TechSpot

Search redirect and other issues

By silverwings85
Feb 2, 2011
  1. Hey guys!

    So I have a virus protection but it needed to be renewed and I was short on funds so I was without protection for a few weeks and I think I picked up something. Everytime I use a search, it redirects me and I've had random pop-ups on pages that don't normally give me pop-ups. The computer is also running super slow, and having random sounds and errors. I battled the Vundo virus awhile back and this seems like the same kinda thing. Help?

    - Kim
     
  2. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok, I'm trying to get the 8 steps done, but I simply CANNOT get the GMER file to work. I've tried exiting out of everything (even manually shutting off processes), unchecking the 'devices' box AND running in Safe Mode and it freezes up every time. I have my internet disabled and my virus protection disabled also. The virus is leaving a constant IExplorer up and I don't even use IE, I am working on Firefox. Not sure whats going on or what I'm doing wrong!
     
  4. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok, here's Malware Bytes...

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5659

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    2/2/2011 10:28:05 AM
    mbam-log-2011-02-02 (10-28-05).txt

    Scan type: Quick scan
    Objects scanned: 157916
    Time elapsed: 7 minute(s), 17 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 16
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 3

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Visicom Media (Adware.KeenValue) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\THtbkNgfuioGT.exe (Trojan.Agent) -> Value: THtbkNgfuioGT.exe -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\all users\application data\thtbkngfuiogt.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    c:\documents and settings\all users\application data\jbgvxreinunpr.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    c:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\29861A.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
     
  5. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok, DDS... (I still can't get GMER to run - I'm going to try to download it again and start over)


    DDS (Ver_10-12-12.02) - NTFSx86
    Run by Kimberly at 12:59:47.74 on Wed 02/02/2011
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15

    ============== Running Processes ===============

    c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
    C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\WINDOWS\System32\MDM.EXE
    C:\Documents and Settings\Kimberly\Desktop\dds.scr
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\WINDOWS\System32\svchost.exe -k NetworkService
    C:\WINDOWS\system32\svchost.exe -k LocalService
    C:\WINDOWS\System32\svchost.exe -k LocalService
    C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
    C:\WINDOWS\System32\svchost.exe -k imgsvc

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.titanbank.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
    uURLSearchHooks: H - No File
    mURLSearchHooks: SrchHook Class: {d3f669eb-57ce-4f45-8fbd-e245cbb46366} - c:\program files\stopzilla!\toolbar\SZIESearchHook.dll
    mURLSearchHooks: SrchHook Class: {d3f669eb-57ce-4f45-8fbd-e245cbb46366} - c:\program files\stopzilla!\toolbar\SZIESearchHook.dll
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
    BHO: ZILLAbar Browser Helper Object: {1827766b-9f49-4854-8034-f6ee26fcb1ec} - c:\program files\stopzilla!\toolbar\SZSG.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: STOPzilla Browser Helper Object: {e3215f20-3212-11d6-9f8b-00d0b743919d} - c:\program files\stopzilla!\SZIEBHO.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: STOPzilla: {98828ded-a591-462f-83ba-d2f62a68b8b8} - c:\program files\stopzilla!\toolbar\SZSG.dll
    TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
    TB: {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - No File
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 4.0\apdproxy.exe"
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"
    mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    mRun: [SunJavaUpdateSched] c:\program files\java\j2re1.4.2_03\bin\jusched.exe
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [BCMSMMSG] BCMSMMSG.exe
    IE: c:\progra~1\common~1\btlink\btlink.dll//iemenu
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    Trusted Zone: west.com
    Trusted Zone: westathome.com
    Trusted Zone: westathome.net
    Trusted Zone: westathomeagent.net
    Trusted Zone: workathomeagent.net
    DPF: DirectAnimation Java Classes
    DPF: Microsoft XML Parser for Java
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} - hxxp://picture.vzw.com/activex/VerizonWirelessUploadControl.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Notify: TPSvc - TPSvc.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\kimberly\applic~1\mozilla\firefox\profiles\4b4ezboc.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.hotmail.com
    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
    FF - prefs.js: network.proxy.type - 4
    FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
    FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\documents and settings\kimberly\application data\facebook\npfbplugin_1_0_3.dll
    FF - plugin: c:\documents and settings\kimberly\application data\mozilla\firefox\profiles\4b4ezboc.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000004.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npagent.dll
    FF - plugin: c:\program files\smileycentral_1v\bar\1.bin\NP1vStub.dll
    FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    ============= SERVICES / DRIVERS ===============

    R? AgilentUSBCam;E-Video DC-350 USB Camera
    R? CIF USB CAMERA Service;CIF USB CAMERA
    R? gupdate;Google Update Service (gupdate)
    R? is3srv;is3srv
    R? iscFlash;iscFlash
    R? NWUSBCDFIL;Novatel Wireless Installation CD
    R? NWUSBPort2;Novatel Wireless USB Status2 Port Driver
    R? PavSRK.sys;PavSRK.sys
    R? QATMARPC;QATMARPC
    R? SmileyCentral_1vService;SmileyCentral Service
    S? szkg5;szkg5
    S? szkgfs;szkgfs
    S? WinDefend;Windows Defender

    =============== Created Last 30 ================

    2011-02-02 16:18:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-02 16:18:12 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-02 16:18:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 09:55:06 377344 ----a-w- c:\docume~1\alluse~1\applic~1\j3HYnZW8zK.exe
    2011-01-15 22:55:01 -------- d-----w- c:\docume~1\alluse~1\applic~1\WeCareReminder

    ==================== Find3M ====================

    2010-12-09 23:38:26 132560 ----a-r- c:\windows\system32\IS3HTUI5.dll
    2010-12-09 23:38:24 546256 ----a-r- c:\windows\system32\SZComp5.dll
    2010-12-09 23:38:24 452048 ----a-r- c:\windows\system32\SZBase5.dll
    2010-12-09 23:38:24 398800 ----a-r- c:\windows\system32\IS3DBA5.dll
    2010-12-09 23:38:24 28624 ----a-r- c:\windows\system32\IS3XDat5.dll
    2010-12-09 23:38:24 22992 ----a-r- c:\windows\system32\SZIO5.dll
    2010-12-09 23:38:22 99792 ----a-r- c:\windows\system32\IS3Svc5.dll
    2010-12-09 23:38:22 99792 ----a-r- c:\windows\system32\IS3Inet5.dll
    2010-12-09 23:38:22 67024 ----a-r- c:\windows\system32\IS3Hks5.dll
    2010-12-09 23:38:22 390608 ----a-r- c:\windows\system32\IS3UI5.dll
    2010-12-09 23:38:20 738768 ----a-r- c:\windows\system32\IS3Base5.dll
    2010-12-09 23:38:20 230864 ----a-r- c:\windows\system32\IS3Win325.dll
    2010-11-29 23:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
    2010-11-09 14:52:35 249856 ----a-w- c:\windows\system32\odbc32.dll
    2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl

    ============= FINISH: 13:18:37.09 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 3/19/2003 2:00:14 PM
    System Uptime: 2/2/2011 12:44:54 PM (1 hours ago)

    Motherboard: Dell Computer Corporation | | 07W080
    Processor: Intel(R) Pentium(R) 4 CPU 2.00GHz | Socket 478 | 1993/400mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 56 GiB total, 20.77 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID:
    Description: Network Controller
    Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_70001799&REV_02\4&1A671D0C&0&28F0
    Manufacturer:
    Name: Network Controller
    PNP Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_70001799&REV_02\4&1A671D0C&0&28F0
    Service:

    Class GUID: {4D36E96D-E325-11CE-BFC1-08002BE10318}
    Description: BCM V.92 56K Modem
    Device ID: PCI\VEN_14E4&DEV_4212&SUBSYS_00011028&REV_02\4&1A671D0C&0&30F0
    Manufacturer: Broadcom Corporation
    Name: BCM V.92 56K Modem
    PNP Device ID: PCI\VEN_14E4&DEV_4212&SUBSYS_00011028&REV_02\4&1A671D0C&0&30F0
    Service: Modem

    Class GUID: {4D36E96D-E325-11CE-BFC1-08002BE10318}
    Description: Communications cable between two computers
    Device ID: ROOT\PNPC031\0000
    Manufacturer: (Standard Modem Types)
    Name: Communications cable between two computers
    PNP Device ID: ROOT\PNPC031\0000
    Service: Modem

    ==== System Restore Points ===================


    ==== Installed Programs ======================

    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 Plugin
    Adobe Help Center 2.0
    Adobe Photoshop Elements 4.0
    Adobe Reader 9.4.1
    Adobe Shockwave Player
    Adobe® Photoshop® Album Starter Edition 3.0
    Ask Toolbar
    Audacity 1.3.12 (Unicode)
    BACS
    Banctec Service Agreement
    BCM V.92 56K Modem
    Belarc Advisor 8.1
    Bing Maps 3D
    BlackBerry_9330 1.0
    Broadcom Advanced Control Suite
    BufferChm
    CASIO USB Driver V1.2.2474.0623
    CDK Players
    Critical Update for Windows Media Player 11 (KB959772)
    CustomerResearchQFolder
    DeviceDiscovery
    DeviceManagementQFolder
    DJ_SF_03_D1500_ProductContext
    DJ_SF_03_D1500_Software
    DJ_SF_03_D1500_Software_Min
    eSupportQFolder
    Facebook Plug-In
    FrostWire 4.21.3
    Google Earth
    Google Update Helper
    GPBaseService
    Help 2.0
    Help and Support Customization
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HP Customer Participation Program 10.0
    HP Deskjet D1500 Printer Driver Software 10.0 Rel .3
    HP Imaging Device Functions 10.0
    HP Photosmart Essential 2.5
    HP Smart Web Printing
    HP Solution Center 10.0
    HP Update
    HPProductAssistant
    HPSSupply
    Intel(R) Extreme Graphics Driver
    iS3 STOPzilla Toolbar
    J2SE Runtime Environment 5.0 Update 3
    Java 2 Runtime Environment, SE v1.4.2
    Java 2 Runtime Environment, SE v1.4.2_03
    Java(TM) 6 Update 15
    LAME v3.98.2 for Audacity
    LeapFrog Connect
    LeapFrog Leapster2 Plugin
    LG Android Drivers
    LG USB Modem driver
    Malwarebytes' Anti-Malware
    MarketResearch
    Mary Kay Career Cars Screen Saver
    mary kay personal beauty profiler
    Microsoft .NET Framework (English)
    Microsoft .NET Framework (English) v1.0.3705
    Microsoft .NET Framework 1.0 Hotfix (KB928367)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Data Access Components KB870669
    Microsoft FrontPage 2000
    Microsoft Image Composer 1.5
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Office 2000 Premium
    Microsoft Office Live Meeting 2007
    Microsoft Outlook 2002
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works 2000
    Mobile Broadband Generic Drivers
    Modem Helper
    Motorola Driver Installation 3.9.0
    Mozilla Firefox (3.6.13)
    MSXML 6 Service Pack 2 (KB973686)
    Need4 3GP Converter 7
    Need4 Software Launcher 7.1
    Octoshape add-in for Adobe Flash Player
    Office Suite 2005
    Ogg Codecs 0.81.15562
    Pantech Handset Driver
    PSSWCORE
    QuickTime
    RapidPlayer v5.0 ActiveX Control
    RealPlayer
    RealUpgrade 1.0
    Registry Cleaner 2.1
    SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6
    Samsung_I500 1.0
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974455)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB976325)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Shockwave
    Shop for HP Supplies
    SmartWebPrintingOC
    SmileyCentral
    SolutionCenter
    Sprint Mobile Broadband (Novatel Wireless)
    Status
    STOPzilla
    Toolbox
    TrayApp
    Ulead Photo Express 3.0 SE
    Uninstall 1.0.0.1
    UnloadSupport
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB975364)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB976749)
    Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin)
    V CAST Media Manager
    VCAST Media Manager Update 1.0.0.1
    VideoToolkit01
    VLC media player 0.9.2
    WebFldrs XP
    WebReg
    Windows Blaster Worm Removal Tool (KB833330)
    Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
    Windows Driver Package - Microsoft Corporation (usbvideo) Image (05/25/2007 1.0.3656.0)
    Windows Genuine Advantage Notifications (KB905474)
    Windows Imaging Component
    Windows Installer Clean Up
    Windows Internet Explorer 8
    Windows Media Format 11 runtime
    Windows Media Player 10 Hotfix - KB894476
    Windows Media Player 11
    Windows XP Service Pack 3
    Word in Works Suite add-in
    WordPerfect Office 2002

    ==== End Of File ===========================
     
  6. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Leave GMER alone for now...

    Please download Rootkit Unhooker from one of the following links and save it to your desktop.
    In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

    • Double-click on RKUnhookerLE.exe to start the program.
      Vista/Windows 7 users right-click and select Run As Administrator.
    • Click the Report tab, then click Scan.
    • Check Drivers, Stealth, and uncheck the rest.
    • Click OK.
    • Wait until it's finished and then go to File > Save Report.
    • Save the report to your Desktop.
    • Copy and paste the contents of the report into your next reply.
    -- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".
     
  7. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    This one ran just fine...

