:16 25/10/2006]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\HP\PSC All-In-One 2350 series d------ [19:18 19/06/2011]
    Help.lnk --a---- 870 bytes [17:56 25/10/2006] [17:56 25/10/2006]
    Image Transfer.lnk --a---- 833 bytes [17:56 25/10/2006] [17:56 25/10/2006]
    Product Registration.lnk --a---- 822 bytes [17:56 25/10/2006] [17:56 25/10/2006]
    Product Support Website.lnk --a---- 1036 bytes [17:56 25/10/2006] [17:56 25/10/2006]
    Readme.lnk --a---- 800 bytes [17:56 25/10/2006] [17:56 25/10/2006]
    Uninstall.lnk --a---- 1233 bytes [17:56 25/10/2006] [17:56 25/10/2006]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\iTunes d------ [19:18 19/06/2011]
    About iTunes.lnk --a---- 1814 bytes [02:20 11/01/2011] [02:20 11/01/2011]
    iTunes.lnk --a---- 1554 bytes [02:20 11/01/2011] [02:20 11/01/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\JDownloader d------ [19:18 19/06/2011]
    jdupdate.log --a---- 110 bytes [00:13 01/02/2011] [02:41 02/02/2011]
    restarter.log --a---- 110 bytes [00:16 01/02/2011] [02:41 02/02/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware d------ [19:18 19/06/2011]
    Malwarebytes' Anti-Malware Help.lnk --a---- 796 bytes [06:08 19/06/2011] [06:08 19/06/2011]
    Malwarebytes' Anti-Malware.lnk --a---- 796 bytes [06:08 19/06/2011] [06:08 19/06/2011]
    Uninstall Malwarebytes' Anti-Malware.lnk --a---- 820 bytes [06:08 19/06/2011] [06:08 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office d------ [19:18 19/06/2011]
    Microsoft Office Excel 2007.lnk --a---- 2561 bytes [02:24 01/12/2009] [05:15 03/12/2009]
    Microsoft Office OneNote 2007.lnk --a---- 2525 bytes [02:24 01/12/2009] [05:15 03/12/2009]
    Microsoft Office PowerPoint 2007.lnk --a---- 2495 bytes [02:24 01/12/2009] [02:09 29/03/2011]
    Microsoft Office Word 2007.lnk --a---- 2527 bytes [02:24 01/12/2009] [01:52 14/04/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools d------ [19:18 19/06/2011]
    Digital Certificate for VBA Projects.lnk --a---- 2553 bytes [02:24 01/12/2009] [05:15 03/12/2009]
    Microsoft Clip Organizer.lnk --a---- 2533 bytes [02:24 01/12/2009] [05:15 03/12/2009]
    Microsoft Office 2007 Language Settings.lnk --a---- 2433 bytes [02:24 01/12/2009] [05:15 03/12/2009]
    Microsoft Office Diagnostics.lnk --a---- 2531 bytes [02:24 01/12/2009] [05:15 03/12/2009]
    Microsoft Office Picture Manager.lnk --a---- 2511 bytes [02:24 01/12/2009] [05:15 03/12/2009]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Mixxx d------ [19:18 19/06/2011]
    Manual.lnk --a---- 1557 bytes [04:25 12/01/2011] [04:25 12/01/2011]
    Mixxx.lnk --a---- 1504 bytes [04:25 12/01/2011] [04:25 12/01/2011]
    Uninstall.lnk --a---- 1513 bytes [04:25 12/01/2011] [04:25 12/01/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\NETGEAR WN111v2 Adapter d------ [19:18 19/06/2011]
    NETGEAR Smart Wizard.lnk --a---- 1720 bytes [02:20 22/01/2011] [02:20 22/01/2011]
    Uninstall NETGEAR WN111v2 Software.lnk --a---- 831 bytes [02:20 22/01/2011] [02:20 22/01/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Nexon d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Nexon\MapleStory d------ [19:18 19/06/2011]
    MapleStory.url --a---- 204 bytes [07:40 07/05/2011] [07:40 07/05/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\OpinionSquare d------ [19:18 19/06/2011]
    About OpinionSquare.lnk --a---- 234 bytes [00:56 21/02/2011] [00:56 21/02/2011]
    Privacy Policy and User License Agreement.lnk --a---- 282 bytes [00:56 21/02/2011] [00:56 21/02/2011]
    Support.lnk --a---- 214 bytes [00:56 21/02/2011] [00:56 21/02/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\QuickTime d------ [19:18 19/06/2011]
    About QuickTime.lnk --a---- 1802 bytes [11:56 08/01/2011] [11:56 08/01/2011]
    PictureViewer.lnk --a---- 1812 bytes [11:56 08/01/2011] [11:56 08/01/2011]
    QuickTime Player.lnk --a---- 1802 bytes [11:56 08/01/2011] [11:56 08/01/2011]
    Uninstall QuickTime.lnk --a---- 1639 bytes [11:56 08/01/2011] [11:56 08/01/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Skype d------ [19:18 19/06/2011]
    Skype.lnk --a---- 1878 bytes [02:44 05/05/2011] [02:44 05/05/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Sophos d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Sophos\Sophos Anti-Rootkit d------ [19:18 19/06/2011]
    Sophos Anti-Rootkit manual.lnk --a---- 1756 bytes [00:04 29/03/2011] [00:04 29/03/2011]
    Sophos Anti-Rootkit.lnk --a---- 1756 bytes [00:04 29/03/2011] [00:04 29/03/2011]
    Uninstall Sophos Anti-Rootkit.lnk --a---- 1770 bytes [00:04 29/03/2011] [00:04 29/03/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\Startup d------ [19:18 19/06/2011]
    desktop.ini --ahs-- 84 bytes [18:57 10/08/2004] [19:04 10/08/2004]
    NETGEAR WN111v2 Smart Wizard.lnk --a---- 1720 bytes [02:20 22/01/2011] [02:20 22/01/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\WhiteSmoke d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\1\Programs\WinRAR d------ [19:18 19/06/2011]
    Console RAR manual.lnk --a---- 685 bytes [23:21 26/02/2011] [23:21 26/02/2011]
    WinRAR help.lnk --a---- 704 bytes [23:21 26/02/2011] [23:21 26/02/2011]
    WinRAR.lnk --a---- 704 bytes [23:21 26/02/2011] [23:21 26/02/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\2 d------ [19:18 19/06/2011]

