Solved System Check virus removal?

Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows XP Professional Service Pack 1 (build 2600)

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
ATA_Read(): DeviceIoControl() ERROR 1

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...
 
ComboFix 12-01-12.04 - Administrator 2/2012 Thu 16:41:53.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.1.936.86.1033.18.510.316 [GMT -5:00]
执行位置: c:\documents and settings\Administrator\Desktop\ComboFix.exe
.
Error: Cfiles.dat
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
发现受感染 c:\windows\system32\qmgr.dll 并且成功解毒
从 - c:\windows\ERDNT\cache\qmgr.dll 恢复原来档案
.
找不到 。。。 "c:\windows\system32\drivers\intelppm.sys"!!
.
.
((((((((((((((((((((((((( 2011-12-12 至 2012-01-12 的新的档案 )))))))))))))))))))))))))))))))
.
.
2012-01-09 01:37 . 2012-01-09 01:37 1786 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2012-01-08 19:17 . 2012-01-08 19:18 -------- d-----w- C:\FRST
2012-01-07 02:16 . 2012-01-07 02:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2012-01-07 02:16 . 2012-01-07 02:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-01-07 02:16 . 2012-01-07 02:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-01-07 02:16 . 2011-12-10 20:24 18800 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-31 00:49 . 2011-12-31 00:49 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2011-12-31 00:49 . 2011-12-31 00:49 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2011-12-31 00:49 . 2011-12-31 00:49 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2011-12-31 00:49 . 2011-12-31 00:49 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-14 00:32 . 2011-10-01 19:56 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-31 00:49 . 2011-10-01 16:52 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-09_01.35.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-12 21:49 . 2012-01-12 21:49 16384 c:\windows\Temp\Perflib_Perfdata_3a0.dat
+ 2003-03-31 12:00 . 2012-01-09 01:37 40972 c:\windows\system32\perfc009.dat
+ 2003-03-31 12:00 . 2012-01-09 01:37 314644 c:\windows\system32\perfh009.dat
+ 2011-10-01 16:11 . 2012-01-12 20:14 3777536 c:\windows\Installer\3a462.msi
- 2011-10-01 16:11 . 2012-01-07 01:17 3777536 c:\windows\Installer\3a462.msi
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2003-03-31 13312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2004-02-10 118784]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2002-10-23 86016]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 577536]
"Lexmark 5200 series"="c:\program files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 57344]
"LXBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2004-03-17 65536]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-03-23 294912]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2003-03-31 208953]
"MSPY2002"="c:\windows\System32\IME\PINTLGNT\ImScInst.exe" [2003-03-31 59392]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 455168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 7:49 AM 227232]
.
.
------- 而外的扫描 -------
.
uStart Page = hxxp://www.google.com/webhp?client=aff-ime
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\65m8sdqv.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-12 16:49
Windows 5.1.2600 Service Pack 1 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST316002 rev.8.01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
--------------------- 运行进程下的动态链接库 ---------------------
.
- - - - - - - > 'winlogon.exe'(652)
c:\windows\System32\ODBC32.dll
c:\windows\System32\msctfime.ime
.
- - - - - - - > 'lsass.exe'(716)
c:\windows\System32\dssenh.dll
.
- - - - - - - > 'explorer.exe'(1648)
c:\windows\System32\msctfime.ime
c:\windows\System32\msi.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
.
------------------------ 其他运行进程 ------------------------
.
c:\windows\SOUNDMAN.EXE
c:\program files\Lexmark 5200 series\lxbtbmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
.
**************************************************************************
.
完成时间: 2012-01-12 16:53:40 - 电脑已重新启动
ComboFix-quarantined-files.txt 2012-01-12 21:53
ComboFix2.txt 2012-01-09 01:37
.
Pre-Run: 85,379,784,704 bytes free
Post-Run: 85,372,088,320 bytes free
.
- - End Of File - - EEDF15ED083AA724C248FC9AA541EC14
 
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-01-14 15:33:17
Windows 5.1.2600 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0 ST316002 rev.8.01
Running: utoh4zsi.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kxtyqpow.sys


---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----

it's actually running completely fine. there used to be random warning popups but there aren't anymore. it's like there's nothing wrong with it anymore
 
We still have one system file missing.
Please run System Look as described in my reply #21.
 
SystemLook 30.07.11 by jpshortstuff
Log created at 21:35 on 14/01/2012 by Administrator
Administrator - Elevation successful

========== filefind ==========

Searching for "intelppm.sys"
No files found.