    RkU Version: 3.8.388.590, Type LE (SR2)
    ==============================================
    OS Name: Windows XP
    Version 5.1.2600 (Service Pack 3)
    Number of processors #1
    ==============================================
    >Drivers
    ==============================================
    0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System)
    0x804D7000 PnpManager 2189952 bytes
    0x804D7000 RAW 2189952 bytes
    0x804D7000 WMIxWDM 2189952 bytes
    0xBF800000 Win32k 1855488 bytes
    0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
    0xF84B7000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
    0xF75B5000 C:\WINDOWS\system32\drivers\smwdm.sys 520192 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )
    0xBF06F000 C:\WINDOWS\System32\ialmdd5.DLL 458752 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
    0xEE5C4000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
    0xF74F7000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
    0xEE6A9000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
    0xB6371000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
    0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
    0xF74C3000 C:\WINDOWS\system32\DRIVERS\NWADIenum.sys 212992 bytes (Novatel Wireless Inc, NWADI Interface Bus Enumerator)
    0xEE727000 C:\WINDOWS\System32\Drivers\UdfReadr_xp.SYS 208896 bytes (Roxio, CD-UDF NT Filesystem Reader Driver)
    0xBF040000 C:\WINDOWS\System32\ialmdev5.DLL 192512 bytes (Intel Corporation, Component GHAL Driver)
    0xF85E8000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
    0xB6773000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
    0xF848A000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
    0xEE634000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
    0xEE681000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
    0xEE59E000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
    0xB67C8000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
    0xF7591000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
    0xF7670000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
    0xF764D000 C:\WINDOWS\System32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
    0xEE65F000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
    0xBF01F000 C:\WINDOWS\System32\ialmdnt5.dll 135168 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
    0x806EE000 ACPI_HAL 131840 bytes
    0x806EE000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
    0xF8580000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
    0xF85B8000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
    0xEF3EB000 C:\WINDOWS\system32\drivers\ialmsbw.sys 110592 bytes (Intel Corporation, Intel Graphics Platform (SoftBIOS) Driver for Windows 2000(R) & Windows XP(TM))
    0xF8470000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
    0xF7634000 C:\WINDOWS\System32\Drivers\pwd_2k.SYS 102400 bytes (Roxio, Win2000 Framework for Packet Write Driver)
    0xF85A0000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xB6814000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
    0xF8557000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
    0xF7566000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
    0xF76A8000 C:\WINDOWS\System32\DRIVERS\ialmnt5.sys 90112 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
    0xB6576000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
    0xEF406000 C:\WINDOWS\system32\drivers\ialmkchw.sys 81920 bytes (Intel Corporation, Intel Graphics Chipset (KCH) Driver for Windows 2000(R) & Windows XP(TM))
    0xF757D000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
    0xF7694000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
    0xEE702000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
    0xF8544000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
    0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
    0xF856E000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
    0xF85D7000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
    0xF7555000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
    0xB7794000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
    0xF8727000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
    0xF8757000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
    0xF8747000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
    0xF8737000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
    0xEEE96000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
    0xF87C7000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
    0xF8637000 szkg.sys 57344 bytes (iS3 Inc., szkg Device Driver)
    0xF86A7000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
    0xF8767000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
    0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 53248 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
    0xF8777000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
    0xF8647000 szkgfs.sys 53248 bytes (iS3, Inc., STOPzilla Kernel Guard File System, x86-32 )
    0xF8687000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
    0xF8797000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
    0xEF131000 C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys 45056 bytes (Broadcom Corporation, Broadcom Corporation NDIS 5.1 ethernet driver)
    0xF8657000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
    0xF8717000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
    0xF8677000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
    0xF8787000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
    0xF8667000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
    0xF774E000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
    0xECBBB000 C:\WINDOWS\System32\DRIVERS\secdrv.sys 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
    0xF87B7000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
    0xF8697000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
    0xF8707000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
    0xF87A7000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
    0xF8897000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
    0xB5D35000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
    0xF86F7000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
    0xF892F000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
    0xF898F000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
    0xF8997000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
    0xF88B7000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
    0xF894F000 C:\WINDOWS\System32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
    0xF88E7000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
    0xF89B7000 C:\WINDOWS\System32\Drivers\mmc_2K.SYS 24576 bytes (Roxio, CD-R/RW AddOn MMC Driver (W2K))
    0xF89BF000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
    0xF8987000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
    0xF890F000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
    0xF8A07000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
    0xF891F000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
    0xF89AF000 C:\WINDOWS\System32\DRIVERS\omci.sys 20480 bytes (Dell Computer Corporation, OMCI Device Driver)
    0xF88BF000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
    0xF899F000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
    0xF89A7000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
    0xF8917000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
    0xB72C8000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
    0xF78BB000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
    0xF8430000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
    0xF8A47000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
    0xB72E4000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
    0xF8AFF000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
    0xF842C000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
    0xF8B13000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
    0xF8B1B000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)
    0xF8B73000 C:\WINDOWS\system32\drivers\aeaudio.sys 8192 bytes (Andrea Electronics Corporation, Andrea Audio Stub Driver)
    0xF8BA7000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
    0xF8BBD000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
    0xF8BA5000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
    0xF8B37000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
    0xF8BA9000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
    0xB6FCE000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
    0xF8BAB000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
    0xF8B75000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
    0xF8B81000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
    0xF8B39000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
    0xF8CFF000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
    0xF8D89000 C:\WINDOWS\System32\Drivers\BANTExt.sys 4096 bytes
    0xF8C0F000 C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS 4096 bytes (Sonic Solutions, CDR4 CD and DVD Place Holder Driver (see PxHelp))
    0xF8C14000 C:\WINDOWS\System32\Drivers\Cdralw2k.SYS 4096 bytes (Sonic Solutions, CDRAL Place Holder Driver (see PxHelp))
    0xEBE2E000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
    0xF8C16000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
    0xF8BFF000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
    ==============================================
    >Stealth
    ==============================================
    WARNING: Virus alike driver modification [ADPU160M.SYS]
    WARNING: Virus alike driver modification [hsfdpsp2.sys]
    WARNING: Virus alike driver modification [atinrvxx.sys]
    WARNING: Virus alike driver modification [a308.sys]
    WARNING: Virus alike driver modification [a312.sys]
    0x832A9F92 Unknown page with executable code, 110 bytes
    WARNING: Virus alike driver modification [wadv08nt.sys]
    WARNING: Virus alike driver modification [a302.sys]
    WARNING: Virus alike driver modification [a305.sys]
    WARNING: Virus alike driver modification [ati1mdxx.sys]
    WARNING: Virus alike driver modification [ACPIEC.SYS]
    WARNING: Virus alike driver modification [wadv05nt.sys]
    WARNING: Virus alike driver modification [CPQDAP01.SYS]
    WARNING: Virus alike driver modification [wadv07nt.sys]
    WARNING: Virus alike driver modification [mdmxsdk.sys]
    WARNING: Virus alike driver modification [wadv09nt.sys]
    WARNING: Virus alike driver modification [wadv11nt.sys]
    WARNING: Virus alike driver modification [AMSINT.SYS]
    WARNING: Virus alike driver modification [NIKEDRV.SYS]
    WARNING: Virus alike driver modification [RIO8DRV.SYS]
    WARNING: Virus alike driver modification [RIODRV.SYS]
    WARNING: Virus alike driver modification [WS2IFSL.SYS]
    WARNING: Virus alike driver modification [ati1pdxx.sys]
    WARNING: Virus alike driver modification [wsiintxx.sys]
    WARNING: Virus alike driver modification [wadv02nt.sys]
    WARNING: Virus alike driver modification [FSVGA.SYS]
    WARNING: Virus alike driver modification [wadv01nt.sys]
    WARNING: Virus alike driver modification [NWLNKFLT.SYS]
    WARNING: Virus alike driver modification [FTDISK.SYS]
    WARNING: Virus alike driver modification [mtlmnt5.sys]
    WARNING: Virus alike driver modification [AHA154X.SYS]
    WARNING: Virus alike driver modification [slnt7554.sys]
    WARNING: Virus alike driver modification [mtlstrm.sys]
    WARNING: Virus alike driver modification [slwdmsup.sys]
    WARNING: Virus alike driver modification [recagent.sys]
    WARNING: Virus alike driver modification [atinmdxx.sys]
    WARNING: Virus alike driver modification [atinttxx.sys]
    WARNING: Virus alike driver modification [CBIDF2K.SYS]
    WARNING: Virus alike driver modification [atinpdxx.sys]
    WARNING: Virus alike driver modification [SMCLIB.SYS]
    WARNING: Virus alike driver modification [DAC960NT.SYS]
    WARNING: Virus alike driver modification [ASC3550.SYS]
    WARNING: Virus alike driver modification [CPQARRAY.SYS]
    WARNING: Virus alike driver modification [INI910U.SYS]
    WARNING: Virus alike driver modification [i81xnt5.sys]
    WARNING: Virus alike driver modification [MODEMCSA.sys]
    WARNING: Virus alike driver modification [SYMC810.SYS]
    WARNING: Virus alike driver modification [a306.sys]
    WARNING: Virus alike driver modification [s3gnbm.sys]
    WARNING: Virus alike driver modification [MRAID35X.SYS]
    WARNING: Virus alike driver modification [a314.sys]
    WARNING: Virus alike driver modification [gt680x.sys]
    WARNING: Virus alike driver modification [DAC2W2K.SYS]
    WARNING: Virus alike driver modification [ntmtlfax.sys]
    WARNING: Virus alike driver modification [nv4_mini.sys]
    WARNING: Virus alike driver modification [SPARROW.SYS]
    WARNING: Virus alike driver modification [wvchntxx.sys]
    WARNING: Virus alike driver modification [watv02nt.sys]
    WARNING: Virus alike driver modification [vch.sys]
    WARNING: Virus alike driver modification [DPTI2O.SYS]
    WARNING: Virus alike driver modification [a307.sys]
    WARNING: Virus alike driver modification [ati1ttxx.sys]
    WARNING: Virus alike driver modification [TSBVCAP.SYS]
    0x832A5773 Unknown page with executable code, 2189 bytes
    WARNING: Virus alike driver modification [hsfbs2s2.sys]
    WARNING: Virus alike driver modification [watv06nt.sys]
    WARNING: Virus alike driver modification [ASC3350P.SYS]
    WARNING: Virus alike driver modification [ABP480N5.SYS]
    WARNING: Virus alike driver modification [TVICHW32.SYS]
    WARNING: Virus alike driver modification [wch7xxnt.sys]
    0x832A86A6 Unknown page with executable code, 2394 bytes
    WARNING: Virus alike driver modification [Dvd_2k.sys]
    0x832AA64C Unknown page with executable code, 2484 bytes
    WARNING: Virus alike driver modification [watv10nt.sys]
    WARNING: Virus alike driver modification [a309.sys]
    WARNING: Virus alike driver modification [HPN.SYS]
    WARNING: Virus alike driver modification [CINEMST2.SYS]
    WARNING: Virus alike driver modification [ati1snxx.sys]
    WARNING: Virus alike driver modification [ASC.SYS]
    WARNING: Virus alike driver modification [PERC2.SYS]
    WARNING: Virus alike driver modification [a303.sys]
    WARNING: Virus alike driver modification [SYM_HI.SYS]
    WARNING: Virus alike driver modification [atinsnxx.sys]
    WARNING: Virus alike driver modification [watv01nt.sys]
    WARNING: Virus alike driver modification [ati1xbxx.sys]
    WARNING: Virus alike driver modification [ati1raxx.sys]
    WARNING: Virus alike driver modification [SYM_U3.SYS]
    WARNING: Virus alike driver modification [wa301a.sys]
    WARNING: Virus alike driver modification [wa301b.sys]
    WARNING: Virus alike driver modification [ATMEPVC.SYS]
    WARNING: Virus alike driver modification [atinxbxx.sys]
    WARNING: Virus alike driver modification [a311.sys]
    WARNING: Virus alike driver modification [wdfldr.sys]
    WARNING: Virus alike driver modification [NWLNKFWD.SYS]
    WARNING: Virus alike driver modification [SYMC8XX.SYS]
    WARNING: Virus alike driver modification [ati2mtaa.sys]
    WARNING: Virus alike driver modification [a310.sys]
    WARNING: Virus alike driver modification [IPFLTDRV.SYS]
    WARNING: Virus alike driver modification [QL10WNT.SYS]
    WARNING: Virus alike driver modification [watv04nt.sys]
    0x832A82D2 Unknown page with executable code, 3374 bytes
    WARNING: Virus alike driver modification [RAWWAN.SYS]
    0x832A4288 Unknown page with executable code, 3448 bytes
    WARNING: Virus alike driver modification [MrtRate.sys]
    WARNING: Virus alike driver modification [ati1xsxx.sys]
    WARNING: Virus alike driver modification [ATMUNI.SYS]
    WARNING: Virus alike driver modification [a313.sys]
    0x832A81F3 Unknown page with executable code, 3597 bytes
    WARNING: Virus alike driver modification [ati1tuxx.sys]
    WARNING: Virus alike driver modification [ULTRA.SYS]
    WARNING: Virus alike driver modification [wpdusb.sys]
    0x832AA0F2 Unknown page with executable code, 3854 bytes
    WARNING: Virus alike driver modification [QL1080.SYS]
    WARNING: Virus alike driver modification [QL1240.SYS]
    WARNING: Virus alike driver modification [slntamr.sys]
    WARNING: Virus alike driver modification [bcm4sbxp.sys]
    WARNING: Virus alike driver modification [bvrp_pci.sys]
    WARNING: Virus alike driver modification [a304.sys]
    WARNING: Virus alike driver modification [mtxparhm.sys]
    WARNING: Virus alike driver modification [QL12160.SYS]
    WARNING: Virus alike driver modification [QL1280.SYS]
    WARNING: Virus alike driver modification [wdf01000.sys]
    WARNING: Virus alike driver modification [TOSIDE.SYS]
    WARNING: Virus alike driver modification [TOSDVD.SYS]
    WARNING: Virus alike driver modification [atinraxx.sys]
    WARNING: Virus alike driver modification [ALIIDE.SYS]
    0xF8687000 WARNING: Virus alike driver modification [VolSnap.sys], 53248 bytes
    WARNING: Virus alike driver modification [PERC2HIB.SYS]
    WARNING: Virus alike driver modification [AIC78U2.SYS]
    WARNING: Virus alike driver modification [NWLNKSPX.SYS]
    WARNING: Virus alike driver modification [ati1btxx.sys]
    WARNING: Virus alike driver modification [AIC78XX.SYS]
    WARNING: Virus alike driver modification [atinbtxx.sys]
    WARNING: Virus alike driver modification [VDMINDVD.SYS]
    WARNING: Virus alike driver modification [DMLOAD.SYS]
    WARNING: Virus alike driver modification [ROOTMDM.SYS]
    0x832A8A05 Unknown thread object [ ETHREAD 0x833A9DA8 ] TID: 124, 600 bytes
    0x832AAA36 Unknown thread object [ ETHREAD 0x833A9B30 ] TID: 128, 600 bytes
    0x832A85DB Unknown thread object [ ETHREAD 0x833A98B8 ] , 600 bytes
    WARNING: Virus alike driver modification [BASFND.sys]
    WARNING: Virus alike driver modification [NWLNKNB.SYS]
    WARNING: Virus alike driver modification [atinxsxx.sys]
    WARNING: Virus alike driver modification [ati1rvxx.sys]
    WARNING: Virus alike driver modification [CMDIDE.SYS]
    WARNING: Virus alike driver modification [EL90XBC5.SYS]
    WARNING: Virus alike driver modification [serscan.sys]
    WARNING: Virus alike driver modification [hsfcxts2.sys]
    WARNING: Virus alike driver modification [ati2mtag.sys]
    WARNING: Virus alike driver modification [atintuxx.sys]
    WARNING: Virus alike driver modification [CD20XRNT.SYS]
    WARNING: Virus alike driver modification [MCD.SYS]
    WARNING: Virus alike driver modification [WudfPf.sys]
    WARNING: Virus alike driver modification [WudfRd.sys]
    WARNING: Virus alike driver modification [BCMDM.sys]
    WARNING: Virus alike driver modification [slnthal.sys]
     
  8. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  9. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok I downloaded that, unzipped it, and attempted to open, but it simply will not open! I even tried in safe mode, but no luck.
     