    C:\DOCUME~1\LINDSA~1\LOCALS~1\Temp\smtmp\4 d------ [19:18 19/06/2011]
    CamStudio.lnk ------- 689 bytes [03:14 27/03/2011] [03:14 27/03/2011]
    CCleaner.lnk ------- 682 bytes [00:32 20/01/2011] [00:32 20/01/2011]
    Cool Edit Pro 2.1.lnk ------- 682 bytes [06:21 25/03/2011] [06:21 25/03/2011]
    Dell Printer Supplies - Inkjet.lnk ------- 1753 bytes [05:32 01/03/2011] [05:32 01/03/2011]
    iTunes.lnk ------- 1542 bytes [02:20 11/01/2011] [02:20 11/01/2011]
    Malwarebytes' Anti-Malware.lnk ------- 784 bytes [06:08 19/06/2011] [06:08 19/06/2011]
    Mixxx.lnk ------- 1492 bytes [04:25 12/01/2011] [04:25 12/01/2011]
    NETGEAR WN111v2 Smart Wizard.lnk ------- 1700 bytes [02:20 22/01/2011] [02:20 22/01/2011]
    QuickTime Player.lnk ------- 1604 bytes [11:56 08/01/2011] [11:56 08/01/2011]
    Skype.lnk ------- 1878 bytes [02:44 05/05/2011] [02:44 05/05/2011]
    Vuze.lnk ------- 1505 bytes [02:32 11/01/2011] [08:10 13/02/2011]
    ¤CÀs¯]Online.lnk ------- 1399 bytes [09:10 11/06/2011] [09:10 11/06/2011]
    µTorrent.lnk ------- 630 bytes [03:58 13/01/2011] [03:58 13/01/2011]

    -= EOF =-
  18. Broni Malware Annihilator Posts: 39,388   +177

    Let's see, if this will fix your issue....

    Open Notepad.
    Copy all text from the following code box and paste it into Notepad window:

    Code:
    @echo off
    xcopy "C:\Documents and Settings\LINDSA~1\Local Settings\Temp\smtmp\1\*" "C:\Documents and Settings\All Users\Start Menu\" /s
    xcopy "C:\Documents and Settings\LINDSA~1\Local Settings\Temp\smtmp\2\*" "C:\Documents and Settings\LINDSA~1\Application Data\Microsoft\Internet Explorer\Quick Launch\" /s
    xcopy "C:\Documents and Settings\LINDSA~1\Local Settings\Temp\smtmp\4\*" "C:\Documents and Settings\All Users\Desktop\" /s 
    exit
    
    Save the file as fix.bat.

    Double click fix.bat to run it.
    A pop-up window will open and you'll see number of files being copied.
    The window will close, when all copying is done.
  19. jayrez Newcomer, in training Posts: 47

    Thanks that seems to have done the trick :)
  20. Broni Malware Annihilator Posts: 39,388   +177

    Good news :)

    Please download Rootkit Unhooker from one of the following links and save it to your desktop.
    In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can download, install and use the free 7-zip utility.

    • Double-click on RKUnhookerLE.exe to start the program.
      Vista/Windows 7 users right-click and select Run As Administrator.
    • Click the Report tab, then click Scan.
    • Check Drivers, Stealth, and uncheck the rest.
    • Click OK.
    • Wait until it's finished and then go to File > Save Report.
    • Save the report to your Desktop.
    • Copy and paste the contents of the report into your next reply.
    -- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

    =====================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!