-= EOF =-
 
ComboFix 12-01-15.01 - Administrator 5/2012 Sun 11:52:28.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.1.936.86.1033.18.510.306 [GMT -5:00]
执行位置: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* 成功创造新还原点
.
Error: Cfiles.dat
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
发现受感染 c:\windows\system32\qmgr.dll 并且成功解毒
从 - c:\windows\ERDNT\cache\qmgr.dll 恢复原来档案
.
.
((((((((((((((((((((((((( 2011-12-15 至 2012-01-15 的新的档案 )))))))))))))))))))))))))))))))
.
.
2012-01-15 16:48 . 2012-01-15 16:47 36352 ----a-w- c:\windows\system32\drivers\intelppm.sys
2012-01-09 01:37 . 2012-01-09 01:37 1786 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2012-01-08 19:17 . 2012-01-08 19:18 -------- d-----w- C:\FRST
2012-01-07 02:16 . 2012-01-07 02:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2012-01-07 02:16 . 2012-01-07 02:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-01-07 02:16 . 2012-01-07 02:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-01-07 02:16 . 2011-12-10 20:24 18800 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-31 00:49 . 2011-12-31 00:49 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2011-12-31 00:49 . 2011-12-31 00:49 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2011-12-31 00:49 . 2011-12-31 00:49 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2011-12-31 00:49 . 2011-12-31 00:49 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-14 00:32 . 2011-10-01 19:56 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-31 00:49 . 2011-10-01 16:52 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-09_01.35.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-15 16:59 . 2012-01-15 16:59 16384 c:\windows\Temp\Perflib_Perfdata_37c.dat
+ 2003-03-31 12:00 . 2012-01-09 01:37 40972 c:\windows\system32\perfc009.dat
+ 2003-03-31 12:00 . 2012-01-09 01:37 314644 c:\windows\system32\perfh009.dat
+ 2011-10-01 16:11 . 2012-01-12 20:14 3777536 c:\windows\Installer\3a462.msi
- 2011-10-01 16:11 . 2012-01-07 01:17 3777536 c:\windows\Installer\3a462.msi
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2003-03-31 13312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2004-02-10 118784]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2002-10-23 86016]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 577536]
"Lexmark 5200 series"="c:\program files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 57344]
"LXBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2004-03-17 65536]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-03-23 294912]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2003-03-31 208953]
"MSPY2002"="c:\windows\System32\IME\PINTLGNT\ImScInst.exe" [2003-03-31 59392]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 455168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 7:49 AM 227232]
.
.
------- 而外的扫描 -------
.
uStart Page = hxxp://www.google.com/webhp?client=aff-ime
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\65m8sdqv.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-15 11:59
Windows 5.1.2600 Service Pack 1 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST316002 rev.8.01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
--------------------- 运行进程下的动态链接库 ---------------------
.
- - - - - - - > 'winlogon.exe'(652)
c:\windows\System32\ODBC32.dll
c:\windows\System32\msctfime.ime
.
- - - - - - - > 'lsass.exe'(720)
c:\windows\System32\dssenh.dll
.
- - - - - - - > 'explorer.exe'(1340)
c:\windows\System32\msctfime.ime
c:\windows\System32\msi.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
.
------------------------ 其他运行进程 ------------------------
.
c:\windows\SOUNDMAN.EXE
c:\program files\Lexmark 5200 series\lxbtbmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
.
**************************************************************************
.
完成时间: 2012-01-15 12:04:09 - 电脑已重新启动
ComboFix-quarantined-files.txt 2012-01-15 17:04
ComboFix2.txt 2012-01-12 21:53
ComboFix3.txt 2012-01-09 01:37
.
Pre-Run: 85,297,016,832 bytes free
Post-Run: 85,290,610,688 bytes free
.
- - End Of File - - 470ED6909E0A160306B134732AE842F1
 
How is computer doing?

Download OTL to your Desktop.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click the Scan All Users checkbox.
  • Under the Custom Scan box paste this in:


netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop


  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
 
OTL Extras logfile created on: 1/16/2012 11:52:45 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 1 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2800.1106)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

509.80 Mb Total Physical Memory | 294.80 Mb Available Physical Memory | 57.83% Memory free
1.22 Gb Paging File | 1.06 Gb Available in Paging File | 87.27% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 83.87 Gb Total Space | 79.40 Gb Free Space | 94.68% Space Free | Partition Type: NTFS
Drive D: | 65.18 Gb Total Space | 61.28 Gb Free Space | 94.01% Space Free | Partition Type: NTFS

Computer Name: SUN-6H5NHFR7L5C | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-73586283-2025429265-839522115-500\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{764C0C8F-B1B1-49BF-AEDC-4E48E857A667}" = Lexmark Fax Solutions
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics Driver
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9984DF60-1C5B-11D3-ACA1-908A4FC10801}" = Intel Application Accelerator
"{AC76BA86-1033-0000-BA7E-000000000001}" = Adobe Acrobat 6.0 Standard
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint Plus
"{EF4EF65F-4D62-44D7-82C9-1AECCBA74C50}" = Intel(R) PROSet
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"InstallShield_{764C0C8F-B1B1-49BF-AEDC-4E48E857A667}" = Lexmark Fax Solutions
"Lexmark 5200 Series" = Lexmark 5200 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 9.0.1 (x86 en-US)" = Mozilla Firefox 9.0.1 (x86 en-US)
"PROSet" = Intel(R) PRO Network Adapters and Drivers

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/4/2012 5:21:28 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Application Error | ID = 1000
Description = Faulting application dqtotsvpshkypw.exe, version 1.0.3.69, faulting
module unknown, version 0.0.0.0, fault address 0x00370968.