  10. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  11. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok, had difficulty getting this to run to but finally did. Then it ran (took over 20 min) and when it was almost done, the screen saved kicked in and locked it up so I ran it again. It did tell me, the first time, that there was some special threat and it had to reboot. When I ran it the second time, it didn't give that same error but ran all the way through.

    ComboFix 11-01-31.02 - Kimberly 02/02/2011 19:26:12.4.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.198 [GMT -6:00]
    Running from: c:\documents and settings\Kimberly\Desktop\ComboFix.exe
    AV: Defender Pro Internet Security *Disabled/Outdated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Defender Pro Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Application Data\j3HYnZW8zK.exe
    c:\documents and settings\Kimberly\System
    c:\documents and settings\Kimberly\System\win_qs8.jqx
    c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
    c:\windows\system32\n.bat
    c:\windows\system32\Temp

    Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
    Restored copy from - Kitty had a snack :p
    .
    ((((((((((((((((((((((((( Files Created from 2011-01-03 to 2011-02-03 )))))))))))))))))))))))))))))))
    .

    2011-02-02 18:39 . 2011-02-02 18:39 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2011-02-02 16:18 . 2010-12-21 00:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-02 16:18 . 2010-12-21 00:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-02 16:18 . 2011-02-02 16:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-01-15 22:55 . 2011-02-02 02:42 -------- d-----w- c:\documents and settings\All Users\Application Data\WeCareReminder

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-09 23:38 . 2010-12-09 23:38 132560 ----a-r- c:\windows\system32\IS3HTUI5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 546256 ----a-r- c:\windows\system32\SZComp5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 452048 ----a-r- c:\windows\system32\SZBase5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 398800 ----a-r- c:\windows\system32\IS3DBA5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 28624 ----a-r- c:\windows\system32\IS3XDat5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 22992 ----a-r- c:\windows\system32\SZIO5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 99792 ----a-r- c:\windows\system32\IS3Svc5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 99792 ----a-r- c:\windows\system32\IS3Inet5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 67024 ----a-r- c:\windows\system32\IS3Hks5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 390608 ----a-r- c:\windows\system32\IS3UI5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 738768 ----a-r- c:\windows\system32\IS3Base5.dll
    2010-12-09 23:38 . 2010-12-09 23:38 230864 ----a-r- c:\windows\system32\IS3Win325.dll
    2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-18 18:12 . 2002-08-29 11:00 81920 ----a-w- c:\windows\system32\isign32.dll
    2010-11-09 14:52 . 2003-10-28 03:09 249856 ----a-w- c:\windows\system32\odbc32.dll
    2010-11-06 00:26 . 2005-02-15 13:37 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-11-06 00:26 . 2002-08-29 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-11-06 00:26 . 2002-08-29 11:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

    [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    2010-05-26 20:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 57344]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-24 202256]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
    "Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-11-19 193880]
    "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-20 32881]
    "IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-13 155648]
    "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-13 114688]
    "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]

    c:\documents and settings\Kimberly\Start Menu\Programs\Accessories\Startup\
    mary kay personal beauty profiler.lnk - c:\program files\mary kay personal beauty profiler\mary kay personal beauty profiler.exe [2010-9-17 142336]
    V CAST Media Monitor.lnk - c:\program files\V CAST Media Manager\MEMonitor.exe [2010-7-30 2991464]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0PFDNNT c:\documents and settings\KIMBERLY\LOCAL SETTINGS\TEMP\CFOUT.TXT\0PFDNNT c:\program files\COMMON FILES\BTLINK\BTLINK.DLL\0PFDNNT c:\program files\Common Files\BTLINK\0PFDNNT c:\windows\SYSTEM32\LMD.BIN\0PFDNNT c:\windows\SYSTEM32\SB.HTM\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\SYSTEM32\STLB2.XML\0PFDNNT c:\windows\TEMP\BW2.COM\0PFDNNT c:\windows\TEMP\BW2.COM\0PFDNNT c:\windows\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL\0PFDNNT c:\windows\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL\0PFDNNT c:\windows\SYSTEM32\DRIVERS\ETC\HOSTS.BHO\0PFDNNT c:\documents and settings\KIMBERLY\LOCAL SETTINGS\TEMPORARY INTERNET FILES\SSK.LOG\0PFDNNT c:\windows\DRSMARTLOAD2.DAT\0PFDNNT c:\windows\GATORPATCH.LOG\0PFDNNT c:\windows\GATORPATCH.LOG\0PFDNNT c:\windows\DOWNLOADED PROGRAM FILES\WEBP2PINSTALLER.DLL\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\system32\IEDriver\0SsiEfr.e

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
    backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Watch.lnk]
    backup=c:\windows\pss\Watch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
    backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bart Station

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\FrostWire\\FrostWire.exe"=
    "c:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=

    R0 szkg5;szkg5;c:\windows\SYSTEM32\DRIVERS\SZKG.sys [12/7/2009 4:59 PM 61328]
    S0 is3srv;is3srv;c:\windows\SYSTEM32\DRIVERS\is3srv.sys [12/7/2009 4:59 PM 61328]
    S3 AgilentUSBCam;E-Video DC-350 USB Camera;c:\windows\system32\DRIVERS\Atusbcam.sys --> c:\windows\system32\DRIVERS\Atusbcam.sys [?]
    S3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?]
    S3 iscFlash;iscFlash;\??\c:\windows\SYSTEM32\DRIVERS\iscflash.sys --> c:\windows\SYSTEM32\DRIVERS\iscflash.sys [?]
    S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\SYSTEM32\DRIVERS\NwUsbCdFil.sys [8/16/2007 2:24 PM 13824]
    S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\SYSTEM32\DRIVERS\nwusbser2.sys [8/16/2007 2:24 PM 99200]
    S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
    S3 QATMARPC;QATMARPC;\??\c:\docume~1\Kimberly\LOCALS~1\Temp\QATMARPC.SYS --> c:\docume~1\Kimberly\LOCALS~1\Temp\QATMARPC.SYS [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-14 05:55]

    2011-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-14 05:55]

    2011-02-03 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]

    2011-02-03 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3449698256-4290693082-1258896976-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2011-02-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3449698256-4290693082-1258896976-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2011-02-03 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
    - c:\program files\Ask.com\UpdateTask.exe [2010-05-26 20:23]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.titanbank.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    IE: c:\progra~1\COMMON~1\BTLINK\btlink.dll//iemenu
    Trusted Zone: west.com
    Trusted Zone: westathome.com
    Trusted Zone: westathome.net
    Trusted Zone: westathomeagent.net
    Trusted Zone: workathomeagent.net
    DPF: DirectAnimation Java Classes
    DPF: Microsoft XML Parser for Java
    FF - ProfilePath - c:\documents and settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.hotmail.com
    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
    FF - prefs.js: network.proxy.type - 4
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    .
    - - - - ORPHANS REMOVED - - - -

    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    Toolbar-SITEguard - (no file)
    WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    Notify-= - (no file)
    Notify-TPSvc - TPSvc.dll
    AddRemove-Octoshape add-in for Adobe Flash Player - c:\documents and settings\Kimberly\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-02 19:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_LOCAL_MACHINE\software\Classes\AppID\Keyhole.EXE]
    @Denied: (Full) (Administrators)
    @Denied: (Full) (S-1-5-21-3449698256-4290693082-1258896976-1006)
    @Denied: (Full) (RestrictedCode)
    @Denied: (Full) (LocalSystem)
    @Denied: (Full) (Users)
    @=""

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7005dc00-91f9-4fb4-8b85-d3738aa9e2f8}]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2011-02-02 19:47:09
    ComboFix-quarantined-files.txt 2011-02-03 01:46
    ComboFix2.txt 2009-12-11 20:39

    Pre-Run: 22,186,881,024 bytes free
    Post-Run: 22,120,771,584 bytes free

    Current=4 Default=4 Failed=2 LastKnownGood=3 Sets=1,2,3,4
    - - End Of File - - B8B671738DD569854CCED28746BB4A5E
     
  12. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Good job :)

    Uninstall Stopzilla, rather shady kind of program.

    Uninstall Ask Toolbar, known foistware.

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    SecCenter::
    {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    
    
    File::
    c:\docume~1\Kimberly\LOCALS~1\Temp\QATMARPC.SYS
    
    Driver::
    QATMARPC
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000000
    "FirewallOverride"=dword:00000000
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"=dword:00000001
    
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  13. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok, here's the new combofix log. This one still took awhile.

    I have to work all day today so it will be awhile before I can do any more work on this.

    Stopzilla was recommended to me last year so I tried it, do you recommend a certain virus protection?

    ComboFix 11-01-31.02 - Kimberly 02/03/2011 8:52.5.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.249 [GMT -6:00]
    Running from: c:\documents and settings\Kimberly\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Kimberly\Desktop\CFScript.txt

    FILE ::
    "c:\docume~1\Kimberly\LOCALS~1\Temp\QATMARPC.SYS"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\feed.txt
    c:\program files\Mozilla Firefox\components\npclntax.xpt
    c:\windows\system32\Thumbs.db

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_QATMARPC


    ((((((((((((((((((((((((( Files Created from 2011-01-03 to 2011-02-03 )))))))))))))))))))))))))))))))
    .

    2011-02-02 18:39 . 2011-02-02 18:39 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2011-02-02 16:18 . 2010-12-21 00:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-02 16:18 . 2010-12-21 00:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-02 16:18 . 2011-02-02 16:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-01-15 22:55 . 2011-02-02 02:42 -------- d-----w- c:\documents and settings\All Users\Application Data\WeCareReminder

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-18 18:12 . 2002-08-29 11:00 81920 ----a-w- c:\windows\system32\isign32.dll
    2010-11-09 14:52 . 2003-10-28 03:09 249856 ----a-w- c:\windows\system32\odbc32.dll
    2010-11-06 00:26 . 2005-02-15 13:37 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-11-06 00:26 . 2002-08-29 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-11-06 00:26 . 2002-08-29 11:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 57344]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-24 202256]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
    "Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-11-19 193880]
    "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-20 32881]
    "IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-13 155648]
    "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-13 114688]
    "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]

    c:\documents and settings\Kimberly\Start Menu\Programs\Accessories\Startup\
    mary kay personal beauty profiler.lnk - c:\program files\mary kay personal beauty profiler\mary kay personal beauty profiler.exe [2010-9-17 142336]
    V CAST Media Monitor.lnk - c:\program files\V CAST Media Manager\MEMonitor.exe [2010-7-30 2991464]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TPSvc]
    TPSvc.dll [BU]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0PFDNNT c:\documents and settings\KIMBERLY\LOCAL SETTINGS\TEMP\CFOUT.TXT\0PFDNNT c:\program files\COMMON FILES\BTLINK\BTLINK.DLL\0PFDNNT c:\program files\Common Files\BTLINK\0PFDNNT c:\windows\SYSTEM32\LMD.BIN\0PFDNNT c:\windows\SYSTEM32\SB.HTM\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\SYSTEM32\STLB2.XML\0PFDNNT c:\windows\TEMP\BW2.COM\0PFDNNT c:\windows\TEMP\BW2.COM\0PFDNNT c:\windows\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL\0PFDNNT c:\windows\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL\0PFDNNT c:\windows\SYSTEM32\DRIVERS\ETC\HOSTS.BHO\0PFDNNT c:\documents and settings\KIMBERLY\LOCAL SETTINGS\TEMPORARY INTERNET FILES\SSK.LOG\0PFDNNT c:\windows\DRSMARTLOAD2.DAT\0PFDNNT c:\windows\GATORPATCH.LOG\0PFDNNT c:\windows\GATORPATCH.LOG\0PFDNNT c:\windows\DOWNLOADED PROGRAM FILES\WEBP2PINSTALLER.DLL\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\system32\IEDriver\0PFDNNT c:\windows\system32\IEDriver\0SsiEfr.e

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
    backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Watch.lnk]
    backup=c:\windows\pss\Watch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
    backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\FrostWire\\FrostWire.exe"=
    "c:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=