Error - 1/6/2012 8:15:00 PM | Computer Name = SUN-6H5NHFR7L5C | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 8007043C from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 1/6/2012 8:15:00 PM | Computer Name = SUN-6H5NHFR7L5C | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 1/6/2012 8:16:52 PM | Computer Name = SUN-6H5NHFR7L5C | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 8007043C from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 1/6/2012 8:16:52 PM | Computer Name = SUN-6H5NHFR7L5C | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 1/6/2012 8:34:48 PM | Computer Name = SUN-6H5NHFR7L5C | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 8007043C from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 1/6/2012 8:34:48 PM | Computer Name = SUN-6H5NHFR7L5C | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 1/8/2012 9:33:40 PM | Computer Name = SUN-6H5NHFR7L5C | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: 0x2efd

Error - 1/8/2012 9:37:45 PM | Computer Name = SUN-6H5NHFR7L5C | Source = LoadPerf | ID = 3006
Description = Unable to read the performance counter strings of the 004 language
ID. The Win32 status returned by the call is the first DWORD in Data section.

Error - 1/10/2012 10:54:22 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Perflib | ID = 2002
Description = The open procedure for service "WmiApRpl" in DLL "C:\WINDOWS\System32\wbem\wmiaprpl.dll"
has taken longer than the established wait time to complete. There may be a problem
with this extensible counter or the service it is collecting data from or the system
may have been very busy when this call was attempted.

[ System Events ]
Error - 1/16/2012 9:29:50 AM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7000
Description = The Terminal Services service failed to start due to the following
error: %%1053

Error - 1/16/2012 9:37:37 AM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Terminal Services service
to connect.

Error - 1/16/2012 9:37:37 AM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7000
Description = The Terminal Services service failed to start due to the following
error: %%1053

Error - 1/16/2012 9:37:37 AM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7001
Description = The Fast User Switching Compatibility service depends on the Terminal
Services service which failed to start because of the following error: %%1053

Error - 1/16/2012 12:43:07 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083

Error - 1/16/2012 12:43:07 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Terminal Services service
to connect.

Error - 1/16/2012 12:43:07 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7000
Description = The Terminal Services service failed to start due to the following
error: %%1053

Error - 1/16/2012 12:43:07 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7001
Description = The Fast User Switching Compatibility service depends on the Terminal
Services service which failed to start because of the following error: %%1053

Error - 1/16/2012 12:43:07 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Terminal Services service
to connect.

Error - 1/16/2012 12:43:07 PM | Computer Name = SUN-6H5NHFR7L5C | Source = Service Control Manager | ID = 7000
Description = The Terminal Services service failed to start due to the following
error: %%1053


< End of report >
 
OTL logfile created on: 1/16/2012 11:52:45 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 1 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2800.1106)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

509.80 Mb Total Physical Memory | 294.80 Mb Available Physical Memory | 57.83% Memory free
1.22 Gb Paging File | 1.06 Gb Available in Paging File | 87.27% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 83.87 Gb Total Space | 79.40 Gb Free Space | 94.68% Space Free | Partition Type: NTFS
Drive D: | 65.18 Gb Total Space | 61.28 Gb Free Space | 94.01% Space Free | Partition Type: NTFS

Computer Name: SUN-6H5NHFR7L5C | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/01/16 11:47:06 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe
PRC - [2011/04/08 14:59:52 | 000,507,624 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2006/01/11 17:08:36 | 000,577,536 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe
PRC - [2004/06/04 05:14:39 | 000,094,208 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
PRC - [2004/06/04 04:58:22 | 000,057,344 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
PRC - [2003/05/15 03:19:50 | 000,217,193 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
PRC - [2003/03/31 07:00:00 | 001,004,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003/03/31 07:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\conime.exe
PRC - [2002/10/23 12:15:08 | 000,086,016 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe


========== Modules (No Company Name) ==========

MOD - [2004/03/23 17:02:20 | 000,032,768 | ---- | M] () -- C:\WINDOWS\system32\LXPRMON.DLL
MOD - [2004/02/12 10:09:02 | 000,075,264 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBTPP5C.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (xmlprov)
SRV - File not found [Auto | Stopped] -- -- (wscsvc)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2004/02/20 14:10:08 | 000,421,888 | ---- | M] (Lexmark International, Inc.) [On_Demand | Stopped] -- C:\WINDOWS\System32\lxbtcoms.exe -- (lxbt_device)
SRV - [2003/03/31 07:00:00 | 000,047,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\mspmspsv.dll -- (WmdmPmSp)
SRV - [2002/09/27 13:56:20 | 000,139,264 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- c:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)


========== Driver Services (SafeList) ==========

DRV - [2006/02/08 17:44:00 | 003,846,016 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2003/03/31 07:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [2002/10/16 02:11:22 | 000,019,968 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL)
DRV - [2002/10/15 02:00:00 | 000,101,431 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\IdeChnDr.sys -- (IdeChnDr) Intel(R)
DRV - [2002/10/15 02:00:00 | 000,013,891 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\IdeBusDr.sys -- (IdeBusDr)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-73586283-2025429265-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp?client=aff-ime
IE - HKU\S-1-5-21-73586283-2025429265-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-73586283-2025429265-839522115-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/30 19:49:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/10/01 11:52:41 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2011/11/09 08:49:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/12/30 19:49:09 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/09/28 19:26:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/09 08:49:11 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/01/15 11:59:26 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx ()
O3 - HKU\S-1-5-21-73586283-2025429265-839522115-500\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Lexmark 5200 series] C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [LXBTCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.DLL (Lexmark International, Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-73586283-2025429265-839522115-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-73586283-2025429265-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-73586283-2025429265-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-73586283-2025429265-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26430B90-B46D-4BDF-B77E-E27A5372CD89}: DhcpNameServer = 192.168.254.254
O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/10/01 00:13:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/12 16:37:40 | 004,384,281 | R--- | C] (Swearware) -- C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2012/01/12 16:33:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\bootkit_remover
[2012/01/08 20:26:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/01/08 20:24:05 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/01/08 20:24:05 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/01/08 20:24:05 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/01/08 20:24:05 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/01/08 20:23:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/01/08 20:23:52 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/01/08 14:17:40 | 000,000,000 | ---D | C] -- C:\FRST
[2012/01/06 21:34:19 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Videos
[2012/01/06 21:34:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools
[2012/01/06 21:18:14 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2012/01/06 21:16:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2012/01/06 21:16:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/06 21:16:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/01/06 21:16:47 | 000,018,800 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/01/06 21:16:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/01/06 20:36:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\patent 3
[2012/01/06 20:33:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\resume 2
[2012/01/06 19:14:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
[2012/01/04 16:31:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Google
[2012/01/04 16:18:27 | 000,000,000 | -HSD | C] -- C:\WINDOWS\assembly
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/16 11:41:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/01/16 08:28:05 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/01/15 11:59:26 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/01/15 11:50:38 | 004,384,281 | R--- | M] (Swearware) -- C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2012/01/08 22:31:29 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\SystemLook.exe
[2012/01/08 20:37:45 | 000,314,644 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/01/08 20:37:45 | 000,040,972 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/01/08 20:26:11 | 000,000,310 | RHS- | M] () -- C:\boot.ini
[2012/01/08 14:04:56 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/01/06 21:16:52 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/04 16:23:48 | 000,265,416 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/08 22:31:20 | 000,139,264 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\SystemLook.exe
[2012/01/08 20:26:11 | 000,000,194 | ---- | C] () -- C:\Boot.bak
[2012/01/08 20:26:08 | 000,245,920 | RHS- | C] () -- C:\cmldr
[2012/01/08 20:24:05 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/01/08 20:24:05 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/01/08 20:24:05 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/01/08 20:24:05 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/01/08 20:24:05 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/01/08 14:04:56 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/01/06 21:16:52 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/06 20:22:43 | 000,001,619 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2012/01/06 20:22:43 | 000,000,763 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Lexmark 5200 Series All-In-One Center.lnk
[2012/01/06 20:22:43 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/01/06 20:22:42 | 000,001,824 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2012/01/06 20:22:42 | 000,001,758 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 6.0 Standard.lnk
[2012/01/06 20:22:42 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/01/06 20:22:42 | 000,000,813 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/01/06 20:22:42 | 000,000,788 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/01/06 20:22:42 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/01/06 20:22:42 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/01/06 20:22:41 | 000,001,855 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN Explorer.lnk
[2012/01/06 20:22:41 | 000,001,832 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Acrobat 6.0 Standard.lnk
[2012/01/06 20:22:41 | 000,001,818 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Acrobat Distiller 6.0.lnk
[2012/01/06 20:22:41 | 000,001,691 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\ABBYY FineReader 5.0 Sprint Plus.lnk
[2012/01/06 20:22:41 | 000,000,838 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2012/01/06 20:22:41 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/10/01 11:33:39 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/10/01 11:17:59 | 000,008,704 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/01 11:01:49 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL
[2011/10/01 11:01:49 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL
[2011/10/01 10:59:40 | 000,139,264 | R--- | C] () -- C:\WINDOWS\System32\lxbtcoin.dll
[2011/10/01 10:59:40 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\lxbtsnls.dll
[2011/10/01 10:59:39 | 000,001,832 | R--- | C] () -- C:\WINDOWS\System32\lxbtprod.ini
[2011/10/01 00:19:24 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/10/01 00:09:24 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/09/30 23:55:49 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2011/09/30 23:55:11 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2011/09/30 17:59:05 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/09/30 17:58:11 | 000,265,416 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/03/10 05:02:14 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\lxbthwdf.dll
[2004/02/05 13:30:24 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxbtih.exe
[2003/06/23 11:06:02 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbtvs.dll
[2003/03/31 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/03/31 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 07:00:00 | 000,314,644 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/03/31 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 07:00:00 | 000,152,576 | ---- | C] () -- C:\WINDOWS\System32\qasf.dll
[2003/03/31 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 07:00:00 | 000,040,972 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/03/31 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 07:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2003/03/31 07:00:00 | 000,004,573 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/03/31 07:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/03/31 07:00:00 | 000,001,740 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2003/03/31 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/01/07 17:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/10/07 20:15:36 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========