    S3 AgilentUSBCam;E-Video DC-350 USB Camera;c:\windows\system32\DRIVERS\Atusbcam.sys --> c:\windows\system32\DRIVERS\Atusbcam.sys [?]
    S3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?]
    S3 iscFlash;iscFlash;\??\c:\windows\SYSTEM32\DRIVERS\iscflash.sys --> c:\windows\SYSTEM32\DRIVERS\iscflash.sys [?]
    S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\SYSTEM32\DRIVERS\NwUsbCdFil.sys [8/16/2007 2:24 PM 13824]
    S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\SYSTEM32\DRIVERS\nwusbser2.sys [8/16/2007 2:24 PM 99200]
    S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-14 05:55]

    2011-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-14 05:55]

    2011-02-03 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]

    2011-02-03 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3449698256-4290693082-1258896976-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

    2011-02-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3449698256-4290693082-1258896976-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.titanbank.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    IE: c:\progra~1\COMMON~1\BTLINK\btlink.dll//iemenu
    Trusted Zone: west.com
    Trusted Zone: westathome.com
    Trusted Zone: westathome.net
    Trusted Zone: westathomeagent.net
    Trusted Zone: workathomeagent.net
    DPF: DirectAnimation Java Classes
    DPF: Microsoft XML Parser for Java
    FF - ProfilePath - c:\documents and settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.hotmail.com
    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
    FF - prefs.js: network.proxy.type - 4
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    Notify-= - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-03 09:26
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_LOCAL_MACHINE\software\Classes\AppID\Keyhole.EXE]
    @Denied: (Full) (Administrators)
    @Denied: (Full) (S-1-5-21-3449698256-4290693082-1258896976-1006)
    @Denied: (Full) (RestrictedCode)
    @Denied: (Full) (LocalSystem)
    @Denied: (Full) (Users)
    @=""

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7005dc00-91f9-4fb4-8b85-d3738aa9e2f8}]
    @Denied: (Full) (Everyone)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(4000)
    c:\windows\system32\WININET.dll
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Windows Defender\MsMpEng.exe
    c:\program files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe
    c:\program files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
    c:\windows\BCMSMMSG.exe
    .
    **************************************************************************
    .
    Completion time: 2011-02-03 09:40:56 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-02-03 15:40
    ComboFix2.txt 2011-02-03 01:47
    ComboFix3.txt 2009-12-11 20:39

    Pre-Run: 22,029,205,504 bytes free
    Post-Run: 21,977,858,048 bytes free

    Current=4 Default=4 Failed=2 LastKnownGood=3 Sets=1,2,3,4
    - - End Of File - - 6D415222288F57CB911629273B6C45E7
     
  14. Broni

    Broni Malware Annihilator Posts: 52,898   +344

  15. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok, just did some random google searches and no redirect. Thank goodness! And yes, TDDS did run this time. Posting the log. Oh and I downloaded Avast - never heard of it before, but hoping its better! :)

    2011/02/04 00:03:42.0187 3352 TDSS rootkit removing tool 2.4.16.0 Feb 1 2011 10:34:03
    2011/02/04 00:03:42.0500 3352 ================================================================================
    2011/02/04 00:03:42.0500 3352 SystemInfo:
    2011/02/04 00:03:42.0500 3352
    2011/02/04 00:03:42.0500 3352 OS Version: 5.1.2600 ServicePack: 3.0
    2011/02/04 00:03:42.0500 3352 Product type: Workstation
    2011/02/04 00:03:42.0500 3352 ComputerName: KIMMIE
    2011/02/04 00:03:42.0500 3352 UserName: Kimberly
    2011/02/04 00:03:42.0500 3352 Windows directory: C:\WINDOWS
    2011/02/04 00:03:42.0500 3352 System windows directory: C:\WINDOWS
    2011/02/04 00:03:42.0500 3352 Processor architecture: Intel x86
    2011/02/04 00:03:42.0500 3352 Number of processors: 1
    2011/02/04 00:03:42.0500 3352 Page size: 0x1000
    2011/02/04 00:03:42.0500 3352 Boot type: Normal boot
    2011/02/04 00:03:42.0500 3352 ================================================================================
    2011/02/04 00:03:43.0593 3352 Initialize success
    2011/02/04 00:03:55.0031 3452 ================================================================================
    2011/02/04 00:03:55.0031 3452 Scan started
    2011/02/04 00:03:55.0031 3452 Mode: Manual;
    2011/02/04 00:03:55.0031 3452 ================================================================================
    2011/02/04 00:04:01.0359 3452 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS
    2011/02/04 00:04:01.0937 3452 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/02/04 00:04:02.0406 3452 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2011/02/04 00:04:02.0859 3452 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys
    2011/02/04 00:04:03.0359 3452 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
    2011/02/04 00:04:03.0843 3452 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2011/02/04 00:04:04.0390 3452 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
    2011/02/04 00:04:05.0203 3452 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\System32\DRIVERS\agp440.sys
    2011/02/04 00:04:05.0640 3452 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
    2011/02/04 00:04:06.0125 3452 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys
    2011/02/04 00:04:06.0578 3452 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys
    2011/02/04 00:04:07.0031 3452 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys
    2011/02/04 00:04:07.0468 3452 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys
    2011/02/04 00:04:07.0890 3452 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\System32\DRIVERS\alim1541.sys
    2011/02/04 00:04:08.0390 3452 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\System32\DRIVERS\amdagp.sys
    2011/02/04 00:04:08.0843 3452 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys
    2011/02/04 00:04:09.0328 3452 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys
    2011/02/04 00:04:09.0796 3452 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys
    2011/02/04 00:04:10.0218 3452 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys
    2011/02/04 00:04:10.0625 3452 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/02/04 00:04:11.0078 3452 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/02/04 00:04:11.0890 3452 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/02/04 00:04:12.0390 3452 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/02/04 00:04:12.0781 3452 BANTExt (5d7be7b19e827125e016325334e58ff1) C:\WINDOWS\System32\Drivers\BANTExt.sys
    2011/02/04 00:04:13.0640 3452 bcm4sbxp (f5c0d3c93235a455cdd13c954adf1a80) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
    2011/02/04 00:04:14.0468 3452 BCMModem (41347688046d49cde0f6d138a534f73d) C:\WINDOWS\system32\DRIVERS\BCMSM.sys
    2011/02/04 00:04:15.0343 3452 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/02/04 00:04:15.0781 3452 bvrp_pci (73458867c8963c76260c18d7bdb15625) C:\WINDOWS\system32\drivers\bvrp_pci.sys
    2011/02/04 00:04:16.0218 3452 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys
    2011/02/04 00:04:16.0578 3452 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/02/04 00:04:16.0953 3452 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2011/02/04 00:04:17.0359 3452 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys
    2011/02/04 00:04:17.0781 3452 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/02/04 00:04:18.0375 3452 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/02/04 00:04:18.0843 3452 Cdr4_xp (837eef65af62d4e8a37c41d3879f7274) C:\WINDOWS\system32\drivers\Cdr4_xp.sys
    2011/02/04 00:04:19.0281 3452 Cdralw2k (579da2f9f5401f55dae2cf8779d61dfc) C:\WINDOWS\system32\drivers\Cdralw2k.sys
    2011/02/04 00:04:19.0703 3452 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/02/04 00:04:20.0218 3452 cdudf_xp (072070a498d5fad70c3a99a5f0b1331b) C:\WINDOWS\system32\drivers\cdudf_xp.sys
    2011/02/04 00:04:21.0421 3452 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\System32\DRIVERS\cmdide.sys
    2011/02/04 00:04:21.0890 3452 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys
    2011/02/04 00:04:22.0343 3452 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys
    2011/02/04 00:04:22.0796 3452 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys
    2011/02/04 00:04:23.0328 3452 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/02/04 00:04:24.0046 3452 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/02/04 00:04:24.0812 3452 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
    2011/02/04 00:04:25.0281 3452 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/02/04 00:04:25.0687 3452 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/02/04 00:04:26.0140 3452 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys
    2011/02/04 00:04:26.0578 3452 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/02/04 00:04:27.0000 3452 dvd_2K (a3997baab606caa92f27e07bc4f070f0) C:\WINDOWS\system32\drivers\dvd_2K.sys
    2011/02/04 00:04:27.0468 3452 EL90XBC (6e883bf518296a40959131c2304af714) C:\WINDOWS\system32\DRIVERS\el90xbc5.sys
    2011/02/04 00:04:28.0000 3452 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/02/04 00:04:28.0484 3452 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/02/04 00:04:28.0937 3452 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    2011/02/04 00:04:29.0375 3452 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2011/02/04 00:04:29.0828 3452 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2011/02/04 00:04:30.0296 3452 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/02/04 00:04:30.0734 3452 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/02/04 00:04:31.0187 3452 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/02/04 00:04:31.0640 3452 GT680x (3ed7c522c3361b7f3dd9ae12fb0ee603) C:\WINDOWS\system32\DRIVERS\GT680x.SYS
    2011/02/04 00:04:32.0109 3452 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2011/02/04 00:04:32.0578 3452 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys
    2011/02/04 00:04:33.0140 3452 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/02/04 00:04:33.0671 3452 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
    2011/02/04 00:04:34.0078 3452 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\System32\DRIVERS\i2omp.sys
    2011/02/04 00:04:34.0531 3452 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/02/04 00:04:35.0000 3452 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys
    2011/02/04 00:04:35.0484 3452 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
    2011/02/04 00:04:35.0906 3452 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
    2011/02/04 00:04:36.0359 3452 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
    2011/02/04 00:04:36.0796 3452 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
    2011/02/04 00:04:37.0218 3452 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
    2011/02/04 00:04:37.0671 3452 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
    2011/02/04 00:04:38.0125 3452 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
    2011/02/04 00:04:38.0953 3452 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
    2011/02/04 00:04:39.0421 3452 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
    2011/02/04 00:04:39.0890 3452 ialm (bf5b9dbbee664f046e85c6b853af47de) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
    2011/02/04 00:04:40.0437 3452 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/02/04 00:04:40.0890 3452 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys
    2011/02/04 00:04:41.0312 3452 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\System32\DRIVERS\intelide.sys
    2011/02/04 00:04:41.0765 3452 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/02/04 00:04:42.0187 3452 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2011/02/04 00:04:42.0640 3452 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2011/02/04 00:04:43.0046 3452 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/02/04 00:04:43.0578 3452 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/02/04 00:04:44.0078 3452 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/02/04 00:04:44.0546 3452 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/02/04 00:04:44.0984 3452 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/02/04 00:04:45.0812 3452 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/02/04 00:04:46.0281 3452 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/02/04 00:04:46.0828 3452 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/02/04 00:04:47.0703 3452 mmc_2K (e97e3fe03b6f271336cb2fbb24734989) C:\WINDOWS\system32\drivers\mmc_2K.sys
    2011/02/04 00:04:48.0140 3452 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/02/04 00:04:48.0640 3452 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    2011/02/04 00:04:49.0046 3452 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
    2011/02/04 00:04:49.0859 3452 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/02/04 00:04:50.0281 3452 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/02/04 00:04:50.0750 3452 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys
    2011/02/04 00:04:51.0234 3452 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/02/04 00:04:51.0906 3452 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/02/04 00:04:52.0484 3452 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/02/04 00:04:52.0906 3452 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/02/04 00:04:53.0312 3452 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/02/04 00:04:53.0750 3452 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/02/04 00:04:54.0171 3452 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/02/04 00:04:54.0593 3452 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
    2011/02/04 00:04:55.0062 3452 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2011/02/04 00:04:55.0593 3452 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2011/02/04 00:04:56.0125 3452 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/02/04 00:04:56.0578 3452 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2011/02/04 00:04:57.0015 3452 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/02/04 00:04:57.0500 3452 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/02/04 00:04:57.0921 3452 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/02/04 00:04:58.0375 3452 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/02/04 00:04:58.0828 3452 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/02/04 00:04:59.0296 3452 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/02/04 00:04:59.0828 3452 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/02/04 00:05:00.0515 3452 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/02/04 00:05:01.0171 3452 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/02/04 00:05:02.0031 3452 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2011/02/04 00:05:03.0031 3452 NWADI (67fb86eeb94059177642050718d57460) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys
    2011/02/04 00:05:03.0609 3452 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/02/04 00:05:04.0015 3452 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/02/04 00:05:04.0468 3452 NWUSBCDFIL (ab2155b8acdf07e63e26c9a0ed07b825) C:\WINDOWS\system32\DRIVERS\NwUsbCdFil.sys
    2011/02/04 00:05:04.0937 3452 NWUSBModem (4e651808b35656ac88a4dcdaf6cc1169) C:\WINDOWS\system32\DRIVERS\nwusbmdm.sys
    2011/02/04 00:05:05.0453 3452 NWUSBPort (4e651808b35656ac88a4dcdaf6cc1169) C:\WINDOWS\system32\DRIVERS\nwusbser.sys
    2011/02/04 00:05:05.0953 3452 NWUSBPort2 (4e651808b35656ac88a4dcdaf6cc1169) C:\WINDOWS\system32\DRIVERS\nwusbser2.sys
    2011/02/04 00:05:06.0421 3452 omci (1d98907d80461371437a7c898c58c8ae) C:\WINDOWS\system32\DRIVERS\omci.sys
    2011/02/04 00:05:06.0875 3452 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys
    2011/02/04 00:05:07.0312 3452 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
    2011/02/04 00:05:07.0718 3452 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/02/04 00:05:08.0109 3452 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/02/04 00:05:08.0875 3452 PCASp50 (1961590aa191b6b7dcf18a6a693af7b8) C:\WINDOWS\system32\Drivers\PCASp50.sys
    2011/02/04 00:05:09.0343 3452 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/02/04 00:05:10.0156 3452 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/02/04 00:05:10.0625 3452 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2011/02/04 00:05:12.0531 3452 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys
    2011/02/04 00:05:12.0968 3452 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys
    2011/02/04 00:05:13.0531 3452 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/02/04 00:05:14.0000 3452 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
    2011/02/04 00:05:14.0484 3452 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/02/04 00:05:14.0921 3452 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/02/04 00:05:15.0375 3452 pwd_2k (070eddd0e4a5be55dd590d8b30dbff22) C:\WINDOWS\system32\drivers\pwd_2k.sys
    2011/02/04 00:05:15.0859 3452 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys
    2011/02/04 00:05:16.0312 3452 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys
    2011/02/04 00:05:16.0812 3452 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\System32\DRIVERS\ql12160.sys
    2011/02/04 00:05:17.0265 3452 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys
    2011/02/04 00:05:17.0718 3452 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys
    2011/02/04 00:05:18.0109 3452 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/02/04 00:05:18.0562 3452 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/02/04 00:05:19.0031 3452 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/02/04 00:05:19.0421 3452 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/02/04 00:05:20.0000 3452 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/02/04 00:05:20.0484 3452 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/02/04 00:05:20.0953 3452 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/02/04 00:05:21.0500 3452 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/02/04 00:05:22.0015 3452 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/02/04 00:05:22.0500 3452 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
    2011/02/04 00:05:22.0937 3452 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
    2011/02/04 00:05:23.0796 3452 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/02/04 00:05:24.0250 3452 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2011/02/04 00:05:24.0703 3452 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
    2011/02/04 00:05:25.0187 3452 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2011/02/04 00:05:26.0031 3452 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\System32\DRIVERS\sisagp.sys
    2011/02/04 00:05:26.0468 3452 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2011/02/04 00:05:27.0140 3452 smwdm (8583e3dc5285eb3ddfb74fb646cdf295) C:\WINDOWS\system32\drivers\smwdm.sys
    2011/02/04 00:05:27.0765 3452 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys
    2011/02/04 00:05:28.0203 3452 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2011/02/04 00:05:28.0687 3452 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/02/04 00:05:29.0281 3452 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/02/04 00:05:29.0875 3452 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
    2011/02/04 00:05:30.0312 3452 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2011/02/04 00:05:30.0765 3452 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/02/04 00:05:31.0218 3452 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/02/04 00:05:31.0718 3452 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys
    2011/02/04 00:05:32.0171 3452 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys
    2011/02/04 00:05:32.0625 3452 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys
    2011/02/04 00:05:33.0062 3452 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys
    2011/02/04 00:05:33.0515 3452 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/02/04 00:05:34.0156 3452 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/02/04 00:05:34.0734 3452 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/02/04 00:05:35.0171 3452 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/02/04 00:05:35.0625 3452 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/02/04 00:05:36.0109 3452 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\System32\DRIVERS\toside.sys
    2011/02/04 00:05:36.0562 3452 TVICHW32 (e266683fc95abdec17cd378564e1b54b) C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS
    2011/02/04 00:05:37.0093 3452 UdfReadr_xp (27e66e79fd742c107fdb23280e17d869) C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
    2011/02/04 00:05:37.0625 3452 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/02/04 00:05:38.0078 3452 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys
    2011/02/04 00:05:38.0656 3452 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/02/04 00:05:39.0265 3452 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
    2011/02/04 00:05:39.0734 3452 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/02/04 00:05:40.0515 3452 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/02/04 00:05:41.0000 3452 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/02/04 00:05:41.0468 3452 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
    2011/02/04 00:05:41.0937 3452 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2011/02/04 00:05:42.0375 3452 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2011/02/04 00:05:42.0843 3452 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/02/04 00:05:43.0296 3452 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/02/04 00:05:43.0781 3452 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
    2011/02/04 00:05:44.0234 3452 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2011/02/04 00:05:44.0703 3452 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\System32\DRIVERS\viaagp.sys
    2011/02/04 00:05:45.0171 3452 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\System32\DRIVERS\viaide.sys
    2011/02/04 00:05:45.0625 3452 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/02/04 00:05:46.0140 3452 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/02/04 00:05:46.0718 3452 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    2011/02/04 00:05:47.0625 3452 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/02/04 00:05:48.0218 3452 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
    2011/02/04 00:05:48.0703 3452 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
    2011/02/04 00:05:49.0171 3452 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2011/02/04 00:05:49.0640 3452 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2011/02/04 00:05:50.0140 3452 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    2011/02/04 00:05:50.0656 3452 {6080A529-897E-4629-A488-ABA0C29B635E} (afeffe0f8805fcd47b05cf1fbde08092) C:\WINDOWS\system32\drivers\ialmsbw.sys
    2011/02/04 00:05:51.0171 3452 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (85a36991a5ceaf9e65c4b743210e759b) C:\WINDOWS\system32\drivers\ialmkchw.sys
    2011/02/04 00:05:51.0531 3452 ================================================================================
    2011/02/04 00:05:51.0531 3452 Scan finished
    2011/02/04 00:05:51.0531 3452 ================================================================================
     
  16. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Good news :)

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  17. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Extras....

    ---Extras---

    OTL Extras logfile created on: 2/4/2011 9:02:24 AM - Run 1
    OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Kimberly\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    510.00 Mb Total Physical Memory | 218.00 Mb Available Physical Memory | 43.00% Memory free
    864.00 Mb Paging File | 669.00 Mb Available in Paging File | 77.00% Paging File free
    Paging file location(s): C:\pagefile.sys 384 768 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 55.84 Gb Total Space | 20.15 Gb Free Space | 36.09% Space Free | Partition Type: NTFS

    Computer Name: KIMMIE | User Name: Kimberly | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    [HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Classes\<extension>]
    .exe [@ = exefile] -- Reg Error: Key error. File not found
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
    "DisableMonitoring" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
    "DisableMonitoring" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22002

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe" = C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe:*:Enabled:LeapFrog Connect -- (LeapFrog Enterprises, Inc.)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire -- (FrostWire Group)
    "C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe" = C:\Program Files\LeapFrog\LeapFrog Connect\LeapFrogConnect.exe:*:Enabled:LeapFrog Connect -- (LeapFrog Enterprises, Inc.)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
    "{00120409-78E1-11D2-B60F-006097C998E7}" = Microsoft FrontPage 2000
    "{02FB3E48-4459-4986-BBE5-945B063B1E58}" = Help 2.0
    "{08DEC21F-F7E5-46F9-81D1-3ED30BD3AEC9}" = CASIO USB Driver V1.2.2474.0623
    "{0CE5F45E-F6CC-4638-B0DD-BB7F6EF56713}" = HP Deskjet D1500 Printer Driver Software 10.0 Rel .3
    "{0DB93918-2A77-11D3-805A-00C04FA329AA}" = Word in Works Suite add-in
    "{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
    "{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
    "{121634B0-2F4A-11D3-ADA3-00C04F52DD53}" = Windows Installer Clean Up
    "{143439E9-658B-4C22-86D1-59D1F70F1ABD}" = Sprint Mobile Broadband (Novatel Wireless)
    "{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{26502D04-57B1-4A2D-8D5D-9DE36FC99355}" = Mobile Broadband Generic Drivers
    "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 15
    "{29D88826-2AB9-11D5-8854-00902761A46D}" = WordPerfect Office 2002
    "{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D
    "{305468A6-DE2D-43ba-A168-2F45A97A89DA}" = DJ_SF_03_D1500_Software_Min
    "{31C2F32D-C5DD-4583-8181-B48591CA231C}" = RapidPlayer v5.0 ActiveX Control
    "{3248F0A8-6813-11D6-A77B-00B0D0150030}" = J2SE Runtime Environment 5.0 Update 3
    "{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
    "{37888B36-58B5-41C6-BE67-B846BB4809FF}" = iS3 STOPzilla Toolbar
    "{3A05B900-A3E7-11DE-A9B7-005056806466}" = Google Earth
    "{468190DA-FB4C-45BA-8E40-4B165FF1A939}" = BACS
    "{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
    "{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
    "{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
    "{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
    "{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
    "{56364334-9530-11D2-BFFC-00C04FA329AA}" = Microsoft Works 2000
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
    "{5D51C5DC-3604-4C3B-981B-309340755447}" = Pantech Handset Driver
    "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
    "{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
    "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
    "{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
    "{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
    "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics Driver
    "{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
    "{8B8240B3-891D-4965-AA51-8799622D44FF}" = DJ_SF_03_D1500_ProductContext
    "{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
    "{90D55A3F-1D99-4C94-A77E-46DC14F0BF08}" = Help and Support Customization
    "{911A0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Outlook 2002
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
    "{AC388C78-2619-452C-BFBE-FABCC3194387}" = Microsoft Office Live Meeting 2007
    "{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
    "{B1421599-A42D-47ef-B512-B9B0317BD599}" = DJ_SF_03_D1500_Software
    "{B2460671-BD25-4C1C-ACB7-FBD4967365FE}" = Samsung_I500 1.0
    "{B43357AA-3A6D-4D94-B56E-43C44D09E548}" = Microsoft .NET Framework (English)
    "{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
    "{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
    "{BB51F026-06AC-4F5D-B18C-4E99ED18E477}" = BlackBerry_9330 1.0
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
    "{C6359569-E03E-4CDC-98E8-CDD080C6EEB5}" = LeapFrog Connect
    "{C7D86D8E-8C33-4A42-B401-3BABDB4E91C7}" = VCAST Media Manager Update 1.0.0.1
    "{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
    "{D739E0F5-1E3D-758A-6116-0BDF08AD6570}" = mary kay personal beauty profiler
    "{D9533C0B-C0F6-411E-A264-4033E67B99C4}" = Office Suite 2005
    "{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
    "{E703EE04-8A31-470B-BA16-24D890589917}" = LeapFrog Leapster2 Plugin
    "{E7269FD6-34EA-4617-8752-6739AA384080}" = V CAST Media Manager
    "{E9ED0801-253D-4FE9-AB20-F63DEFE72547}" = SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6
    "{EBB7C1C1-D439-4D9B-9FDC-954C10F266B0}" = Adobe Photoshop Elements 4.0
    "{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
    "{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com
    "{FB068BA4-C6EA-4D47-A491-C40E23E77F89}" = Motorola Driver Installation 3.9.0
    "{FDF64A37-4842-48CD-A424-2C38444D36FD}" = LG Android Drivers
    "8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D" = Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Photoshop Elements 4" = Adobe Photoshop Elements 4.0
    "Adobe Shockwave Player" = Adobe Shockwave Player
    "Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
    "avast5" = avast! Free Antivirus
    "BCM V.92 56K Modem" = BCM V.92 56K Modem
    "Belarc Advisor" = Belarc Advisor 8.1
    "CDKNet" = CDK Players
    "com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
    "EB88B6218325D2AB47CFFBF7170236B60A6198FF" = Windows Driver Package - Microsoft Corporation (usbvideo) Image (05/25/2007 1.0.3656.0)
    "FrostWire" = FrostWire 4.21.3
    "HP Imaging Device Functions" = HP Imaging Device Functions 10.0
    "HP Photosmart Essential" = HP Photosmart Essential 2.5
    "HP Smart Web Printing" = HP Smart Web Printing
    "HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
    "HPExtendedCapabilities" = HP Customer Participation Program 10.0
    "ie8" = Windows Internet Explorer 8
    "Image Composer" = Microsoft Image Composer 1.5
    "InstallShield_{468190DA-FB4C-45BA-8E40-4B165FF1A939}" = Broadcom Advanced Control Suite
    "InstallShield_{E9ED0801-253D-4FE9-AB20-F63DEFE72547}" = SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6
    "LAME for Audacity_is1" = LAME v3.98.2 for Audacity
    "Leapster2Plugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin)
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Mary Kay Career Cars" = Mary Kay Career Cars Screen Saver
    "mary.kay.personal.beauty.profiler.477.73ACE317F4A7B83CB919AF282FBA5D3D96899CDE.1" = mary kay personal beauty profiler
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework Full v1.0.3705 (1033)" = Microsoft .NET Framework (English) v1.0.3705
    "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "Need4 3GP Converter 7" = Need4 3GP Converter 7
    "Need4 Software Launcher" = Need4 Software Launcher 7.1
    "Ogg Codecs" = Ogg Codecs 0.81.15562
    "RealPlayer 12.0" = RealPlayer
    "RegistryCleaner" = Registry Cleaner 2.1
    "Shockwave" = Shockwave
    "Shop for HP Supplies" = Shop for HP Supplies
    "SmileyCentral_1vbar Uninstall" = SmileyCentral
    "Ulead Photo Express 3.0 SE" = Ulead Photo Express 3.0 SE
    "Uninstall_is1" = Uninstall 1.0.0.1
    "UPCShell" = LeapFrog Connect
    "VLC media player" = VLC media player 0.9.2
    "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    "WIC" = Windows Imaging Component
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "WordPerfect Office 2002" = WordPerfect Office 2002
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Facebook Plug-In" = Facebook Plug-In

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 2/2/2011 8:30:22 PM | Computer Name = KIMMIE | Source = Application Hang | ID = 1002
    Description = Hanging application firefox.exe, version 1.9.2.3989, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 2/2/2011 8:30:24 PM | Computer Name = KIMMIE | Source = Application Hang | ID = 1002
    Description = Hanging application firefox.exe, version 1.9.2.3989, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 2/2/2011 8:30:35 PM | Computer Name = KIMMIE | Source = Application Hang | ID = 1002
    Description = Hanging application firefox.exe, version 1.9.2.3989, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 2/2/2011 9:27:47 PM | Computer Name = KIMMIE | Source = Application Error | ID = 1000
    Description = Faulting application SZServer.exe, version 5.0.82.1, faulting module
    SZSnsrSv.dll, version 5.0.82.1, fault address 0x00020247.

    Error - 2/2/2011 9:28:41 PM | Computer Name = KIMMIE | Source = Application Error | ID = 1000
    Description = Faulting application SZServer.exe, version 5.0.82.1, faulting module
    SZSnsrSv.dll, version 5.0.82.1, fault address 0x00020247.