========== Purity Check ==========



========== Custom Scans ==========


< >

< %SYSTEMDRIVE%\*.* >
[2011/09/30 23:55:53 | 000,001,056 | ---- | M] () -- C:\ALCSetup.log
[2011/10/01 00:13:34 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2011/10/01 00:02:16 | 000,000,194 | ---- | M] () -- C:\Boot.bak
[2012/01/08 20:26:11 | 000,000,310 | RHS- | M] () -- C:\boot.ini
[2002/08/29 01:05:56 | 000,245,920 | RHS- | M] () -- C:\cmldr
[2012/01/15 12:04:12 | 000,007,109 | ---- | M] () -- C:\ComboFix.txt
[2011/10/01 00:13:34 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2011/10/01 00:13:34 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/10/01 11:00:11 | 000,000,100 | ---- | M] () -- C:\lxbt.log
[2011/10/01 00:13:34 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2003/03/31 07:00:00 | 000,047,580 | RHS- | M] () -- C:\NTDETECT.COM
[2003/03/31 07:00:00 | 000,233,632 | RHS- | M] () -- C:\ntldr
[2012/01/16 11:41:18 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
[2012/01/08 11:19:32 | 000,013,606 | ---- | M] () -- C:\TDSSKiller.2.6.25.0_08.01.2012_11.17.12_log.txt
[2012/01/08 11:20:35 | 000,001,846 | ---- | M] () -- C:\TDSSKiller.2.6.25.0_08.01.2012_11.20.27_log.txt
[2012/01/08 11:20:58 | 000,013,606 | ---- | M] () -- C:\TDSSKiller.2.6.25.0_08.01.2012_11.20.44_log.txt

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2011/10/01 00:13:14 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/02/12 10:09:02 | 000,075,264 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBTPP5C.DLL
[2003/06/18 19:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2011/09/30 17:57:35 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2011/09/30 17:57:35 | 000,626,688 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2011/09/30 17:57:35 | 000,409,600 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/10/01 00:13:35 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/10/01 00:20:30 | 000,000,139 | -HS- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2011/10/01 00:20:28 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/01/15 11:50:38 | 004,384,281 | R--- | M] (Swearware) -- C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2012/01/08 22:31:29 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\SystemLook.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/10/01 00:20:28 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Administrator\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2012/01/16 11:46:26 | 000,032,768 | ---- | M] () -- C:\Documents and Settings\Administrator\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2003/03/31 07:00:00 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2003/03/31 07:00:00 | 000,005,102 | ---- | M] () -- C:\Program Files\Messenger\logo.gif
[2003/03/31 07:00:00 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/08/20 14:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/08/20 14:32:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2002/08/20 15:39:42 | 000,109,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2002/08/20 17:08:36 | 000,221,215 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2002/08/20 17:08:38 | 001,511,453 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2002/08/20 17:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
[2003/03/31 07:00:00 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2003/03/31 07:00:00 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2003/03/31 07:00:00 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2003/03/31 07:00:00 | 000,203,112 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\rtcimsp.dll
[2002/08/20 14:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >
 
Good :)

Uninstall McAfee Security Scan, typical foistware.