    [ System Events ]
    Error - 2/3/2011 10:14:24 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    cdudf_xp

    Error - 2/3/2011 10:21:58 AM | Computer Name = KIMMIE | Source = DCOM | ID = 10010
    Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
    with DCOM within the required timeout.

    Error - 2/3/2011 10:51:58 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7034
    Description = The Adobe Active File Monitor V4 service terminated unexpectedly.
    It has done this 1 time(s).

    Error - 2/3/2011 11:23:27 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7000
    Description = The Kodak Camera Connection Software service failed to start due to
    the following error: %%2

    Error - 2/3/2011 11:25:11 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7022
    Description = The HP CUE DeviceDiscovery Service service hung on starting.

    Error - 2/3/2011 11:25:11 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    cdudf_xp

    Error - 2/3/2011 11:25:12 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the stisvc service.

    Error - 2/4/2011 1:46:50 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7000
    Description = The Kodak Camera Connection Software service failed to start due to
    the following error: %%2

    Error - 2/4/2011 1:48:22 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7022
    Description = The HP CUE DeviceDiscovery Service service hung on starting.

    Error - 2/4/2011 1:48:22 AM | Computer Name = KIMMIE | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    cdudf_xp


    < End of report >
     
  18. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    OTL.Txt... (part 1)

    OTL logfile created on: 2/4/2011 9:02:24 AM - Run 1
    OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Kimberly\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    510.00 Mb Total Physical Memory | 218.00 Mb Available Physical Memory | 43.00% Memory free
    864.00 Mb Paging File | 669.00 Mb Available in Paging File | 77.00% Paging File free
    Paging file location(s): C:\pagefile.sys 384 768 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 55.84 Gb Total Space | 20.15 Gb Free Space | 36.09% Space Free | Partition Type: NTFS

    Computer Name: KIMMIE | User Name: Kimberly | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/02/04 08:59:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kimberly\Desktop\OTL.exe
    PRC - [2011/01/13 02:47:34 | 003,396,624 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2011/01/13 02:47:33 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2010/11/19 13:38:08 | 000,193,880 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
    PRC - [2010/11/19 13:29:00 | 004,916,568 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
    PRC - [2010/08/11 15:04:14 | 002,991,464 | ---- | M] (Smith Micro, Inc.) -- C:\Program Files\V CAST Media Manager\MEMonitor.exe
    PRC - [2010/06/24 17:14:22 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/08/24 16:11:02 | 000,155,648 | ---- | M] (Sprint Spectrum, L.L.C) -- C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
    PRC - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe
    PRC - [2005/09/09 03:24:30 | 000,102,400 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    PRC - [2005/09/09 01:18:10 | 000,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
    PRC - [2003/11/19 18:48:14 | 000,032,881 | ---- | M] () -- C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/02/04 08:59:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kimberly\Desktop\OTL.exe
    MOD - [2011/01/13 02:47:35 | 000,189,728 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
    MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- -- (KodakCCS)
    SRV - File not found [Disabled | Stopped] -- -- (HidServ)
    SRV - File not found [Disabled | Stopped] -- -- (AppMgmt)
    SRV - [2011/01/13 02:47:33 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2010/11/19 13:29:00 | 004,916,568 | ---- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service)
    SRV - [2010/10/31 20:41:14 | 000,028,766 | ---- | M] (SmileyCentral) [Auto | Stopped] -- C:\Program Files\SmileyCentral_1v\bar\1.bin\1vbarsvc.exe -- (SmileyCentral_1vService)
    SRV - [2007/08/24 16:11:02 | 000,155,648 | ---- | M] (Sprint Spectrum, L.L.C) [Auto | Running] -- C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe -- (OSCM Utility Service)
    SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
    SRV - [2005/09/09 03:24:30 | 000,102,400 | ---- | M] () [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor4.0)


    ========== Driver Services (SafeList) ==========

    DRV - [2011/01/13 02:41:16 | 000,294,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2011/01/13 02:40:16 | 000,047,440 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2011/01/13 02:40:04 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2011/01/13 02:37:30 | 000,023,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2011/01/13 02:37:11 | 000,029,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2011/01/13 02:37:09 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2008/11/11 13:42:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\lgusbmodem.sys -- (USBModem)
    DRV - [2008/11/11 13:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\lgusbbus.sys -- (usbbus)
    DRV - [2008/04/13 12:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp)
    DRV - [2008/04/13 12:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp)
    DRV - [2008/02/27 12:49:00 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
    DRV - [2007/10/12 15:04:38 | 000,099,200 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nwusbser2.sys -- (NWUSBPort2)
    DRV - [2007/10/12 15:04:38 | 000,099,200 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nwusbser.sys -- (NWUSBPort)
    DRV - [2007/10/12 15:04:38 | 000,099,200 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nwusbmdm.sys -- (NWUSBModem)
    DRV - [2007/09/06 14:30:24 | 000,194,048 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\NWADIenum.sys -- (NWADI)
    DRV - [2007/08/16 14:24:38 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\PCASp50.sys -- (PCASp50)
    DRV - [2007/08/16 14:24:36 | 000,013,824 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NwUsbCdFil.sys -- (NWUSBCDFIL)
    DRV - [2007/02/02 02:00:00 | 000,009,464 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
    DRV - [2007/02/02 02:00:00 | 000,009,336 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
    DRV - [2004/08/03 23:29:54 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv)
    DRV - [2004/08/03 23:29:49 | 000,019,455 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
    DRV - [2004/08/03 23:29:47 | 000,012,063 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
    DRV - [2004/08/03 23:29:45 | 000,023,615 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
    DRV - [2004/08/03 23:29:43 | 000,033,599 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
    DRV - [2004/08/03 23:29:42 | 000,019,551 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
    DRV - [2004/08/03 23:29:41 | 000,029,311 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
    DRV - [2004/08/03 23:29:37 | 000,012,415 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
    DRV - [2004/08/03 23:29:37 | 000,012,127 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
    DRV - [2004/08/03 23:29:37 | 000,011,775 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
    DRV - [2004/08/03 23:29:36 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
    DRV - [2003/08/29 04:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem)
    DRV - [2003/01/15 14:45:06 | 000,042,368 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys -- (bcm4sbxp)
    DRV - [2002/07/19 10:22:08 | 000,017,153 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
    DRV - [2002/05/13 19:59:20 | 000,004,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\bvrp_pci.sys -- (bvrp_pci)
    DRV - [2002/04/10 17:01:12 | 000,024,554 | ---- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Dvd_2k.sys -- (dvd_2K)
    DRV - [2002/04/10 17:01:00 | 000,029,638 | ---- | M] (Roxio) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Mmc_2k.sys -- (mmc_2K)
    DRV - [2002/04/10 17:00:44 | 000,117,898 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\pwd_2K.sys -- (pwd_2k)
    DRV - [2002/04/10 16:48:04 | 000,236,032 | ---- | M] (Roxio) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\cdudf_xp.sys -- (cdudf_xp)
    DRV - [2002/04/10 16:45:16 | 000,206,336 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys -- (UdfReadr_xp)
    DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow)
    DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3)
    DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi)
    DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx)
    DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810)
    DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra)
    DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160)
    DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080)
    DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280)
    DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k)
    DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x)
    DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc)
    DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550)
    DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde)
    DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde)
    DRV - [2001/08/17 12:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)
    DRV - [2000/08/18 14:57:52 | 000,017,524 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\gt680x.sys -- (GT680x)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,StartPage = http://www.lipan.net
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html
    IE - HKLM\..\URLSearchHook: {D3F669EB-57CE-4f45-8FBD-E245CBB46366} - C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll (iS3 Inc.)


    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com
    IE - HKU\.DEFAULT\..\URLSearchHook: {D3F669EB-57CE-4f45-8FBD-E245CBB46366} - C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll (iS3 Inc.)
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com
    IE - HKU\S-1-5-18\..\URLSearchHook: {D3F669EB-57CE-4f45-8FBD-E245CBB46366} - C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll (iS3 Inc.)
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.titanbank.com/
    IE - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
    IE - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultengine: "Ask.com"
    FF - prefs.js..browser.search.defaultenginename: "Ask.com"
    FF - prefs.js..browser.search.order.1: "Ask.com"
    FF - prefs.js..browser.search.selectedEngine: "Google"
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "www.hotmail.com"
    FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.4
    FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
    FF - prefs.js..network.proxy.no_proxies_on: ""
    FF - prefs.js..network.proxy.type: 4


    FF - HKLM\software\mozilla\Firefox\Extensions\\{780044d1-e8c0-488f-8059-4522ddbfc2ea}: C:\Program Files\Stopzilla!\Toolbar\Extension [2009/10/31 02:45:20 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/06/24 17:16:13 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\1vffxtbr@SmileyCentral_1v.com: C:\Program Files\SmileyCentral_1v\bar\1.bin [2010/10/31 20:41:29 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/03 09:08:22 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/01 20:49:54 | 000,000,000 | ---D | M]

    [2009/02/14 23:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Extensions
    [2009/02/14 23:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Extensions\mozswing@mozswing.org
    [2011/02/03 23:58:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\extensions
    [2010/06/24 17:17:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2009/03/03 01:53:16 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\extensions\moveplayer@movenetworks.com
    [2010/08/16 19:27:05 | 000,002,564 | ---- | M] () -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\searchplugins\askcom.xml
    [2009/12/01 12:50:20 | 000,002,160 | ---- | M] () -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\searchplugins\MySpace.xml
    [2011/02/03 23:58:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2010/06/24 17:16:13 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
    [2009/02/14 23:21:53 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
    [2007/09/06 11:53:00 | 000,400,384 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npagent.dll

    O1 HOSTS File: ([2011/02/03 09:23:40 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
    O2 - BHO: (ZILLAbar Browser Helper Object) - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\Toolbar\SZSG.dll (iS3, Inc)
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    O3 - HKLM\..\Toolbar: (STOPzilla) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\Toolbar\SZSG.dll (iS3, Inc)
    O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
    O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
    O3 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
    O3 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..\Toolbar\WebBrowser: (no name) - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - No CLSID value found.
    O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [Monitor] C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
    O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe ()
    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
    O4 - Startup: C:\Documents and Settings\Kimberly\Start Menu\Programs\Accessories\Startup\mary kay personal beauty profiler.lnk = C:\Program Files\mary kay personal beauty profiler\mary kay personal beauty profiler.exe ()
    O4 - Startup: C:\Documents and Settings\Kimberly\Start Menu\Programs\Accessories\Startup\V CAST Media Monitor.lnk = C:\Program Files\V CAST Media Manager\MEMonitor.exe (Smith Micro, Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Policies\Microsoft\Internet Explorer\control panel present
    O7 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: west.com ([]* in Trusted sites)
    O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: westathome.com ([]* in Trusted sites)
    O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: westathome.net ([]* in Trusted sites)
    O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: westathomeagent.net ([]* in Trusted sites)
    O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: workathomeagent.net ([]* in Trusted sites)
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} http://picture.vzw.com/activex/VerizonWirelessUploadControl.cab (Verizon Wireless Media Upload)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
    O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
    O16 - DPF: DirectAnimation Java Classes Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 208.180.42.100 208.180.42.68
    O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\TPSvc: DllName - TPSvc.dll - File not found
    O24 - Desktop WallPaper: C:\Documents and Settings\Kimberly\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kimberly\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2002/09/03 08:59:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\DOCUMENTS AND SETTINGS\KIMBERLY\LOCAL SETTINGS\TEMP\CFOUT.TXT) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\PROGRAM FILES\COMMON FILES\BTLINK\BTLINK.DLL) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Common Files\BTLINK) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\LMD.BIN) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\SB.HTM) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\STLB2.XML) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\TEMP\BW2.COM) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\TEMP\BW2.COM) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS.BHO) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\DOCUMENTS AND SETTINGS\KIMBERLY\LOCAL SETTINGS\TEMPORARY INTERNET FILES\SSK.LOG) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DRSMARTLOAD2.DAT) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\GATORPATCH.LOG) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\GATORPATCH.LOG) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\WEBP2PINSTALLER.DLL) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
    O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
    O34 - HKLM BootExecute: (SsiEfr.e) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\...exe [@ = exefile] -- Reg Error: Key error. File not found

    NetSvcs: 6to4 - File not found
    NetSvcs: AppMgmt - File not found
    NetSvcs: HidServ - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Ligos Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
    Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.444p - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\Ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\Ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Ligos Corporation)
    Drivers32: vidc.mpng - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
    Drivers32: vidc.mvjp - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
    Drivers32: wave - C:\WINDOWS\System32\SERWVDRV.DLL (Microsoft Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (56590081070202880)
     
  19. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    OTL.Txt (part 2)

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/02/04 08:59:35 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kimberly\Desktop\OTL.exe
    [2011/02/04 08:48:54 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2011/02/04 00:15:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
    [2011/02/04 00:15:55 | 000,294,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2011/02/04 00:15:55 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2011/02/04 00:15:52 | 000,047,440 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2011/02/04 00:15:52 | 000,023,632 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2011/02/04 00:15:50 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2011/02/04 00:15:50 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2011/02/04 00:15:50 | 000,029,392 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2011/02/04 00:14:56 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2011/02/04 00:14:54 | 000,188,216 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2011/02/04 00:14:09 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
    [2011/02/04 00:14:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2011/02/02 18:38:50 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2011/02/02 18:38:50 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2011/02/02 18:38:48 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2011/02/02 18:38:48 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2011/02/02 17:50:27 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/02/02 10:18:25 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2011/02/02 10:18:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/02/02 10:18:12 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2011/02/02 10:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/01/26 13:36:33 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
    [2011/01/26 13:36:33 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
    [2011/01/26 13:36:33 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
    [2011/01/15 16:55:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WeCareReminder
    [2011/01/15 09:22:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kimberly\Desktop\Flier
    [2003/12/18 13:48:34 | 000,017,524 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\gt680x.sys
    [2003/12/09 12:16:52 | 000,442,368 | ---- | C] ( ) -- C:\WINDOWS\System32\comintfs.dll

    ========== Files - Modified Within 30 Days ==========

    [2011/02/04 09:02:21 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3449698256-4290693082-1258896976-1006.job
    [2011/02/04 09:02:21 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3449698256-4290693082-1258896976-1006.job
    [2011/02/04 08:59:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kimberly\Desktop\OTL.exe
    [2011/02/04 08:36:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2011/02/04 01:35:02 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2011/02/04 00:15:56 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2011/02/03 23:46:30 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2011/02/03 23:46:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
    [2011/02/03 23:46:15 | 535,351,296 | -HS- | M] () -- C:\hiberfil.sys
    [2011/02/03 09:23:40 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
    [2011/02/03 08:24:04 | 000,000,728 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
    [2011/02/02 10:08:51 | 000,000,281 | RHS- | M] () -- C:\BOOT.INI
    [2011/02/02 09:51:59 | 000,000,129 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\04c0650645d8f56161dbc18e8079363a.szcpf
    [2011/02/01 15:55:25 | 000,001,016 | ---- | M] () -- C:\WINDOWS\ULEAD32.INI
    [2011/02/01 15:54:42 | 000,158,900 | ---- | M] () -- C:\Documents and Settings\Kimberly\Desktop\snow-in-mountain-wallpaper.jpg
    [2011/02/01 11:42:43 | 000,112,097 | ---- | M] () -- C:\Documents and Settings\Kimberly\Desktop\Party Form.png
    [2011/01/28 22:46:18 | 000,058,880 | ---- | M] () -- C:\Documents and Settings\Kimberly\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2011/01/26 16:02:21 | 000,024,576 | ---- | M] () -- C:\Documents and Settings\Kimberly\Desktop\drumbeat.xls
    [2011/01/15 16:54:31 | 000,000,880 | ---- | M] () -- C:\Documents and Settings\Kimberly\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.21.3.lnk
    [2011/01/15 16:54:31 | 000,000,862 | ---- | M] () -- C:\Documents and Settings\Kimberly\Desktop\FrostWire 4.21.3.lnk
    [2011/01/13 02:47:35 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2011/01/13 02:47:32 | 000,188,216 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2011/01/13 02:41:16 | 000,294,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2011/01/13 02:40:16 | 000,047,440 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2011/01/13 02:40:04 | 000,100,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2011/01/13 02:39:50 | 000,094,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2011/01/13 02:37:30 | 000,023,632 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2011/01/13 02:37:11 | 000,029,392 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2011/01/13 02:37:09 | 000,017,744 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2011/01/12 08:58:30 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\Kimberly\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

    ========== Files Created - No Company Name ==========

    [2011/02/04 00:15:56 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2011/02/03 08:21:21 | 000,000,728 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
    [2011/02/02 18:38:50 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2011/02/02 18:38:50 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2011/02/02 16:54:27 | 535,351,296 | -HS- | C] () -- C:\hiberfil.sys
    [2011/02/02 10:08:48 | 000,000,898 | ---- | C] () -- C:\Documents and Settings\Kimberly\Start Menu\Programs\Accessories\Startup\mary kay personal beauty profiler.lnk
    [2011/02/02 10:08:48 | 000,000,747 | ---- | C] () -- C:\Documents and Settings\Kimberly\Start Menu\Programs\Accessories\Startup\V CAST Media Monitor.lnk
    [2011/02/02 09:51:59 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\04c0650645d8f56161dbc18e8079363a.szcpf
    [2011/02/01 15:54:41 | 000,158,900 | ---- | C] () -- C:\Documents and Settings\Kimberly\Desktop\snow-in-mountain-wallpaper.jpg
    [2011/02/01 11:42:47 | 000,112,097 | ---- | C] () -- C:\Documents and Settings\Kimberly\Desktop\Party Form.png
    [2011/01/26 16:02:21 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\Kimberly\Desktop\drumbeat.xls
    [2011/01/15 16:54:31 | 000,000,880 | ---- | C] () -- C:\Documents and Settings\Kimberly\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.21.3.lnk
    [2011/01/15 16:54:30 | 000,000,862 | ---- | C] () -- C:\Documents and Settings\Kimberly\Desktop\FrostWire 4.21.3.lnk
    [2011/01/12 08:58:30 | 000,001,620 | ---- | C] () -- C:\Documents and Settings\Kimberly\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2010/09/12 20:25:54 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
    [2010/06/30 13:23:50 | 000,004,918 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\nyaaqbsr.rmh
    [2010/06/30 13:23:41 | 000,005,114 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xqkcebzs.dik
    [2010/06/24 17:00:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\setup32.INI
    [2009/10/05 21:12:37 | 000,001,128 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
    [2009/04/19 23:14:38 | 000,000,035 | ---- | C] () -- C:\WINDOWS\atechloc.ini
    [2009/04/19 23:14:29 | 000,000,083 | ---- | C] () -- C:\WINDOWS\atech.ini
    [2008/07/22 22:22:53 | 000,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL
    [2008/01/30 21:44:57 | 000,002,508 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\$_hpcst$.hpc
    [2006/07/29 11:20:36 | 000,002,508 | ---- | C] () -- C:\Documents and Settings\Kimberly\Application Data\$_hpcst$.hpc
    [2006/06/18 11:56:30 | 000,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
    [2006/06/18 11:56:30 | 000,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
    [2006/04/27 21:57:56 | 000,001,751 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
    [2006/04/24 13:14:54 | 000,000,777 | ---- | C] () -- C:\WINDOWS\videoimp.ini
    [2006/04/05 21:36:54 | 000,000,097 | ---- | C] () -- C:\WINDOWS\TaxACT05.ini
    [2006/01/13 14:02:32 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
    [2005/11/20 19:30:27 | 000,000,045 | ---- | C] () -- C:\WINDOWS\EPSONC86.ini
    [2005/11/20 19:27:35 | 000,000,051 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI
    [2005/03/07 10:27:13 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\Rivet200.dll
    [2004/12/21 13:34:13 | 000,058,880 | ---- | C] () -- C:\Documents and Settings\Kimberly\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2004/12/21 10:16:23 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
    [2004/07/02 15:55:01 | 000,000,315 | ---- | C] () -- C:\WINDOWS\Belt.ini
    [2004/06/30 13:39:45 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2004/06/29 16:46:04 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\PopWait.exe
    [2003/12/20 11:46:36 | 000,000,045 | ---- | C] () -- C:\WINDOWS\EPSC42.ini
    [2003/09/13 14:19:29 | 000,000,020 | ---- | C] () -- C:\WINDOWS\InfModM.ini
    [2003/09/13 13:07:16 | 000,000,015 | ---- | C] () -- C:\WINDOWS\wgedit.ini
    [2003/09/13 13:05:20 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\unzdll.dll
    [2003/05/26 22:15:47 | 000,000,010 | ---- | C] () -- C:\WINDOWS\wininit.ini_
    [2003/05/18 21:33:05 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2003/04/14 20:07:21 | 000,045,320 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
    [2003/03/21 14:03:41 | 000,001,512 | ---- | C] () -- C:\WINDOWS\entpack.ini
    [2003/03/21 14:03:18 | 000,271,264 | ---- | C] () -- C:\WINDOWS\VBRUN100.DLL
    [2003/03/21 14:03:18 | 000,019,200 | ---- | C] () -- C:\WINDOWS\WEPUTIL.DLL
    [2003/03/20 22:06:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Ui.INI
    [2003/03/20 18:13:24 | 000,634,880 | ---- | C] () -- C:\WINDOWS\System32\scorillont.dll
    [2003/03/20 18:13:24 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\scorsock.dll
    [2003/03/20 10:00:54 | 000,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
    [2003/03/19 22:41:43 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
    [2003/03/19 22:41:43 | 000,000,177 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
    [2003/03/19 22:41:41 | 000,065,864 | ---- | C] () -- C:\WINDOWS\System32\Digita.sys
    [2003/03/19 22:41:41 | 000,006,144 | ---- | C] () -- C:\WINDOWS\System32\ImgLibLead.dll
    [2003/03/19 22:41:40 | 000,100,864 | ---- | C] () -- C:\WINDOWS\System32\Dc50ip32.dll
    [2003/03/19 20:16:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WATCH.INI
    [2003/03/19 17:29:01 | 000,001,016 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI
    [2003/03/19 16:59:01 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2003/03/19 16:33:53 | 000,004,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
    [2003/03/13 14:43:14 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2003/03/13 14:34:18 | 000,000,185 | ---- | C] () -- C:\WINDOWS\intuprof.ini
    [2003/03/13 14:34:17 | 000,000,833 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
    [2003/03/13 14:29:37 | 000,000,788 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2003/03/13 14:10:20 | 000,000,485 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2002/09/03 08:59:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [1999/01/22 12:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/04/14 11:43:12 | 000,000,000 | ---- | M] () -- C:\AdobeDebug.txt
    [2002/09/03 08:59:58 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2006/06/16 20:55:51 | 010,361,874 | RHS- | M] () -- C:\AVG7DB_F.DAT
    [2006/06/15 14:16:09 | 012,285,681 | ---- | M] () -- C:\AVG7QT.DAT
    [2006/04/17 09:55:10 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2011/02/02 10:08:51 | 000,000,281 | RHS- | M] () -- C:\BOOT.INI
    [2002/09/03 08:38:46 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS
    [2008/08/12 14:39:05 | 012,472,320 | ---- | M] () -- C:\CAPTURE.AVI
    [2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
    [2011/02/03 09:40:59 | 000,012,557 | ---- | M] () -- C:\ComboFix.txt
    [2002/09/03 08:59:58 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2003/03/13 14:13:30 | 000,004,376 | RH-- | M] () -- C:\DELL.SDR
    [2006/08/13 14:46:29 | 000,022,372 | ---- | M] () -- C:\devicetable.log
    [2011/02/03 23:46:15 | 535,351,296 | -HS- | M] () -- C:\hiberfil.sys
    [2006/07/01 18:59:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2008/09/23 23:14:18 | 000,000,000 | ---- | M] () -- C:\Lemmings.log
    [2008/04/07 23:29:14 | 000,001,397 | ---- | M] () -- C:\logfile
    [2008/07/19 19:22:48 | 000,000,148 | ---- | M] () -- C:\lxdc.log
    [2002/09/03 08:59:58 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
    [2004/09/25 19:51:47 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2010/04/01 18:08:05 | 000,250,048 | RHS- | M] () -- C:\NTLDR
    [2011/02/03 23:46:02 | 402,653,184 | -HS- | M] () -- C:\pagefile.sys
    [2008/08/09 18:41:05 | 000,012,662 | -H-- | M] () -- C:\POF$$THM.TOF
    [2005/10/31 09:56:00 | 000,700,416 | ---- | M] (LimeWire) -- C:\StubInstaller.exe
    [2010/07/31 17:13:55 | 001,511,424 | -H-- | M] () -- C:\SZKGFS.dat
    [2011/02/04 00:06:34 | 000,055,130 | ---- | M] () -- C:\TDSSKiller.2.4.16.0_04.02.2011_00.03.42_log.txt
    [2009/10/04 20:20:47 | 000,000,150 | ---- | M] () -- C:\YServer.txt

    < %systemroot%\Fonts\*.com >
    [2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2002/09/03 08:59:02 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\DESKTOP.INI

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2007/10/21 23:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\CNMPD97.DLL
    [2007/10/21 23:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\CNMPP97.DLL
    [2008/07/06 06:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\filterpipelineprintproc.dll
    [2007/10/20 17:21:50 | 000,278,016 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\hpzpp5mu.dll
    [2009/12/10 09:24:06 | 000,082,168 | ---- | M] (Microsoft Corporation.) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\lmdippr8.dll
    [2008/07/06 04:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2011/01/13 02:47:35 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [1998/04/18 08:34:56 | 000,054,784 | ---- | M] (Storm Technology, Inc.) -- C:\WINDOWS\EasyPhoto Slide Show.scr
    [1999/08/17 12:10:12 | 000,028,672 | ---- | M] (Ulead Systems, Inc.) -- C:\WINDOWS\Photo Express 3.scr

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >
    [2006/09/17 14:42:32 | 000,001,610 | -H-- | M] () -- C:\Documents and Settings\Kimberly\Application Data\Microsoft\LastFlashConfig.WFC

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2002/09/03 08:47:18 | 000,094,208 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
    [2002/09/03 08:47:18 | 000,602,112 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
    [2002/09/03 08:47:18 | 000,380,928 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2010/04/01 18:21:19 | 000,000,080 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2003/03/19 13:01:06 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Kimberly\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2011/02/04 08:59:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kimberly\Desktop\OTL.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2004/09/25 23:08:08 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Kimberly\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2009/04/20 00:42:11 | 000,010,288 | ---- | M] () -- C:\Documents and Settings\All Users\lxdc

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >
    Uninstall CDK.exe

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2011/02/04 09:02:20 | 000,114,688 | ---- | M] () -- C:\Documents and Settings\Kimberly\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\INF\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 18:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2002/06/03 10:22:22 | 000,015,692 | ---- | M] () -- C:\Program Files\Messenger\license.txt
    [2002/06/03 10:22:16 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2002/06/03 10:22:16 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2002/06/03 10:22:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
    [2008/05/02 08:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 11:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 18:12:28 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2002/08/20 15:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\MSMSGSIN.EXE
    [2002/06/03 10:22:12 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2002/06/03 10:22:12 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2002/06/03 10:22:14 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2010/10/05 17:42:53 | 000,005,120 | -HS- | M] () -- C:\Program Files\Messenger\Thumbs.db
    [2002/06/03 10:22:18 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/07/17 12:41:04 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >
    [2000/09/11 07:00:00 | 000,009,597 | ---- | M] () -- C:\WINDOWS\SYSTEM\RDB16.EXE