You're not running any AV program.
Install ONE of these:
- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
- free Microsoft Security Essentials: http://windows.microsoft.com/en-GB/windows/products/security-essentials
- free Comodo Antivirus: http://www.comodo.com/home/internet-security/antivirus.php
Update, run full scan, report on any findings.

================================================================

OTL log is clean.

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Do NOT post JavaRa log.

============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


3. Download Temp File Cleaner (TFC)
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


4. Please run a free online scan with the ESET Online Scanner

  • Disable your antivirus program
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Click Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click on List of found threats
  • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • NOTE. If Eset won't find any threats, it won't produce any log.
 
Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 1 x86
Out of date service pack!!
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:

Windows Security Center service is not running! This report may not be accurate!
avast! Free Antivirus
ESET Online Scanner v3
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:

Java(TM) 6 Update 30
Adobe Flash Player 11.1.102.55
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent

AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
``````````End of Log````````````





Farbar Service Scanner Version: 18-01-2012 01
Ran by Administrator (administrator) on 20-01-2012 at 12:13:47
Microsoft Windows XP Professional Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.
Checking LEGACY_wscsvc: Attention! Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


Windows Update:
===========
BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.


File Check:
========
C:\WINDOWS\System32\dhcpcsvc.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0099840 ____A (Microsoft Corporation) AFBBF93EFA9E38A676C6F466EDCF1CF9

C:\WINDOWS\System32\Drivers\afd.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0131968 ____A (Microsoft Corporation) 51B1872B62D1C335BAC53313913C8D5B

C:\WINDOWS\System32\Drivers\netbt.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0157056 ____A (Microsoft Corporation) D96F3BC5A6E7452B0E3275B560DC8528

C:\WINDOWS\System32\Drivers\tcpip.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0332928 ____A (Microsoft Corporation) 244A2F9816BC9B593957281EF577D976

C:\WINDOWS\System32\Drivers\ipsec.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0057984 ____A (Microsoft Corporation) 1C4802409CFD4A7051F458B744CFCAA5

C:\WINDOWS\System32\dnsrslvr.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0044032 ____A (Microsoft Corporation) 56EBC522D52FC5E526E8860A5A810D98

C:\WINDOWS\System32\ipnathlp.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0435200 ____A (Microsoft Corporation) 7A885D70778358142FC40354E29D51A7

C:\WINDOWS\System32\netman.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0154112 ____A (Microsoft Corporation) E7FF9267BBEB1386975278A27378526F

C:\WINDOWS\System32\wbem\WMIsvc.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) 659357580135726E46E3F8084512E3FA

C:\WINDOWS\System32\srsvc.dll
[2011-10-01 00:09] - [2003-03-31 07:00] - 0158720 ____A (Microsoft Corporation) 38E9CFAC7881435764051FD7B1F010FB

C:\WINDOWS\System32\Drivers\sr.sys
[2011-10-01 00:09] - [2003-03-31 07:00] - 0069248 ____A (Microsoft Corporation) CD952661DBDF31C42E325A06BC67FD0E

Attention! C:\WINDOWS\System32\wscsvc.dll is missing.
C:\WINDOWS\System32\wbem\WMIsvc.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) 659357580135726E46E3F8084512E3FA

C:\WINDOWS\System32\wuauserv.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0009216 ____A (Microsoft Corporation) B85D727AA4DE3BF6BEBEA364A250FCDA

C:\WINDOWS\System32\qmgr.dll
[2011-10-01 00:10] - [2003-03-31 07:00] - 0221696 ____A (Microsoft Corporation) 6A1CF14D0E7D0B2241F552223769C8A7

C:\WINDOWS\System32\es.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0225280 ____A (Microsoft Corporation) C9702DDD814C39DC1254CF757C31C6E4

C:\WINDOWS\System32\cryptsvc.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0053248 ____A (Microsoft Corporation) 41C70161BFCB17E7E12ED89BADD2AEF4

C:\WINDOWS\System32\svchost.exe
[2003-03-31 07:00] - [2003-03-31 07:00] - 0012800 ____A (Microsoft Corporation) 0F7D9C87B0CE1FA520473119752C6F79

C:\WINDOWS\System32\rpcss.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0260608 ____A (Microsoft Corporation) 493FCBED180DCACF0B5D4C8C29949CA9

C:\WINDOWS\System32\services.exe