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-02-04 09:02:20


    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

    < End of report >
     
  20. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =========================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      IE - HKLM\..\URLSearchHook: {D3F669EB-57CE-4f45-8FBD-E245CBB46366} - C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll (iS3 Inc.)
      IE - HKU\.DEFAULT\..\URLSearchHook: {D3F669EB-57CE-4f45-8FBD-E245CBB46366} - C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll (iS3 Inc.)
      IE - HKU\S-1-5-18\..\URLSearchHook: {D3F669EB-57CE-4f45-8FBD-E245CBB46366} - C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll (iS3 Inc.)
      IE - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
      FF - prefs.js..browser.search.defaultengine: "Ask.com"
      FF - prefs.js..browser.search.defaultenginename: "Ask.com"
      FF - prefs.js..browser.search.order.1: "Ask.com"
      FF - HKLM\software\mozilla\Firefox\Extensions\\{780044d1-e8c0-488f-8059-4522ddbfc2ea}: C:\Program Files\Stopzilla!\Toolbar\Extension [2009/10/31 02:45:20 | 000,000,000 | ---D | M]
      [2010/08/16 19:27:05 | 000,002,564 | ---- | M] () -- C:\Documents and Settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\searchplugins\askcom.xml
      O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
      O2 - BHO: (ZILLAbar Browser Helper Object) - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\Toolbar\SZSG.dll (iS3, Inc)
      O3 - HKLM\..\Toolbar: (STOPzilla) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\Toolbar\SZSG.dll (iS3, Inc)
      O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
      O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
      O3 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
      O3 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..\Toolbar\WebBrowser: (no name) - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - No CLSID value found.
      O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: west.com ([]* in Trusted sites)
      O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: westathome.com ([]* in Trusted sites)
      O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: westathome.net ([]* in Trusted sites)
      O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: westathomeagent.net ([]* in Trusted sites)
      O15 - HKU\S-1-5-21-3449698256-4290693082-1258896976-1006\..Trusted Domains: workathomeagent.net ([]* in Trusted sites)
      O16 - DPF: DirectAnimation Java Classes Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
      O20 - Winlogon\Notify\TPSvc: DllName - TPSvc.dll - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\DOCUMENTS AND SETTINGS\KIMBERLY\LOCAL SETTINGS\TEMP\CFOUT.TXT) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\PROGRAM FILES\COMMON FILES\BTLINK\BTLINK.DLL) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Common Files\BTLINK) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\LMD.BIN) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\SB.HTM) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\STLB2.XML) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\TEMP\BW2.COM) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\TEMP\BW2.COM) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS.BHO) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\DOCUMENTS AND SETTINGS\KIMBERLY\LOCAL SETTINGS\TEMPORARY INTERNET FILES\SSK.LOG) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DRSMARTLOAD2.DAT) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\GATORPATCH.LOG) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\GATORPATCH.LOG) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\WEBP2PINSTALLER.DLL) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
      O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\IEDriver) - File not found
      [2010/06/30 13:23:50 | 000,004,918 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\nyaaqbsr.rmh
      [2010/06/30 13:23:41 | 000,005,114 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xqkcebzs.dik
      @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
      
      :Services
      
      :Reg
      
      :Files
      C:\Program Files\STOPzilla!
      
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =========================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  21. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok updated Java and ran JavaRa, here is the log for OTL... working on the next scans...

    All processes killed
    ========== OTL ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{D3F669EB-57CE-4f45-8FBD-E245CBB46366} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3F669EB-57CE-4f45-8FBD-E245CBB46366}\ deleted successfully.
    C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll moved successfully.
    Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{D3F669EB-57CE-4f45-8FBD-E245CBB46366} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3F669EB-57CE-4f45-8FBD-E245CBB46366}\ not found.
    File C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll not found.
    Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{D3F669EB-57CE-4f45-8FBD-E245CBB46366} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3F669EB-57CE-4f45-8FBD-E245CBB46366}\ not found.
    File C:\Program Files\STOPzilla!\Toolbar\SZIESearchHook.dll not found.
    Registry value HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
    Prefs.js: "Ask.com" removed from browser.search.defaultengine
    Prefs.js: "Ask.com" removed from browser.search.defaultenginename
    Prefs.js: "Ask.com" removed from browser.search.order.1
    Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{780044d1-e8c0-488f-8059-4522ddbfc2ea} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{780044d1-e8c0-488f-8059-4522ddbfc2ea}\ not found.
    C:\Program Files\Stopzilla!\Toolbar\Extension\skin folder moved successfully.
    C:\Program Files\Stopzilla!\Toolbar\Extension\locale\en-US folder moved successfully.
    C:\Program Files\Stopzilla!\Toolbar\Extension\locale folder moved successfully.
    C:\Program Files\Stopzilla!\Toolbar\Extension\defaults\preferences folder moved successfully.
    C:\Program Files\Stopzilla!\Toolbar\Extension\defaults folder moved successfully.
    C:\Program Files\Stopzilla!\Toolbar\Extension\content folder moved successfully.
    C:\Program Files\Stopzilla!\Toolbar\Extension\components folder moved successfully.
    C:\Program Files\Stopzilla!\Toolbar\Extension folder moved successfully.
    C:\Documents and Settings\Kimberly\Application Data\Mozilla\Firefox\Profiles\4b4ezboc.default\searchplugins\askcom.xml moved successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1827766B-9F49-4854-8034-F6EE26FCB1EC}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1827766B-9F49-4854-8034-F6EE26FCB1EC}\ deleted successfully.
    C:\Program Files\STOPzilla!\Toolbar\SZSG.dll moved successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98828DED-A591-462F-83BA-D2F62A68B8B8} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98828DED-A591-462F-83BA-D2F62A68B8B8}\ deleted successfully.
    File C:\Program Files\STOPzilla!\Toolbar\SZSG.dll not found.
    Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
    Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
    Registry value HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
    Registry value HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F0F8ECBE-D460-4B34-B007-56A92E8F84A7} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0F8ECBE-D460-4B34-B007-56A92E8F84A7}\ not found.
    Registry key HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\west.com\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\westathome.com\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\westathome.net\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\westathomeagent.net\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-3449698256-4290693082-1258896976-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\workathomeagent.net\ deleted successfully.
    Starting removal of ActiveX control DirectAnimation Java Classes Reg Error: Value error.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes Reg Error: Value error.\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes Reg Error: Value error.\ not found.
    Starting removal of ActiveX control Microsoft XML Parser for Java Reg Error: Value error.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java Reg Error: Value error.\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java Reg Error: Value error.\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TPSvc\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\DOCUMENTS AND SETTINGS\KIMBERLY\LOCAL SETTINGS\TEMP\CFOUT.TXT deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\PROGRAM FILES\COMMON FILES\BTLINK\BTLINK.DLL deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\Program Files\Common Files\BTLINK deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\SYSTEM32\LMD.BIN deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\SYSTEM32\SB.HTM deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\system32\IEDriver deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\SYSTEM32\STLB2.XML deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\TEMP\BW2.COM deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\TEMP\BW2.COM deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\SNDBMARK.DLL deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS.BHO deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\DOCUMENTS AND SETTINGS\KIMBERLY\LOCAL SETTINGS\TEMPORARY INTERNET FILES\SSK.LOG deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\DRSMARTLOAD2.DAT deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\GATORPATCH.LOG deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\GATORPATCH.LOG deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\DOWNLOADED PROGRAM FILES\WEBP2PINSTALLER.DLL deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\system32\IEDriver deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\system32\IEDriver deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\system32\IEDriver deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:pFDNNT C:\WINDOWS\system32\IEDriver deleted successfully.
    C:\Documents and Settings\All Users\Application Data\nyaaqbsr.rmh moved successfully.
    C:\Documents and Settings\All Users\Application Data\xqkcebzs.dik moved successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\Program Files\STOPzilla!\Toolbar folder moved successfully.
    C:\Program Files\STOPzilla! folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Kimberly
    ->Temp folder emptied: 9798924 bytes
    ->Temporary Internet Files folder emptied: 6141093 bytes
    ->Java cache emptied: 2027 bytes
    ->FireFox cache emptied: 91764869 bytes
    ->Flash cache emptied: 59476 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 2968 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 55927 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 8523230 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes
    RecycleBin emptied: 75296984 bytes

    Total Files Cleaned = 183.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Kimberly
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.20.6 log created on 02042011_144033

    Files\Folders moved on Reboot...
    File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!

    Registry entries deleted on Reboot...
     
  22. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Security Check log...

    Results of screen317's Security Check version 0.99.7
    Windows XP Service Pack 3
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    avast! Free Antivirus
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    Registry Cleaner 2.1
    Java(TM) 6 Update 23
    Java 2 Runtime Environment, SE v1.4.2
    Java 2 Runtime Environment, SE v1.4.2_03
    Out of date Java installed!
    Adobe Flash Player 10.1.85.3
    Adobe Reader 9.4.1
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.6.13)
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Windows Defender MSMpEng.exe
    Windows Defender MsMpEng.exe
    Alwil Software Avast5 AvastSvc.exe
    Alwil Software Avast5 avastUI.exe
    ``````````End of Log````````````
     
  23. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Ok, wow, the ESET took 5 1/2 hours to scan. Is that normal??? It found 45 threats. Posting...

    C:\Documents and Settings\Kimberly\Application Data\OpenCandy\OpenCandy_3A362FF9E622441A9D10A33D3506A2D6\p1v1_PPIRegistryReviver_w.exe a variant of Win32/SlowPCfighter application
    C:\Documents and Settings\Kimberly\Application Data\OpenCandy\OpenCandy_3A362FF9E622441A9D10A33D3506A2D6\PPIRegistryReviverSetup.exe a variant of Win32/SlowPCfighter application
    C:\Program Files\MSN Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application
    C:\Program Files\MSN Messenger\riched20.dll Win32/Toolbar.MyWebSearch application
    C:\Program Files\SmileyCentral_1v\bar\1.bin\1vdatact.dll a variant of Win32/Toolbar.MyWebSearch.A application
    C:\Program Files\SmileyCentral_1v\bar\1.bin\1vhtml.dll probably a variant of Win32/Toolbar.MyWebSearch.F application
    C:\Program Files\SmileyCentral_1v\bar\1.bin\1vhtmlmu.dll probably a variant of Win32/Toolbar.MyWebSearch.B application
    C:\Program Files\SmileyCentral_1v\bar\1.bin\1vPlugin.dll a variant of Win32/Toolbar.MyWebSearch application
    C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\j3HYnZW8zK.exe.vir a variant of Win32/Kryptik.KFK trojan
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029314.scr Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029317.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029318.DLL Win32/Adware.FunWeb application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029319.DLL Win32/Adware.FunWeb application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029320.DLL Win32/Toolbar.MyWebSearch.G application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029321.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029322.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029323.DLL Win32/Adware.FunWeb application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029324.SCR Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029325.DLL Win32/Toolbar.MyWebSearch.G application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029326.DLL Win32/Toolbar.MyWebSearch.D application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029327.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029328.EXE Win32/Adware.FunWeb application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029331.DLL Win32/Toolbar.MyWebSearch.H application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029332.DLL a variant of Win32/Toolbar.MyWebSearch.I application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029334.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029336.EXE Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029338.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029339.DLL Win32/Toolbar.MyWebSearch.J application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029341.EXE Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029342.EXE Win32/Toolbar.MyWebSearch.J application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029343.EXE Win32/Toolbar.MyWebSearch.I application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029344.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029345.DLL Win32/Toolbar.MyWebSearch.J application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029346.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029347.EXE Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029348.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029533.DLL Win32/Toolbar.MyWebSearch.B application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029534.DLL a variant of Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029535.DLL a variant of Win32/Toolbar.MyWebSearch.K application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029536.EXE Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029537.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029538.DLL Win32/Toolbar.MyWebSearch application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP298\A0029547.dll a variant of Win32/Toolbar.MyWebSearch.K application
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP300\A0038811.exe a variant of Win32/Kryptik.KFK trojan
    C:\WINDOWS\wt\wtupdates\wtwebdriver\files\3.3.1.001\npwthost.dll probably a variant of Win32/Agent.HNCJWDG trojan
     
  24. silverwings85

    silverwings85 TS Rookie Topic Starter Posts: 25

    Also, I had to manually turn off Windows Defender to get ESET to run. I didn't even know I had this program on the computer. Do I need it?
     
  25. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Personally, I regard Windows Defender as worthless.
    It comes with Windows and, I believe, it's on by default.

    =============================================================

    Uninstall Registry Cleaner 2.1
    Registry cleaners/optimizers are not recommended for several reasons:

    • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

      The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
    • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
    • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
    • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
    • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".
    Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.


    ======================================================================

    Uninstall:
    Java 2 Runtime Environment, SE v1.4.2
    Java 2 Runtime Environment, SE v1.4.2_03

    =======================================================================

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.

    ======================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      
      :Services
      
      :Reg
      
      :Files
      C:\Documents and Settings\Kimberly\Application Data\OpenCandy\OpenCandy_3A362FF9E622441A9D10A33D3506A2D6\p1v1_PPIRegistryReviver_w.exe 
      C:\Documents and Settings\Kimberly\Application Data\OpenCandy\OpenCandy_3A362FF9E622441A9D10A33D3506A2D6\PPIRegistryReviverSetup.exe 
      C:\Program Files\MSN Messenger\msimg32.dll 
      C:\Program Files\MSN Messenger\riched20.dll 
      C:\Program Files\SmileyCentral_1v\bar\1.bin\1vdatact.dll 
      C:\Program Files\SmileyCentral_1v\bar\1.bin\1vhtml.dll probably 
      C:\Program Files\SmileyCentral_1v\bar\1.bin\1vhtmlmu.dll probably 
      C:\Program Files\SmileyCentral_1v\bar\1.bin\1vPlugin.dll
      C:\WINDOWS\wt\wtupdates\wtwebdriver\files\3.3.1.001\npwthost.dll
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ======================================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...