[2003-03-31 07:00] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) E3DF4A0252D287C44606EE55355E1623


Extra List:
=======
aswTdi(8) Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x080000000500000001000000020000000300000004000000080000000600000007000000
IpSec Tag value is correct.

**** End of log ****
 
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\netbt.sys.vir a variant of Win32/Rootkit.Kryptik.HJ trojan cleaned by deleting - quarantined
 
Good.

We still have couple of issues.
Let's start with missing system file (wscsvc.dll).

Please run Farbar Service Scanner FSS).
Type the following in the edit box after "Search:".

wscsvc.dll

Click Search Files button and post the log (FSS.txt) it makes to your reply.
 
Farbar Service Scanner Version: 18-01-2012 01
Ran by Administrator (administrator) on 21-01-2012 at 12:05:13
Microsoft Windows XP Service Pack 1 (X86)

************************************************
================== Search: "wscsvc.dll" ===================

====== End Of Search ======
 
Farbar Service Scanner Version: 18-01-2012 01
Ran by Administrator (administrator) on 21-01-2012 at 19:13:22
Microsoft Windows XP Professional Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error: Google IP is offline
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.
Checking LEGACY_wscsvc: Attention! Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


Windows Update:
===========
BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.


File Check:
========
C:\WINDOWS\System32\dhcpcsvc.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0099840 ____A (Microsoft Corporation) AFBBF93EFA9E38A676C6F466EDCF1CF9

C:\WINDOWS\System32\Drivers\afd.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0131968 ____A (Microsoft Corporation) 51B1872B62D1C335BAC53313913C8D5B

C:\WINDOWS\System32\Drivers\netbt.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0157056 ____A (Microsoft Corporation) D96F3BC5A6E7452B0E3275B560DC8528

C:\WINDOWS\System32\Drivers\tcpip.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0332928 ____A (Microsoft Corporation) 244A2F9816BC9B593957281EF577D976

C:\WINDOWS\System32\Drivers\ipsec.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0057984 ____A (Microsoft Corporation) 1C4802409CFD4A7051F458B744CFCAA5

C:\WINDOWS\System32\dnsrslvr.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0044032 ____A (Microsoft Corporation) 56EBC522D52FC5E526E8860A5A810D98

C:\WINDOWS\System32\ipnathlp.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0435200 ____A (Microsoft Corporation) 7A885D70778358142FC40354E29D51A7

C:\WINDOWS\System32\netman.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0154112 ____A (Microsoft Corporation) E7FF9267BBEB1386975278A27378526F

C:\WINDOWS\System32\wbem\WMIsvc.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) 659357580135726E46E3F8084512E3FA

C:\WINDOWS\System32\srsvc.dll
[2011-10-01 00:09] - [2003-03-31 07:00] - 0158720 ____A (Microsoft Corporation) 38E9CFAC7881435764051FD7B1F010FB

C:\WINDOWS\System32\Drivers\sr.sys
[2011-10-01 00:09] - [2003-03-31 07:00] - 0069248 ____A (Microsoft Corporation) CD952661DBDF31C42E325A06BC67FD0E

C:\WINDOWS\System32\wscsvc.dll
[2012-01-21 19:12] - [2012-01-21 19:12] - 0080896 ____A (Microsoft Corporation) E7B0DC69DF7F9D268DAECE02E71801B3

C:\WINDOWS\System32\wbem\WMIsvc.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) 659357580135726E46E3F8084512E3FA

C:\WINDOWS\System32\wuauserv.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0009216 ____A (Microsoft Corporation) B85D727AA4DE3BF6BEBEA364A250FCDA

C:\WINDOWS\System32\qmgr.dll
[2011-10-01 00:10] - [2003-03-31 07:00] - 0221696 ____A (Microsoft Corporation) 6A1CF14D0E7D0B2241F552223769C8A7

C:\WINDOWS\System32\es.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0225280 ____A (Microsoft Corporation) C9702DDD814C39DC1254CF757C31C6E4

C:\WINDOWS\System32\cryptsvc.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0053248 ____A (Microsoft Corporation) 41C70161BFCB17E7E12ED89BADD2AEF4

C:\WINDOWS\System32\svchost.exe
[2003-03-31 07:00] - [2003-03-31 07:00] - 0012800 ____A (Microsoft Corporation) 0F7D9C87B0CE1FA520473119752C6F79

C:\WINDOWS\System32\rpcss.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0260608 ____A (Microsoft Corporation) 493FCBED180DCACF0B5D4C8C29949CA9

C:\WINDOWS\System32\services.exe
[2003-03-31 07:00] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) E3DF4A0252D287C44606EE55355E1623


Extra List:
=======
aswTdi(8) Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x080000000500000001000000020000000300000004000000080000000600000007000000
IpSec Tag value is correct.

**** End of log ****
 
Very well.

You still have an issue with Security Center due to missing registry key.

Following steps involve registry editing. Please create new restore point before proceeding!!!
How to:
XP - http://support.microsoft.com/kb/948247
Vista and Seven - http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/



Please go to Start=>Run (alternatively use Windows key+R), type regedit and click OK.
Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
Right-Click Root and select Permissions...
Under Security type while Everyone is selected put a check mark in the box under Allow next to Full Control.
Click Apply and OK.
Download XP.zip file from here: http://www.smartestcomputing.us.com/files/download/9-registry-network-keys/
Unzip downloaded file.
You'll find several files inside.
Double-click legacy_wscsvc.reg and confirm the prompt.
Please go back to the the Root key again while Everyone is selected remove check mark in the box under Allow next to Full Control and close the registry.
Restart computer.
See if you can access Security Center.
Post new FSS log.
 
i am sp1 so i dont have it. also, i dont update to sp2 because it slows down my computer.
Farbar Service Scanner Version: 18-01-2012 01
Ran by Administrator (administrator) on 21-01-2012 at 22:24:15
Microsoft Windows XP Professional Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
===========

File Check:
========
C:\WINDOWS\System32\dhcpcsvc.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0099840 ____A (Microsoft Corporation) AFBBF93EFA9E38A676C6F466EDCF1CF9

C:\WINDOWS\System32\Drivers\afd.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0131968 ____A (Microsoft Corporation) 51B1872B62D1C335BAC53313913C8D5B

C:\WINDOWS\System32\Drivers\netbt.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0157056 ____A (Microsoft Corporation) D96F3BC5A6E7452B0E3275B560DC8528

C:\WINDOWS\System32\Drivers\tcpip.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0332928 ____A (Microsoft Corporation) 244A2F9816BC9B593957281EF577D976

C:\WINDOWS\System32\Drivers\ipsec.sys
[2003-03-31 07:00] - [2003-03-31 07:00] - 0057984 ____A (Microsoft Corporation) 1C4802409CFD4A7051F458B744CFCAA5

C:\WINDOWS\System32\dnsrslvr.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0044032 ____A (Microsoft Corporation) 56EBC522D52FC5E526E8860A5A810D98

C:\WINDOWS\System32\ipnathlp.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0435200 ____A (Microsoft Corporation) 7A885D70778358142FC40354E29D51A7

C:\WINDOWS\System32\netman.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0154112 ____A (Microsoft Corporation) E7FF9267BBEB1386975278A27378526F

C:\WINDOWS\System32\wbem\WMIsvc.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) 659357580135726E46E3F8084512E3FA

C:\WINDOWS\System32\srsvc.dll
[2011-10-01 00:09] - [2003-03-31 07:00] - 0158720 ____A (Microsoft Corporation) 38E9CFAC7881435764051FD7B1F010FB

C:\WINDOWS\System32\Drivers\sr.sys
[2011-10-01 00:09] - [2003-03-31 07:00] - 0069248 ____A (Microsoft Corporation) CD952661DBDF31C42E325A06BC67FD0E

C:\WINDOWS\System32\wscsvc.dll
[2012-01-21 19:12] - [2012-01-21 19:12] - 0080896 ____A (Microsoft Corporation) E7B0DC69DF7F9D268DAECE02E71801B3

C:\WINDOWS\System32\wbem\WMIsvc.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) 659357580135726E46E3F8084512E3FA

C:\WINDOWS\System32\wuauserv.dll
[2011-10-01 00:02] - [2003-03-31 07:00] - 0009216 ____A (Microsoft Corporation) B85D727AA4DE3BF6BEBEA364A250FCDA

C:\WINDOWS\System32\qmgr.dll
[2011-10-01 00:10] - [2003-03-31 07:00] - 0221696 ____A (Microsoft Corporation) 6A1CF14D0E7D0B2241F552223769C8A7

C:\WINDOWS\System32\es.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0225280 ____A (Microsoft Corporation) C9702DDD814C39DC1254CF757C31C6E4

C:\WINDOWS\System32\cryptsvc.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0053248 ____A (Microsoft Corporation) 41C70161BFCB17E7E12ED89BADD2AEF4

C:\WINDOWS\System32\svchost.exe
[2003-03-31 07:00] - [2003-03-31 07:00] - 0012800 ____A (Microsoft Corporation) 0F7D9C87B0CE1FA520473119752C6F79

C:\WINDOWS\System32\rpcss.dll
[2003-03-31 07:00] - [2003-03-31 07:00] - 0260608 ____A (Microsoft Corporation) 493FCBED180DCACF0B5D4C8C29949CA9

C:\WINDOWS\System32\services.exe
[2003-03-31 07:00] - [2003-03-31 07:00] - 0101376 ____A (Microsoft Corporation) E3DF4A0252D287C44606EE55355E1623


Extra List:
=======
aswTdi(8) Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x080000000500000001000000020000000300000004000000080000000600000007000000
IpSec Tag value is correct.

**** End of log ****
 
i am sp1 so i dont have it
You don't have what?
Installing SP 2 and SP 3 is a must.

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current (including Service Pack 3 installation and updating Internet Explorer to version 8!!!)

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.
 
Back